Windows Deployment Error Diagnostic Guide

Windows Vista Deployment Error
Diagnostic Guide
Microsoft Corporation
Last Updated: September 2007
Applies to:
 Windows Vista® operating systems
Summary: Provides information for OEM and Corporations to diagnose Windows

Vista® deployment errors that are related to Windows Setup and Package Manager.
The information contained in this document represents the current view of Microsoft Corporation on the issues
discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it
should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the
accuracy of any information presented after the date of publication.
MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS

DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under
copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or
transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or
for any purpose, without the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights
covering subject matter in this document. Except as expressly provided in any written license agreement from
Microsoft, the furnishing of this document does not give you any license to these patents, trademarks,
copyrights, or other intellectual property.
Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses,
logos, people, places and events depicted herein are fictitious, and no association with any real company,
organization, product, domain name, e-mail address, logo, person, place or event is intended or should be
inferred.
Microsoft does not make any representation or warranty regarding specifications in this document or any
product or item developed based on these specifications. Microsoft disclaims all express and implied
warranties, including but not limited to the implied warranties or merchantability, fitness for a particular
purpose and freedom from infringement. Without limiting the generality of the foregoing, Microsoft does not
make any warranty of any kind that any item developed based on these specifications, or any portion of a
specification, will not infringe any copyright, patent, trade secret or other intellectual property right of any
person or entity in any country. It is your responsibility to seek licenses for such intellectual property rights
where appropriate. Microsoft shall not be liable for any damages arising out of or in connection with the use of
these specifications, including liability for lost profit, business interruption, or any other damages whatsoever.
Some states do not allow the exclusion or limitation of liability or consequential or incidental damages; the
above limitation may not apply to you.
© 2007 Microsoft Corporation. All rights reserved.
Microsoft, MS-DOS, Windows, Windows Media, Windows NT, Windows Server, Windows Vista, Active
Directory, ActiveSync, ActiveX, Direct3D, DirectDraw, DirectInput, DirectMusic, DirectPlay, DirectShow,
DirectSound, DirectX, Expression, FrontPage, HighMAT, Internet Explorer, JScript, Microsoft Press, MSN,
NetShow, Outlook, PlaysForSure logo, PowerPoint, SideShow, Visual Basic, Visual C++, Visual InterDev, Visual
J++, Visual Studio, WebTV, Win32, and Win32s are either registered trademarks or trademarks of Microsoft
Corporation in the U.S.A. and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective
owners.
Contents
Contents .............................................................................................................................. 3
Introduction ......................................................................................................................... 4
Logging Process ................................................................................................................. 4
Error Types ......................................................................................................................... 4
Component-Based Servicing (CBS) Errors ......................................................................... 5
Syntax of CBS Error Messages ...................................................................................... 5
Versions and Elevation Values ....................................................................................... 6
Install State ..................................................................................................................... 7
Message Types .............................................................................................................. 7
CBS Error Codes............................................................................................................... 15
CBS Event Messages ....................................................................................................... 21
Description of Events.................................................................................................... 21
Description of Detailed Information............................................................................... 22
Component-Servicing Infrastructure (CSI) Errors .............................................................. 25
CSI Error Codes ........................................................................................................... 26
Settings Management Infrastructure (SMI) Errors ............................................................. 38
Format of SMI Error Messages/Warning ...................................................................... 39
SMI Error Messages ..................................................................................................... 40
Windows Update Errors .................................................................................................... 42
Device Management Infrastructure (DMI) Errors ............................................................... 43
Generating a separate driver log file............................................................................. 43
DMI Error Messages..................................................................................................... 43
Additional Information........................................................................................................ 44
Introduction
This document describes how to diagnose error logs related to deploying Windows
Vista®, specifically how to interpret errors related to Windows Setup (Setup.exe) and
Package Manager (Pkgmgr.exe).
Logging Process
If an error occurs during Windows Setup, then the following .log files are automatically
created:
%WINDIR%\panther\setupact.log \\ Full Log
%WINDIR%\panther\setuperr.log \\ Errors only
If an error occurs when you run Package Manager manually with the logging option (/l),
a log file is created in the specified location. For example,
Start /w pkgmgr.exe /ip /m:\\myserver\share\myfix.cab /s:c:\sandbox
/l:c:\logs\mylog.log
If a location is not specified, then a default Component-Based Servicing (CBS) log file is
created at the following location.
%WINDIR%\logs\cbs\cbs.log
If the CBS log becomes more than 50 megabytes (MB) in size, it is truncated. The
truncated portion is stored at the following location.
%WINDIR%\logs\cbs.persist.log
The Windows Update log also contains CBS errors as well as Windows update errors.
This log file is created at the following location.
%WINDIR%\windowsupdate.log
Important If you attempt to service an offline Windows image and Package Manager
returns an error, the Windows image may be corrupt. The Windows image you are
attempting to service should be discarded. This is necessary because if the Windows
image is corrupt, subsequent attempts to service the image may not return an error, and
you may ship a Windows image that is corrupt. Servicing operations for corrupt images
may result in the failure to apply subsequent critical patches. As a best practice, when
you receive an error using Package Manager, discard the current Windows image and
start again with the last known valid Windows image. When servicing your offline
Windows image, ensure that all offline servicing actions are successful. If there are any
failures, discard the potentially corrupt Windows image.
Error Types
Log files can contain the following error types:
 Component-Based Servicing (CBS) Errors – Errors related to servicing Windows

Vista packages and applicability.
 Component-Servicing Infrastructure (CSI) Errors – Errors related to servicing
Windows Vista component sets within a package.
 Settings Management Infrastructure (SMI) Errors – Errors related to setting
configuration, such as in an answer file.

Windows Vista Deployment Error Diagnostic Guide 5
 Device Management Infrastructure (DMI) Errors – Errors related to offline

installation of out-of-box drivers.
 Windows Update (WU) Errors – Errors related to servicing of the operating system
through Windows Update.
Log files can also contain system errors in the hexadecimal format 0x8007nnnn. To find
additional error information, perform the following procedure:
1. Click Start, click Run, and then type Calc.exe.

2. Ensure that the calculator is in Scientific view, click Hex (for hexidecimal), enter the
last four numbers in hexadecimal form, and then click Dec to convert the number to
decimal.
3. At this Microsoft Web site, search ―System Error Codes‖ on the MSDN Web site
(http://go.microsoft.com/fwlink/?LinkId=83027) for the decimal code.
For example, for error 0X80070490, convert 0490 to a decimal (1168), and then search
System Error Codes for 1168.
Component-Based Servicing (CBS) Errors

To find CBS-related errors, search the log file for the word ―Error.‖ CBS errors can be
either:
 CBS related errors with the format 0x800fnnnn

 System error codes with the format 0x8007nnnn (as discussed in the previous
section)
Important If you open a CBS log file and it is missing CBS-related information, you
might need to enable logging by setting the following registry key:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing]

EnableLog=dword:00000001
This ensures that the CBS log contains all possible information about what occurred.
When you find a CBS error, use the following information about the syntax, versions,
elevation levels, and common errors to diagnose the problem.
Syntax of CBS Error Messages

The basic syntax of CBS logged entries is:
<TimeStamp> <Severity> <Component> <Type>: <Description>
Parameter Description
<TimeStamp> Specifies the date and time that the error occurred.
<Severity> Specifies the severity of the event. Values are Info, Warning,
and Error.
<Component> Specifies the component that logged the message. For the CBS
log, this is either CBS or CSI.

<Type> Specifies the type of operation that the message is about.

Examples include:
 Appl - Messages about checking the applicability of the
update.
 Exec - Messages about when operations on the
packages and updates are being processed.
 Plan - Messages about what is being planned for this
session.
 Session - Messages that describe when a session has
started, when it stops, and if a reboot is required.
 Shtd - Messages about shutting down the Trusted
Installer.
 Startup - Messages about the startup phase of the
servicing stack when it is initiated.
 WatchList - Messages that are logged by the Watchlist
feature.
<Description> Describes the log entry. This description may contain CBS or
system error codes if an error occurred during an operation. For
example: Doqe: Failed writing driver operations queue with
hr: [HexadecimalErrorCode].
Example
The following example is an informative log of an event that happened at 3:16 PM on the
June 7, 2006. It indicates that the service state started processing and has registered for
notification of user logon..
2006-06-07 15:16:41, Info CBS Startup: Begin processing,
registering for winlogon notification.
Versions and Elevation Values

The version of a component is divided into four parts with the following syntax:
Major.Minor.Build.Revision. Revision can be either a distribution or a revision, as in the
elevation values table that follows the code examples.
When you upgrade a component, the type of upgrade is indicated by an elevation value.
The elevation value indicates which part of the version was upgraded. Errors in the CBS
log can contain the version of a component and/or an elevation code.
In the following example, the version is 6.0.5520.20481.

deltapackageexpander.d_31bf3856ad364e35_6.0.5520.20481_none_4b6cb59
c880b8306.manifest>. hr: 0x800f081f
A package can have an elevation type that is a combination of one or more of the
following.

Elevation Type Value Description

Version 32 Specifies the elevation of the major version of the component.
For example, upgrading from version 1.0 to version 2.0.
It can also specify the elevation of the minor version of the
component. Example: .Upgrading from version 1.1 to
version 1.2.
ServiceLevel 16 Specifies the elevation of the service pack level. Example
When a package moves from an RTM service level to an SP1
service level.
Build 8 Specifies the elevation of the build number. Example:
Upgrading from build 6.0.5000.0 to 6.0.5001.0.
Distribution 4 Specifies the elevation of the distribution branch. Example:
upgrading from the RTMGDR branch to the RTMQFE branch.
Revision 2 Specifies the elevation of the revision part of the version (which
is typically a fix for the component). Example: Upgrading from
6.0.5000.0 to 6.0.5000.1.
Install 128 Specifies that there is no previous version of the component.
Example: Installing a package for the first time on a computer.
Install State
CBS errors can also contain information about the state of an installation. The following
table outlines the values for the state of the installation:
Install State Value Description

Superseded -17 Specifies that this update has been replaced by another update.
Absent 0 Specifies that the manifest is not on the computer.
Resolved 2 Specifies that all the manifests are present on the computer, but the
files are not installed or staged.
Staged 4 Specifies that all the manifests and files are present on the
computer, but the files are not projected and are not being used by
the operating system.
UninstallRequested 5 Specifies that the update will be uninstalled after the computer is
restarted.
InstallRequested 6 Specifies that the update will be installed after the computer is
restarted.
Installed 7 Specifies that everything is fully installed.
Message Types
CBS error logs specify the type of operation that the message is about. Operation types
for messages are as follows:
Appl: Messages about the applicability of the update.
Exec: Messages about operations on the packages and updates that are being
processed.
Plan: Messages about what is being planned for the current session.

Session: Messages that describe when a session has started, when it stops, and if a
reboot is required.
Shtdn: Messages about shutting down the Trusted Installer.

Startup: Messages about the start up phase of the servicing stack when it is initiated.
Watchlist: Messages logged by the Watchlist feature.
Appl message examples
The following message specifies that an elevation is required and what the previous
version of the component was.
2006-06-08 16:54:07, Info CBS Appl: Selfupdate,
Component: x86_microsoft-windows-
notepadwin_31bf3856ad364e35_0.0.0.0_none_66a3c28c433749ff
(6.0.5447.1), elevation:2, lower version revision holder: 6.0.5447.0
The following message indicates whether or not the expected level was elevated. The
value APPLICABLE is set to 1 for TRUE or 0 for FALSE, meaning that elevation was
successful or failed, respectively.
2006-06-08 16:54:07, Info CBS Appl: SelfUpdate
detect, component: x86_microsoft-windows-
notepadwin_31bf3856ad364e35_6.0.5447.1_none_71509fa345f5f0fc,
elevation: 2, applicable: 1
This is the evaluation of the non detectUpdate applicability rules.

2006-06-08 16:54:07, Info CBS Appl: Evaluating
applicability block(non detectUpdate part), disposition is: 4,
applicability: 4, result applicability state: 7
This verification follows the same format as the previous verification but evaluates any
detectUpdate applicability in the manifest.
applicability block(detectUpdate part), disposition is: 4,
applicability: 4, result applicability state: 7
In the following message, the results of both verifications are compiled and reported in
the overall applicability.
applicability block, disposition is: 4, applicability: 4, result
applicability state: 7
The following table describes the verification results:
Field Field Description Possible Value Description

Values
Disposition This is the default disposition 0 Absent
state of the update if
2 Resolved
applicability is not fulfilled.
4 Staged
7 Installed
Applicability This is the result of the Not applicable
1
applicability detection.

Non detectUpdate was

2 successful, but detectUpdate
failed.
4 Applicable
Result This is the destination state of 0 Absent
Applicability the update given the default
disposition and the result of the 2 Resolved
applicability check. 4 Staged
7 Installed
In the following message, the applicability is 1, 2, or 4 as described above, but the

Disposition field maps to the Result Applicability field of the earlier messages. Once
applicability has been evaluated, the disposition from the package is updated from the
default disposition authored to the install state determined for the package.
2006-06-08 16:54:07, Info CBS Appl: Package:
000001~31bf3856ad364e35~x86~~6.0.0.1, Update: 000001-1_RTM_GDR,
Applicable: 4, Disposition: 7
This message describes the package being evaluated, its parent, and how the
evaluation is processed.
2006-06-08 16:54:07, Info CBS Appl: detect
Parent, Package: 000001~31bf3856ad364e35~x86~~6.0.0.1, Parent:
Microsoft-Windows-ServerCore-
Package~31bf3856ad364e35~x86~~6.0.5447.0, Disposition = 1003,
VersionComp: 1, ServiceComp: 1, BuildComp: 1, DistributionComp: 1,
RevisionComp: 1, Exist: 1
The following table describes the available fields and lists the possible values:
Field Description Possible Value Description

Values
Package Specifies the package being Not Not applicable
evaluated. applicable
Parent Specifies the parent of the Not Not applicable
package being evaluated. applicable
Disposition Specifies the highest install 0 Absent
state if the value of the parent
applicability returns false. 4 Staged
1003 Detect. This means that the

highest value should be the
current state of the parent
package.
VersionComp Specifies the type of 1 Equal. This field must be equal
comparison performed on the for the applicability to return
version, service pack level, true.
ServiceComp build number, distribution 2 Not equal
branch, revision, and existence
BuildComp of the parent. 3 Greater than or equal to
DistributionComp 4 Greater than
RevisionComp 5 Less than or equal to

Exist 6 Less than
In the previous example, the highest install state is the installation state of the parent, so
there must be an exact match of the entire parent version string.
The last message indicates what parent was searched for and how it was searched for.
The following message provides the result of that search. In this example, the
installation is on a client version of Windows Vista, so the parent searched for
(Microsoft-Windows-ServerCore-...) does not exist, and the returned state is 0 (Absent).
This state is either the currently installed state of the component or the intended state if
the parent has pending operations.
2006-06-08 16:54:07, Info CBS Appl: detectParent
(exact match): package: 000001~31bf3856ad364e35~x86~~6.0.0.1, Parent:
Microsoft-Windows-ServerCore-
Package~31bf3856ad364e35~x86~~6.0.5447.0, parent state: 0
In the next two messages, there is another potential parent (Microsoft-Windows-

Foundation-Packages...) present on the computer, and its install state is 7 (Installed).
Parent, Package: 000001~31bf3856ad364e35~x86~~6.0.0.1, Parent:
Microsoft-Windows-Foundation-
Package~31bf3856ad364e35~x86~~6.0.5447.0, Disposition = 1003,
VersionComp: 1, ServiceComp: 1, BuildComp: 1, DistributionComp: 1,
RevisionComp: 1, Exist: 1
2006-06-08 16:54:07, Info CBS Appl: detectParent

(exact match): package: 000001~31bf3856ad364e35~x86~~6.0.0.1, Parent:
Microsoft-Windows-Foundation-
Package~31bf3856ad364e35~x86~~6.0.5447.0, parent state: 7
Because of previous messages, the package being evaluated has a maximum install
state equal to that of its parent. This package has a parent on the operating system with
an install state of 7. The following message combines both pieces of information and
indicates that the disposition returned from the detectParent part of the applicability
evaluation is 7 (that is, the package must be installed).
Parent, Package: 000001~31bf3856ad364e35~x86~~6.0.0.1, disposition
state from detectParent: 7
If any other part of the applicability evaluation had indicated that the intended state must
be less than 7, then this message must reflect that. In the following example, all
evaluations pointed to a disposition 7, so there is no change.
package applicability for package
000001~31bf3856ad364e35~x86~~6.0.0.1, applicable state: 7
In the following message, the package applicability is evaluated according to its

elevation type. The package to be installed elevates the component listed from version
6.0.5447.0 to version 6.0.5447.1. The Elevate field indicates that a revision update is
possible.
2006-06-08 16:54:08, Info CBS Appl: Selfupdate,
Component: x86_microsoft-windows-
notepad_31bf3856ad364e35_0.0.0.0_none_92f48328b829f7a9 (6.0.5447.1),
elevation:2, lower version revision holder: 6.0.5447.0

The following message specifies a successful revision elevation. If, in the previous
example, an update from version 6.0.5447.0 to 6.0.5448.0 is attempted, then the
applicable state must be 0 because the package is not authored to do a build elevation.
2006-06-08 16:54:08, Info CBS Appl: SelfUpdate
detect, component: x86_microsoft-windows-
notepad_31bf3856ad364e35_6.0.5447.1_none_9da1603fbae89ea6, elevation:
2, applicable: 1
The following message specifies that the package is evaluated for applicability, and that
it must be installed.
package applicability for package
000001~31bf3856ad364e35~x86~~6.0.0.1, applicable state: 7
Exec message examples
Execution (exec) messages are logged as the operations on the packages and updates
that are being processed. Every package and every update in those packages are
categorized as Resolved, Staged, and Installed.
Note that this enables you to correlate the package being installed to the session that
started the installation. It also gives you the name of the client that initiated the session.
2006-06-08 16:54:07, Info CBS Exec: Processing
started. Client: Package Manager, Session: 29789014:3562626901,
Package: 000001~31bf3856ad364e35~x86~~6.0.0.1
The following message provides the package name, the name of the update, and the
name of the component.
2006-06-08 16:54:08, Info CBS Exec: Resolving
Package: 000001~31bf3856ad364e35~x86~~6.0.0.1, Update: 000001-
1_RTM_GDR, PinDeployment: x86_microsoft-windows-
notepadwin.d_31bf3856ad364e35_6.0.5447.1_none_c208895bd7789b76
The files are copied to the WinSxS folder prior to the staging and deployment, but this is
where CBS/CSI both officially recognize that the components are present and ready to
be installed.
2006-06-08 16:54:11, Info CBS Exec: Staging
1_RTM_GDR, PinDeployment: x86_microsoft-windows-
The following message indicates that the operation has been initiated. It would return
Unprojecting if it was an uninstall operation.
2006-06-08 16:54:12, Info CBS Exec: Installing
1_RTM_GDR, InstallDeployment: x86_microsoft-windows-
This particular package requires a reboot to finish installation.

2006-06-08 16:54:18, Info CBS Exec: Pended
transaction, changes will be applied during shutdown/startup
processing.

The following message indicates that the installation process is complete. Note that the
computer has not rebooted so the installation is not yet complete.
complete. Session: 29789014:3562626901, Package:
000001~31bf3856ad364e35~x86~~6.0.0.1, hr: 0x0
The following set of logs is from the uninstallation of the same package, which follows
the same basic format as the previous messages.
Uninstallation has started.

started. Client: Software Explorer, Session: 29789015:1763725385,
Package: 000001~31bf3856ad364e35~x86~~6.0.0.1
The component is removed from the project.

2006-06-08 16:58:18, Info CBS Exec: Unprojecting
1_RTM_GDR, UninstallDeployment: x86_microsoft-windows-
The package and component are unpinned so they can be removed from the store at a
later point.
2006-06-08 16:58:18, Info CBS Exec: Unpinning
1_RTM_GDR, UnpinDeployment: x86_microsoft-windows-
The cleanup of the component is scheduled for system shutdown.

2006-06-08 16:58:22, Info CBS Exec: Scheduled
cleanup processing for shutdown.
The execution phase of the uninstallation of the product is complete.

complete. Session: 29789015:1763725385, Package:
000001~31bf3856ad364e35~x86~~6.0.0.1, hr: 0x0
Plan
Plan messages specify what actions to take in the following session. For example,
2006-06-08 16:54:07, Info CBS Plan: Package:
000001~31bf3856ad364e35~x86~~6.0.0.1, current: Absent, pending:
Default, start: Absent, applicable: Installed, targeted: Installed,
limit: Installed
2006-06-08 16:54:08, Info CBS Plan: Package:
000001~31bf3856ad364e35~x86~~6.0.0.1, Update: 000001-1_RTM_GDR,
current: Absent, pending: Default, start: Absent, intended:
Installed, targeted: Installed, limit: Installed
The following table describes what to expect for these messages:
State Description
Current Describes the current state of the package or update.
Pending Specifies if the operation requires a reboot. In the examples above, this has not yet
been evaluated, so it is set to Default.

Start Defines the phase at which the operation begins on this component.
Applicable Specifies what the applicability evaluation has returned about the target state of this
package. (This is only present for packages.)
Intended Gives the intended target state if the package is installed immediately. (This is only
present for updates.)
Targeted Describes the final intended state of the package or update.
Limit Indicates the highest install state that the package or update can be at and is
determined by evaluating all owners of the package or update.
Session
The session operation type describes when a session has started, when it stops, and if a
reboot is required or not.
2006-06-08 16:19:38, Info CBS Session:
29789010:54683585 initialized.
2006-06-08 16:19:38, Info CBS Session:
29789010:54683585 finalized. Reboot required: no
The session ID is generated from the local time and date stamp of the system.
Shtd
These shutdown (shtd) messages come from the shutdown processing of the
TrustedInstaller service.
Scavenging will only occur if it was previously scheduled as part of an uninstallation.

(See the Exec section for more details.)
2006-06-08 17:06:30, Info CBS Shtd: Initializing
scavenging.
2006-06-08 17:06:40, Info CBS Shtd: Scavenging
complete. hr: 0x0
The following message is logged when shutdown processing is complete.

2006-06-08 17:06:40, Info CBS Shtd: Shutdown
processing complete.
Startup
When the computer starts, the startup phase of the servicing stack is initiated. At this
time, any pending online Advanced Installer (AI) actions are completed, driver
installation is finished, and the package status for any packages that were pending
reboot is updated.
The following message indicates that startup actions are processing, and that logon to
the system is blocked until they have completed.
2006-06-08 16:55:49, Info CBS Startup: Begin
processing, registering for winlogon notification.

These messages indicate that no driver operations were queued up for this boot.
2006-06-08 16:55:49, Info CBS Startup:
Initializing driver operations queue.
2006-06-08 16:55:55, Info CBS Startup: Driver
operations queue is empty. No processing was necessary.
There may be multiple phases in the advanced installer queue. Any information about
the execution of the advanced installers will be logged by CSI immediately following this
line. When reporting errors, it is important not to use startupPhase.
2006-06-08 16:55:49, Info CBS Startup:
Initializing advanced operation queue.
2006-06-08 16:55:50, Info CBS Startup: Processing
advanced operation queue, startupPhase: 0
The following message indicates that the startup processing has completed, winlogon is
notified, and the logon process is allowed to continue.
2006-06-08 16:55:55, Info CBS Startup: received
notification that startup processing completed, allowing user to
logon
The following message indicates that the startup phase has completed successfully.
Clients will now be able to start new sessions with the TrustedInstaller service. Any
errors will be reported by both additional log events and an error code on this line.
2006-06-08 16:55:55, Info CBS Startup: Processing
complete. hr: 0x0
WatchList
The following message indicates that, because of a change to the hearts component
(version 6.0.9952.16395), the applicability of the CBS-Nested-200006-BD package
needs to be re-evaluated. The Change field gives information about the package that
caused the change to the component: It was package CBS-Nested-2006; the
deployment was CBS-Nested-A-200006-1_RTM_GDR; the package has an elevation
type of Revision, and the action type was Install.
2006-06-07 15:17:19, Info CBS WatchList: Add
package CBS-Nested-200006-BD~31bf3856ad364e35~x86~~6.0.0.1.CBS-
Nested-200006-BD-1_RTM_LDR to re-evaluation(install) due to the
change on Component Family: x86_cbs-nested-windows-..l-inboxgames-
hearts_31bf3856ad364e35_0.0.0.0_none_80d4a0d11ae946de, Version:
6.0.9952.16395, change: (Owner: CBS-Nested-
200006~31bf3856ad364e35~x86~~6.0.0.1.CBS-Nested-A-200006-1_RTM_GDR,
Flag: 2, Action: 3)
See the following table for other possible actions:
Value Action Description

0 Undefined Indicates the default value.
1 Pin Marks a staged component so that it will not
be removed from the system the next time
that a cleanup is triggered.
2 Unpin Marks a staged component so that it will be
removed from the system the next time a
cleanup is triggered.

3 Install Indicates that the component was installed.

4 Uninstall Indicates that the component was uninstalled.
Other Messages
The following message is logged every time that the servicing stack is loaded. It
specifies the version of the stack that was picked up and where that stack is located.
2006-06-08 16:19:09, Info CBS Loaded Servicing
Stack v6.0.5447.0 with Core: C:\Windows\winsxs\x86_microsoft-windows-
servicingstack_31bf3856ad364e35_6.0.5447.0_none_37e533c312344440\cbsc
ore.dll
CBS Error Codes

The following table lists CBS errors with additional troubleshooting information.
Error Code Description Resolution

0xf0801 The Trusted Installer service is Retry your operation in a few minutes.
busy and cannot be accessed
at this time. Most likely,
another operation that needs
to complete is using Trusted
Installer.
0xf0802 While adding a source to a There is no further action needed from you.
package, CBS recognized that
the source was already
present. The package may be
minimally malformed (for
example, a .dll may have been
copied twice to the computer),
but the issue is not significant
enough to affect the operation.
0xf0803 Operation succeeded. The Restart the computer to complete the
servicing stack was updated operation.
and the computer needs to
shut down.
0x800f0801 The session must be initialized Close the application you are using to install
before other operations can be this component or update, (for example,
initiated. Windows Update, OCSetup, or Package
Manager), and then start the application and
retry your operation.
0x800f0804 The package to open could not Ensure that you can access the package
be found or could not be and try again.
opened. There are many
possible causes for this error—
for example, there may have
been a network failure or you
may have insufficient rights to
access the package.
0x800f0805 The package is not valid. You Obtain a valid package and try again.
can only install packages
provided to you by Microsoft.

0x800f0806 One or more resources Restart the computer. To ensure that the
required by this update are update is installed, try to apply the update
locked. In most cases, this is again. (Do not apply any other updates at
not a problem because the the same time.)
update is now in a queue, and
it will be installed when your
computer is restarted.
However, some updates
cannot be in a queue and need
to be installed manually.
0x800f0808 The offline image that you are Ensure that you have sufficient rights to the
attempting to modify is not offline image.
accessible.
0x800f080b A package property that is not Search for a Microsoft Knowledge Base
available has been requested. article about this package at this Microsoft
The package may be invalid or Web site
corrupted. (http://go.microsoft.com/fwlink/?LinkID=91203
). You can often find the Knowledge
Base number in the .mum file of the
package (search for KB) or in the error
message. If a Knowledge Base article
does not exist, then download the
package from the Web again and retry
the operation.
0x800f080c An operation has been Search for a Knowledge Base article about
requested for an update that is this package at this Microsoft Web site
not present in the package. (http://go.microsoft.com/fwlink/?LinkID=9120
One of the components that 3). You can often find the Knowledge Base
the package contains may be number in the .mum file of the package
invalid. (search for KB) or in the error message. If a
Knowledge Base article does not exist, then
download the package from the Web again
and retry the operation.
0x800f080e More than one element with Search for a Knowledge Base article
the same name has been about this package at this Microsoft Web
detected in a manifest site
element. The package may be (http://go.microsoft.com/fwlink/?LinkID=91203
invalid or corrupted. ). You can often find the Knowledge
the operation.

0x800f080f A duplicate element has been Search for a Knowledge Base article
detected for an element type about this package at this Microsoft Web
that must be unique. The site
package may be invalid or (http://go.microsoft.com/fwlink/?LinkID=91203
corrupted. ). You can often find the Knowledge
the operation.
0x800f0810 A required attribute was not Search for a Knowledge Base article
defined in the manifest. . The about this package at this Microsoft Web
package may be invalid or site
the operation.
0x800f0811 A required element was not Search for a Knowledge Base article
defined in the manifest. The about this package at this Microsoft Web
package may be invalid or site
the operation.
0x800f0812 CBS attempted to validate a Search for a Knowledge Base article

parent element in the manifest about this package at this Microsoft Web
and failed because the parent site
was not present. The package (http://go.microsoft.com/fwlink/?LinkID=91203
may be invalid or corrupted. ). You can often find the Knowledge
the operation.
0x800f0813 CBS attempted to change the Search for a Knowledge Base article
package to an invalid state. about this package at this Microsoft Web
The package may be invalid or site


the operation.
0x800f0816 The express package has not There is no further action needed from you.
been completely downloaded. Wait until the express package is
The state of the operation has downloaded.
been saved while the package
is downloaded.
0x800f0817 Another package that this Look at the errors around this error in the log
package requires has been to find the package that you need to
uninstalled. reinstall. There should be an error that
indicates which package this package
depends on. Reinstall that package and try
the operation again.
0x800f0818 The manifest contained in this Search for a Knowledge Base article
package does not have the about this package at this Microsoft Web
expected identity. The package site
may be invalid or corrupted. (http://go.microsoft.com/fwlink/?LinkID=91203
the operation.
0x800f0819 A duplicate update has been Search for a Knowledge Base article
found. All update names in the about this package at this Microsoft Web
manifest must be unique. The site
package may be invalid or (http://go.microsoft.com/fwlink/?LinkID=91203
corrupted. ). You can often find the Knowledge
the operation.
0x800f081a The driver operations key is Search for a Knowledge Base article
invalid or corrupt. The package about this package at this Microsoft Web
may be invalid or corrupted. site
(http://go.microsoft.com/fwlink/?LinkID=91203
the operation.

0x800f081b The driver package that you Search for a Knowledge Base article
have attempted to install was about this package at this Microsoft Web
written for an unknown site
architecture type (for example, (http://go.microsoft.com/fwlink/?LinkID=91203
the architecture is not for x64- ). You can often find the Knowledge
based, x86-based, or Itanium- Base number in the .mum file of the
based). The package may be
invalid or corrupted.
the operation.
0x800f081e The package was not Search for a Knowledge Base article
applicable. For example, one about this package at this Microsoft Web
of the nested packages is not site
applicable to Windows PE or a (http://go.microsoft.com/fwlink/?LinkID=91203
package that you were trying ). You can often find the Knowledge
to apply to a Windows PE Base number in the .mum file of the
image is not applicable.
the operation.
0x800f081f A source file or manifest for the Make sure that you have enough disk
package could not be found space, and download the package again.
while the package was being If you continue to receive this error, then
extracted or during the you may have insufficient rights to the
installation. For example, there files on the computer or the package
was a missing manifest for the may be invalid or corrupted.
package in use.
To resolve this, search for a Knowledge
Base article about this package at this
Microsoft Web site
the operation.
0x800f0820 A user has canceled this Requires no further action. This is an

operation. informative message and not an error.
0x800f0821 A client has aborted this Check the logs for the application that you
operation. were using to install (for example OCsetup,
Windows Update, or Package Manager) to
identify why the computer stopped the
operation.
0x800f0822 The package contained a Search for a Knowledge Base article
driver update that did not about this package at this Microsoft Web
specify <updateDriver> in the site

package manifest. The (http://go.microsoft.com/fwlink/?LinkID=91203

package may be invalid or ). You can often find the Knowledge
corrupted. Base number in the .mum file of the
the operation.
0x800f0823 The package requires a Make sure that you have the most recent
version of the stack that is not servicing stack from the Microsoft Download
present on the computer. Center, and run Microsoft Update to see if
you are missing an update. Otherwise,
search for a Knowledge Base article for the
package at this Microsoft Web site
3).
0x800f0824 A source file or manifest for the Requires no further action. This is an
package could not be found informative message and not an error.
when the package was being
removed. The installer (or
another application) may have
already removed the source
files.
0x800f0825 You are trying to uninstall a If you must uninstall this package, then use
package that was installed on System Restore to restore the state of the
the computer and is now computer back to before the package was
permanent. Therefore, this installed.
package cannot be uninstalled.
0x800f0826 Another package in the same Reinstall the package. (Make sure that you
transaction has failed; because do not install another package at the same
of this, all packages in that time.)
transaction have been rolled
back to their last known good
state.
0x800f0827 The operation for your Retry your operation. If you continue to
package was stopped because receive this error code, then restart your
the installation of a servicing computer and try again.
stack update was successful
and the stack must shut down.
0x800f0900 An unexpected internal XML Retry your operation. If you receive the
parser error occurred while same error, restart the computer and try
attempting to read a manifest again. If you continue to receive this
file. error, then the package may be invalid or
corrupted.
In this case, search for a Knowledge

Base article about this package at this
Microsoft Web site


the operation.
0x800f0901 In a given package, only one Search for a Knowledge Base article
updateComponent is allowed about this package at this Microsoft Web
for a component family. site
the operation.
For more information about common CBS errors and additional troubleshooting
information, see the OCSetup Log Diagnoser white paper at this Microsoft Web site
(http://go.microsoft.com/fwlink/?LinkId=84909).
CBS Event Messages

The following describes CBS event messages that can be found in the Event Viewer.
These messages can be used to determine if a package was installed successfully or
failed with an error, if the package was applicable, or whether or not it required a reboot.
All events are written during online servicing scenarios. If a package is applied offline but
requires some online events to complete installation, events are written at the time those
online actions are processed.
Description of Events
Event Event Name Description
ID
4371 CbsPackageInitiateChanges Raised any time that a client starts
changes to the state of a package (for
example, starting an install or uninstall).
4372 CbsPackageChangeState Raised at the time that the transaction
that will change the state is committed.
4373 CbsPackageChangeStateSuccess Raised if the state change completes
successfully.
4374 CbsPackageNotApplicable Raised if the package is not applicable to
the computer.
Resolution
Look at the last error in Cbs.log and
ensure that Applicability:4 is specified in
the message. If the applicability attribute
is not 4, then the package does not apply
to this computer.
Install any dependencies that the
computer is missing, or obtain a valid
package. If you think the package is
applicable, download the package again.
Try the operation again.

4375 CbsPackageChangeStateFailure Raised if a state change failed to

complete.
Resolution
Check the log files.
4376 CbsPackageChangeStateReboot Can only succeed if the system is
rebooted first.
Resolution
Restart the computer.
4383 CbsUpdateChangeStateSuccess Raised when an update has successfully
changed state.
4385 CbsUpdateChangeStateFailure Raised when an update has failed to
change state.
Resolution
Check the log files.
4386 CbsUpdateChangeStateReboot Can only succeed if the system is first
rebooted.
Resolution
Restart the computer.
1 WUSA_EVENT_DEBUG If debug WUSA logging is enabled, these
events will give debug information about
WUSA.EXE execution.
2 USA_EVENT_INSTALLSUCCESS Logged in the admin channel if the
package was successfully installed.
3 WUSA_EVENT_GENERICFAILURE Logged in the admin channel if the
package failed to install.
4 WUSA_EVENT_REBOOTREQUIRED Logged in the admin channel if the
package installation requires a reboot.
5 USA_EVENT_REBOOTINITIATED Logged in the admin channel when a
reboot has been initiated.
Description of Detailed Information
CbsPackageInitiateChanges
Field Data Type Description

identifier Unicode String The short name of the package, identified in the
package by the package/identifier attribute.
releaseType Unicode String The release type of the package, identified in the
package by the package/releaseType attribute.
The following types have been defined:
 Product
 Connector
 Critical Update
 Development Kit
 Driver
 Feature Pack
 Guidance
 Hotfix
 Security Update
 Service Pack

 Software Update
 Tool
 Update
 Update Rollup
 Language Pack
 Foundation
initialPackageStateLoc Unicode String This is the localized human-readable string that
describes the initial install state of the package.
initialPackageState Unicode String This is the English human-readable string that
describes the initial install state of the package.
packageStateLoc Unicode String This is the localized human-readable string that
describes the target install state of the package.
packageState Unicode String This is the English human-readable string that
packageAssembly Unicode String Assembly identity of the package manifest.
client Unicode String Name of the client that requested the package
state change.
supportInformation Unicode String A link to more support information, defined in the
package as the assembly/supportInformation
attribute.
All Other Package Events

 Product
 Connector
 Critical Update
 Development Kit
 Driver
 Feature Pack
 Guidance
 Hotfix
 Security Update
 Service Pack
 Software Update
 Tool
 Update
 Update Rollup
 Language Pack
 Foundation
packageStateLoc Unicode String This is the localized human-readable string that
packageState Unicode String This is the English human-readable string that
packageAssembly Unicode String Assembly identity of the package manifest.

operation Unicode String One of the following requested operations:

 Resolve
 Stage
 Install
 Uninstall
operationCompleted Unicode String ―True‖ indicates that the operation has completed
and the package is in its final state.
errorCode Unicode String Error code from an incomplete operation.
rebootOption Unicode String ―True‖ indicates that the operation requires a
reboot to complete.
missingElements Unicode String Semicolon-separated list of missing identities or
files, if error is generated due to missing
dependencies.
All Update Events

updateName Unicode String The name of the update, defined in the manifest
by the update/name attribute.
 Product
 Connector
 Critical Update
 Development Kit
 Driver
 Feature Pack
 Guidance
 Hotfix
 Security Update
 Service Pack
 Software Update
 Tool
 Update
 Update Rollup
 Language Pack
 Foundation
updateStateLoc Unicode String This is the localized human-readable string that
describes the target install state of the update.
updateState Unicode String This is the English human-readable string that
describes the target install state of the update.
packageAssembly Unicode String Assembly identity of the package manifest
updateDisplayName Unicode String User-friendly name of the update, defined in the
manifest as the update/assemblyIdentity/name
attribute.
operation Unicode String One of the following requested operations:
 Resolve

 Stage
 Install
 Uninstall
operationCompleted Unicode String ―True‖ indicates that the operation has completed
and the package is in its final state.
errorCode Unicode String Error code from an incomplete operation.
rebootOption Unicode String ―True‖ indicates that the operation requires a
reboot to complete.
WUSA_EVENT_DEBUG Events

DebugMessage Unicode String FunctionName:LineNumber <description> [error
code] [error message]
[error code] and [error message] are optional.
WUSA_EVENT_INSTALLSUCCESS Events

UpdateTitle Unicode String Title of the successfully-installed package.
CommandLine Unicode String Command used to install the package, if any.
WUSA_EVENT_GENERICFAILURE Events

UpdateTitle Unicode String Title of the successfully installed package.
ErrorCode UInt32
ErrorString Unicode String
CommandLine Unicode String Command line used to install the package, if any.
WUSA_EVENT_REBOOTREQUIRED and USA_EVENT_REBOOTINITIATED Events

UpdateTitle Unicode String Title of the successfully installed package.
CommandLine Unicode String Command line used to install the package, if any.
Component-Servicing Infrastructure (CSI) Errors

This section describes how to diagnose CSI-specific errors that can be found in Cbs.log.
The following are tips for reading the CSI error logs.
 Error messages are indicated by an (F) in the log entry.

 Error messages include an error exit code (a hexadecimal value). The mapping for
this exit code to the error is available in the Winerror.h file.
 When diagnosing the error logs, start from the last failure and work your way back.
You can use the Analysecsilog.pl tool to produce the logs for only the failures that
you want to diagnose.

 Do a first-level diagnosis of the logs to determine the issue, its owner, and the next
steps for its resolution.
CSI Error Codes

This section describes the 15 most common CSI errors.
ERROR_ADVANCED_INSTALLER_FAILED
This error indicates a failure in an advanced installer (AI), or a generic command (GC)
that was executed by the servicing stack. Such failures are usually caused by incorrect
install/uninstall of the advanced installer.
The following is a sample.

0000000c@2006/4/8:08:38:48.971 (F) CMIADAPTER: Exiting with HRESULT
code = 80280006 [Warning,Facility=0028,Code=6 (0x0006).
0000002e@2006/4/8:08:38:48.971 CSI Advanced installer perf trace:
CSIPERF:AIDONE;{51d504ad-4868-464c-a504-e6cc8a210a97};(null);1022
0000002f (F) Failed execution of queue item Installer: Service
({51d504ad-4868-464c-a504-e6cc8a210a97}) with HRESULT 80280006
[Warning,Facility=0028,Code=6 (0x0006). Failure will not be ignored.
00000030 End executing advanced installer (sequence 62)
Completion status: 80073713 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14099 (0x3713)
00000032 (F) c0150020 [Error,Facility=21 (0x0015),Code32 (0x0020)
#2000# from Windows::COM::CComponentStore::ApplyTransactionNow(...)
00000033@2006/4/8:08:38:48.971 (F) Failure originated:
File: d:\winmain\base\wcp\componentstore\com\store_transaction.cpp
Function: Windows::COM::CComponentStore::ApplyTransactionNow
Line: 1577
Expression: (null)
Status Type: {44edceb3-7a6e-47e9-b787-5aa9dadfa4ab}
Status: c0150020 [Error,Facility=21 (0x0015),Code32 (0x0020)
00000035 (F) c0150020 [Error,Facility=21 (0x0015),Code32 (0x0020)
#890# from Windows::COM::CComponentStore::ApplyTransactionNow(...)
00000036 (F) 80073713 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14099 (0x3713) #519# from
Windows::ServicingAPI::CCSITransaction::ICSITransaction_Commit(Flags
= 112 (0x00000070), pSink = NULL, disp = 0)
(0x0007),Code=14099 (0x3713) #518# 1056364 us from
Windows::ServicingAPI::CCSITransaction_ICSITransaction::Commit(flags
= 0x00000070, pSink = NULL, disp = 0)
Diagnosis
In the logs, start from the last failure, which is indicated by the last line containing (F).
The failure is followed by the NTSTATUS/HRESULT error code, in this case, 8007313.
Facility=FACILITY_WIN32 indicates that this is a win32 error code, and the specific
code listed for this error above (code=14099) can be searched for in Winerror.h. This is
followed by the location details of the error origination. Here, the error code is
ERROR_ADVANCED_INSTALLER_FAILED, a non-ignorable advanced installer failure.
If there is a non-ignorable CMI adapter failure, the CSI stack also fails.
From here, look at the previous failures in the logs to locate the failure in CMIADAPTER.
The failure following this failure indicates the advanced installer that failed (the service
installer in this sample). ―Failure will not be ignored‖ indicates that the AI queue failed
with ERROR_ADVANCED_INSTALLER_FAILED, and that a rollback was initiated after
the queue was exhausted.

STATUS_INVALID_PARAMETER (E_INVALIDARGS)
This is usually a diagnosability bug, but can occur when an invalid parameter is passed
into a CSI function by the caller (CBS).
0000000e (F) STATUS_INVALID_PARAMETER #696# from
Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysCreate
Key(key = {provider=NULL, handle=0}, da = (KEY_ALL_ACCESS), oa =
@0x12e1ec->OBJECT_ATTRIBUTES {s:24; rd:NULL;
on:[25]"\Registry\MACHINE\CSITest"; a:(OBJ_CASE_INSENSITIVE)}, ti =
0, class = [6]"(null)", co = (REG_OPTION_BACKUP_RESTORE), disp =
Unmapped disposition: 0 (0x00000000))
0000000f@2006/4/8:01:24:41.328 (F) Failure originated:
File: d:\winmain\base\wcp\sil\merged\ntu\ntsystem.cpp
Function:
Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysCreate
Key
Line: 2035
Expression: (null)
Status: STATUS_INVALID_PARAMETER
00000010 (F) STATUS_INVALID_PARAMETER #695# from
Windows::Rtl::SystemImplementation::CKey::CreateNewKey(...)
ApplyTransactionPOQToSil(...)
File: d:\winmain\base\wcp\componentstore\com\store_transaction.cpp
Function: ApplyTransactionPOQToSil
Line: 706
Expression: (null)
Status: STATUS_INVALID_PARAMETER
Windows::COM::CComponentStore::ApplyTransactionNow(...)
00000014 (F) E_INVALIDARG #280# from
= 112 (0x00000070), pSink = NULL, disp = 0)
00000015 (F) E_INVALIDARG #279# 1093920 us from
= 0x00000070, pSink = NULL, disp = 0)
00000016 Performing 1 (0x00000001) operations:
UnlockComponent (12): flags: 00000000 lockid: {l:16
b:02e10b35ab5ac601030000008402f00b} pid: 284 starttime:
127889330797368226 (0x01c65aab34bd53a2)
00000017@2006/4/8:01:24:41.343 CSI Transaction @0x1e7238 destroyed
Diagnosis
The last failure indicates that the error is E_INVALIDARGS. This is followed by the CSI
function name (where the error is occurring) and its arguments. Tracing the log in
reverse for failures, the inverse failure stack is displayed along with code locations. In
this sample, the failure originated in the function
Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysCreateKey,
which is indicated by ―failure originated‖ in the logs. This failure bubbled up the stack to
the function
Windows::ServicingAPI::CCSITransaction_ICSITransaction::Commit, which is
the entry point.

ERROR_ACCESS_DENIED
This error usually occurs when the resource is in use and the correct flags (to ignore
resource-in-use errors) have not been passed in through CBS, which gets a disposition
when the ignore flag is passed. This flag is then used to determine whether a reboot is
required. This also happens when the right access control lists (ACLs) are not set.
00000007 (F) STATUS_ACCESS_DENIED #140840# from
Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCrea
teFile(flags = 0, handle = {provider=@0x272148, handle=0}, da =
(FILE_GENERIC_READ), oa = @0x12dfc8->OBJECT_ATTRIBUTES {s:24;
rd:NULL; on:[112]"\SystemRoot\WinSxS\x86_accessdenied-
component_31bf3856ad364e35_6.0.5500.0_none_799da20575364bf4\AccessDen
ied.exe"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0x12dfe0, as = (null),
fa = (FILE_ATTRIBUTE_NORMAL), sa =
(FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN,
co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT), eab =
NULL, eal = 0, disp = Invalid)
Function:
teFile
Line: 1092
Expression: (null)
Status: STATUS_ACCESS_DENIED
00000009 (F) STATUS_ACCESS_DENIED #140834# from
Windows::Rtl::SystemImplementation::CDirectory::DeleteRecursively(...
)
0000000a (F) STATUS_ACCESS_DENIED #144# from
CCSDirectTransaction::OperateEnding at index 0 (0x00000000) of 1
(0x00000001) operations, disposition 0
0000000b@2006/4/7:18:41:00.978 (F) Failure originated:
File: d:\winmain\base\wcp\componentstore\com\store.cpp
Function: Windows::COM::CComponentStore::IStore2_Transact2
Line: 3160
Expression: (null)
Status Type: {e323b7c4-7a1a-4e06-bf6d-56ccd7377627}
Status: HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED)
0000000c (F) HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) #40# from
= 0, pSink = NULL, disp = 0)
0000000d (F) HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED) #39# 4829196 us
from
0000000e@2006/4/7:18:41:00.994 CSI Transaction @0x29e0a8 destroyed
Diagnosis
This is similar to the previous error (E_INVALIDARG) but this time, ―access denied‖ is
indicated (HRESULT_FROM_WIN32(ERROR_ACCESS_DENIED in the log).
ERROR_PRIVILEGE_NOT_HELD
This error indicates a required privilege is not held by the client. This error is defined in
WinError.h.

ERROR_SXS_ASSEMBLY_NOT_FOUND
This error occurs when CSI cannot find the component that is supposed to have been
staged in the CSI store.
0000000e TLC operation Install (0) incomplete for (url (none),
[AsmNotFound-Deployment, Version = 6.0.5500.0, Type neutral, TypeName
neutral, PublicKeyToken = {l:8 b:31bf3856ad364e35}, PublicKey
neutral, Culture neutral, ProcessorArchitecture = 0 (0x0000),
VersionScope = 1 nonSxS; pk 2044502b061098af v-i pk 3724a23faf831263
s-i pk beb1c3a1fa9ca45b], inst [l:0{0}]""), missing compositions
AsmNotFound-Component, Version = 6.0.5500.0, Type neutral,
TypeName neutral, PublicKeyToken = {l:8 b:31bf3856ad364e35},
PublicKey neutral, Culture neutral, ProcessorArchitecture = 0
(0x0000), VersionScope = 1 nonSxS; pk 299086da7783cbad v-i pk
1d2f71d3bf59d3d5 s-i pk c7fdfa516c0fd759
0000000f@2006/4/6:08:13:14.700 (F) Failure originated:
File: d:\winmain\base\wcp\componentstore\csd_winners.cpp
Function: CCSDirectTransaction::PerformChangeAnalysis
Line: 1037
Expression: (null)
Status: STATUS_SXS_ASSEMBLY_NOT_FOUND
00000010 (F) 800736b3 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14003 (0x36b3) #280# from
00000011 (F) 800736b3 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14003 (0x36b3) #279# 6114 us from
b:a0a5f3f35159c601030000008c012409} pid: 18c starttime:
127887847942636000 (0x01c65951f3b5c1e0)
00000013@2006/4/6:08:13:20.191 CSI Transaction @0x1e3528 destroyed
Diagnosis
Starting from the last failure in the log, 800736b3 (HRESULT failure code in
hexadecimal) translates to ―SXS assembly not found.‖
This is followed by Facility – FACILITY_WIN32, which indicates that this is a win32

error that was converted to HRESULT before exiting. This is followed by the error code
14003. This is the actual win32 error code, which you can look up in Winerror.h.
The rest of this log entry is the function name followed by the argument details.
Just above ―Failure originated‖ is the identity of the component that was not found.
AsmNotFound-Component, Version = 6.0.5500.0, Type neutral, TypeName
VersionScope = 1 nonSxS; pk 299086da7783cbad v-i pk 1d2f71d3bf59d3d5
s-i pk c7fdfa516c0fd759

Before that, you can see the deployment that has the missing installation dependency.
[AsmNotFound-Deployment, Version = 6.0.5500.0, Type neutral, TypeName
VersionScope = 1 nonSxS; pk 2044502b061098af v-i pk 3724a23faf831263
s-i pk beb1c3a1fa9ca45b], inst [l:0{0}]""), missing compositions
STATUS_SXS_MANIFEST_PARSE_ERROR
This error is seen when parsing fails on the component manifest being installed. This is
due to either a syntactic or semantic error in the manifest.

00000009@2006/4/6:08:17:59.696 CSI Perf Trace
CSIPERF:POQEXECUTE:1355
0000000a Performing 1 (0x00000001) operations:
Stage (1): flags: 00000008 app: (url (none), [ManifestParseError-
Component, Version = 6.0.5500.0, Type neutral, TypeName neutral,
PublicKeyToken = {l:8 b:31bf3856ad364e35}, PublicKey neutral, Culture
neutral, ProcessorArchitecture = 0 (0x0000), VersionScope = 1
nonSxS], inst [l:0{0}]"") comp: (null) man: @0x1c1b20
0000000b (F) Manifest parsing failed:
Status: STATUS_UNSUCCESSFUL
Node: 23 (0x00000017)
Node (ln 6 col 57) xpath: [ml:23,l23]"/assembly/file/@hashalg"
Strings: ([ml:6,l6]"SHA112")
0000000c@2006/4/6:08:17:59.712 (F) Failure originated:
File: d:\winmain\base\wcp\manifestparser\pcmc_manifestwalker.cpp
Function: CMicrodomManifestWalker::CommonReportError
Line: 4961
Expression: (null)
Status: STATUS_UNSUCCESSFUL
0000000d (F) STATUS_SXS_MANIFEST_PARSE_ERROR #399# from
CCSDirectTransaction::OperateEnding at index 0 (0x00000000) of 1
(0x00000001) operations, disposition 0
0000000e (F) 800736b5 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14005 (0x36b5) #280# from
Windows::ServicingAPI::CCSITransaction::ICSITransaction_AddComponent(
Flags = 0, a = ManifestParseError-Component, Version = 6.0.5500.0,
Type neutral, TypeName neutral, PublicKeyToken = {l:8
b:31bf3856ad364e35}, PublicKey neutral, Culture neutral,
ProcessorArchitecture = 0 (0x0000), VersionScope = 1 nonSxS; pk
6b09d8a74f83aff5 v-i pk 987a76108ae80fcd s-i pk 09774c1e440fbba1, mp
=
[81]"c:\diagnosability\ERROR_SXS_MANIFEST_PARSE_ERROR\ManifestParseEr
ror-Component.man", disp = 0)
0000000f (F) 800736b5 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14005 (0x36b5) #279# from
Windows::ServicingAPI::CCSITransaction_ICSITransaction::AddComponent(
flags = 0, pdi = @0x1b87d0, pmp =
[81]"c:\diagnosability\ERROR_SXS_MANIFEST_PARSE_ERROR\ManifestParseEr
ror-Component.man", disp= 0)
b:4068d79d5259c6010300000054016403} pid: 154 starttime:
127887850793848000 (0x01c659529da7ccc0)
00000011@2006/4/6:08:17:59.712 CSI Transaction @0x1b7240 destroyed

Diagnosis
Starting from the last failure in the log, the HRESULT failure code in hexadecimal,
800736b5, translates to ―manifest parse error." Facility, FACILITY_WIN32 indicates
that this is a win32 error that was converted to an HRESULT before exiting. Code 14005
is the actual win32 error code that can be looked up in Winerror.h. The rest of the error
message is the function name followed by the argument details.
ERROR_SXS_FILE_HASH_MISMATCH
This error is usually seen when the file being staged into the store has been tampered
with.
Line: 3160
Expression: (null)
Status: 800736cc [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14028 (0x36cc)
00000014 (F) 800736cc [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14028 (0x36cc) #519# from
Windows::ServicingAPI::CCSITransaction::ICSITransaction_AddFile(Flags
= 0, a = HashMismatch-Component, Version = 6.0.5500.0, Type neutral,
(0x0000), VersionScope = 1 nonSxS; pk 87240b2afa8dc799 v-i pk
b0bcd501061fd449 s-i pk 25917ea1ef19d345, fn =
[16]"HashMismatch.exe", fp =
[63]"c:\diagnosability\ERROR_SXS_FILE_HASH_MISMATCH\HashMismatch.exe"
, disp = 0)
00000015 (F) 800736cc [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14028 (0x36cc) #518# from
Windows::ServicingAPI::CCSITransaction_ICSITransaction::AddFile(flags
= 0, pdi = @0x2b8c60, pfn = [16]"HashMismatch.exe", pfp =
, disp= 0)
b:006774c54759c601030000003409f801} pid: 934 starttime:
127887804211936000 (0x01c65947c5283b00)
b:60c876c54759c601060000003409f801} pid: 934 starttime:
127887804211936000 (0x01c65947c5283b00)
00000017@2006/4/6:07:00:21.755 CSI Transaction @0x29cbc8 destroyed
Diagnosis
Looking at the last failure, the HRESULT failure code in hexadecimal, 800736cc,
translates to ―file hash mismatch." The code, 14028, is the actual win32 error code for
this error that can be looked up in Winerror.h. This is usually occurs when the hash of a
file is not equal to the one listed in the manifest. This can happen if the file has been
modified after its manifest hashes were updated. This can also happen when the copied
file is corrupted due to hardware (1-bit) errors.

The error lists the component that carries the file with the mismatched hash and the path
to the file that fails the hash verification test:
HashMismatch-Component, Version = 6.0.5500.0, Type neutral, TypeName
VersionScope = 1 nonSxS; pk 87240b2afa8dc799 v-i pk b0bcd501061fd449
s-i pk 25917ea1ef19d345, fn = [16]"HashMismatch.exe", fp =
, disp = 0)
ERROR_FILE_NOT_FOUND
This error is mapped from STATUS_OBJECT_NAME_NOT_FOUND.

Function:
teFile
Line: 1092
Expression: (null)
Status: STATUS_OBJECT_NAME_NOT_FOUND
00000008 (F) STATUS_OBJECT_NAME_NOT_FOUND #138# from
Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemI
solationLayerTearoff::TransferFile(flags = 0, op = [4]"Copy", odir =
NULL, oname =
[ml:538{269},l:142{71}]"\??\C:\diagnosability\ERROR_FILE_NOT_FOUND\fi
lenotfound-deployment1.man", ndir = @0x275348, nname =
[ml:126{63},l:82{41}]"802aa8145459c60102000000b009600b_manifest",
disp = Unmapped disposition: 0 (0x00000000))
00000009 (F) HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND) #37# from
Windows::ServicingAPI::CCSITransaction::ICSITransaction_InstallDeploy
ment(Flags = 0, a = FileNotFound-Deployment, Version = 6.0.5500.0,
54d07ae8a3b2b56e v-i pk 20c5347e651bb9dc s-i pk f33dee5f983ec11a, cb
= (null), s = (null), rid = (null), rah = (null), manpath =
[67]"C:\diagnosability\ERROR_FILE_NOT_FOUND\filenotfound-
deployment1.man", catpath = (null), disp = 0)
0000000b Creating NT transaction (seq 1), objectname
[ml:104{52},l:102{51}]"\Transaction\{14a82a80-5954-01c6-0300-
0000b009600b}"
0000000c Created NT transaction (seq 1) result 0x00000000, handle
@0x2d0
0000000d@2006/4/6:08:28:28.532 CSI Perf Trace
CSIPERF:POQEXECUTE:1
0000000e@2006/4/6:08:28:28.532 CSI perf trace:
CSIPERF:TXCOMMIT;4
0000000f@2006/4/6:08:28:37.03 CSI Transaction @0x28e390 destroyed

Diagnosis
Looking at the last failure in the log, HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND)
indicates that this is a win32 error. The error implies that CSI is unable to find a file that it
expected to be present. The error lists the component with the error and the path to the
file that was not found.
FileNotFound-Deployment, Version = 6.0.5500.0, Type neutral, TypeName
VersionScope = 1 nonSxS; pk 54d07ae8a3b2b56e v-i pk 20c5347e651bb9dc
s-i pk f33dee5f983ec11a, cb = (null), s = (null), rid = (null), rah =
(null), manpath =
[67]"C:\diagnosability\ERROR_FILE_NOT_FOUND\filenotfound-
deployment1.man", catpath = (null), disp = 0)
ERROR_PATH_NOT_FOUND
This error is mapped from STATUS_OBJECT_PATH_NOT_FOUND.

00000006 (F) STATUS_OBJECT_PATH_NOT_FOUND #139# from
teFile(flags = 0, handle = {provider=@0x1b1aa8, handle=0}, da =
(FILE_GENERIC_READ), oa = @0x12ddc8->OBJECT_ATTRIBUTES {s:24;
rd:NULL;
on:[78]"\??\C:\diagnosability\ERROR_PATH_NOT_FOUND\junkdir\PathNotFou
nd-deployment.man"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0x12de04, as =
(null), fa = (FILE_ATTRIBUTE_NORMAL), sa =
(FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN,
co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT), eab =
NULL, eal = 0, disp = Invalid)
Function:
teFile
Line: 1092
Expression: (null)
Status: STATUS_OBJECT_PATH_NOT_FOUND
00000008 (F) STATUS_OBJECT_PATH_NOT_FOUND #138# from
Windows::Rtl::SystemImplementation::CSystemIsolationLayer_IRtlSystemI
solationLayerTearoff::TransferFile(flags = 0, op = [4]"Copy", odir =
NULL, oname =
[ml:538{269},l:156{78}]"\??\C:\diagnosability\ERROR_PATH_NOT_FOUND\ju
nkdir\PathNotFound-deployment.man", ndir = @0x1b5348, nname =
[ml:126{63},l:82{41}]"80de988e6259c601020000006404d805_manifest",
disp = Unmapped disposition: 0 (0x00000000))
(0x0007),Code=3 (0x0003) #37# from
ment(Flags = 0, a = PathNotFound-Deployment, Version = 6.0.5500.0,
a3aca402c4b3fa5b v-i pk 501501fa6170eb17 s-i pk 421a1779b9400607, cb
[74]"C:\diagnosability\ERROR_PATH_NOT_FOUND\junkdir\PathNotFound-
deployment.man", catpath = (null), disp = 0)
0000000a@2006/4/6:10:12:09.360 CSI Transaction @0x1ce390 destroyed

Diagnosis
This is usually caused by one of the following:
 The destination path of a file or registry key is wrong. This can be caused by an
incorrectly-authored manifest.
 The source to a manifest or a file is incorrect or non-existent. This can happen when
the layer above CSI (for example, CBS) is handing off the wrong path.
ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT
This error occurs when the component being staged has already been staged, but the
contents now differ.

Stage (1): flags: 00000008 app: (url (none), [SameIDDiffContent-
Deployment, Version = 6.0.5500.0, Type neutral, TypeName neutral,
nonSxS], inst [l:0{0}]"") comp: (null) man: @0x201a58
00000007 Stage component failed, manifest does not match previously
staged manifest for identity
File: d:\winmain\base\wcp\componentstore\csd_transact.cpp
Function: CCSDirectTransaction::InstallPrivateComponent
Line: 2452
Expression: (null)
Status: c015001c [Error,Facility=21 (0x0015),Code28 (0x001c)
00000009 (F) c015001c [Error,Facility=21 (0x0015),Code28 (0x001c)
#160# from CCSDirectTransaction::OperateEnding at index 0
(0x00000000) of 1 (0x00000001) operations, disposition 2 (0x00000002)
0000000a (F) 80073715 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14101 (0x3715) #37# from
ment(Flags = 0, a = SameIDDiffContent-Deployment, Version =
6.0.5500.0, Type neutral, TypeName neutral, PublicKeyToken = {l:8
8df1a9f2b5478398 v-i pk 5609b213f1608682 s-i pk 2c5f1d69a9d38f44, cb
[115]"c:\diagnosability\ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS
_DIFFERENT\SameIDDiffContent-Deployment-Modified.man", catpath =
(null), disp = 0)
0000000b@2006/4/6:10:01:29.432 CSI Transaction @0x1fb820 destroyed
Diagnosis
This happens when installing a component that is already staged in the component store
and content in the component has changed but the identity has not changed. For
example, the hash of a file in the manifest has been updated, but the component version
was not incremented.
80073715 is the HRESULT for the following win32 error (indicated by code 14101):
ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS_DIFFERENT

The specific component or deployment causing this problem is indicated in the log.
SameIDDiffContent-Deployment, Version = 6.0.5500.0, Type neutral,
(0x0000), VersionScope = 1 nonSxS; pk 8df1a9f2b5478398 v-i pk
5609b213f1608682 s-i pk 2c5f1d69a9d38f44, cb = (null), s = (null),
rid = (null), rah = (null), manpath =
[115]"c:\diagnosability\ERROR_SXS_MANIFEST_IDENTITY_SAME_BUT_CONTENTS
_DIFFERENT\SameIDDiffContent-Deployment-Modified.man", catpath =
(null), disp = 0)
ERROR_SXS_IDENTITIES_DIFFERENT
This error occurs when the component being staged has a different identity than
expected; for example, when the version of the component has been incremented in the
component manifest but not in the deployment.

00000007 Stage component failed, id mismatch:
Manifest: DiffID-Deployment, Version = 6.0.5500.0, Type neutral,
(0x0000), VersionScope = 1 nonSxS
Function: CCSDirectTransaction::InstallPrivateComponent
Line: 2400
Expression: (null)
Status: c015001d [Error,Facility=21 (0x0015),Code29 (0x001d)
00000009 (F) c015001d [Error,Facility=21 (0x0015),Code29 (0x001d)
(0x00000000) of 1 (0x00000001) operations, disposition 0
0000000a (F) 80073716 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14102 (0x3716) #37# from
ment(Flags = 0, a = DiffIdentity-Deployment, Version = 6.0.5500.0,
c73501a15f90441c v-i pk 3bab155c1758711e s-i pk 65a27518541c4fc8, cb
[70]"C:\diagnosability\ERROR_SXS_IDENTITIES_DIFFERENT\DiffID-
deployment.man", catpath = (null), disp = 0)
0000000b@2006/4/6:10:18:52.292 CSI Transaction @0x1a35a0 destroyed
Diagnosis
Look for the last failure (F) in the logs. Look up the corresponding code in Winerror.h. In
the sample case, Code=14102 corresponds to ERROR_SXS_IDENTITIES_DIFFERENT. This
is then followed by the identity of the deployment or component causing the error.

ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT
This error occurs when the deployment tag is missing.

Install (5): flags: 00000000 tlc: (url (none), [AssemblyNotADep-
nonSxS], inst [l:0{0}]"") ref: ( flgs: 00000000 guid: {d16d444c-56d8-
11d5-882d-0080c847b195} name: [l:0{0}]"" ncdata: [l:0{0}]"")
thumbprint: (null)
0000000b Call to install deployment failed, component is not a
deployment (no <deployment/> tag)
0000000c@2006/4/6:08:06:39.802 (F) Failure originated:
Function: CCSDirectTransaction::InstallDeployment
Line: 3423
Expression: (null)
Status: c015001e [Error,Facility=21 (0x0015),Code30 (0x001e)
0000000d (F) c015001e [Error,Facility=21 (0x0015),Code30 (0x001e)
0000000e@2006/4/6:08:06:39.802 (F) Failure originated:
Line: 3160
Expression: (null)
Status: 80073717 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14103 (0x3717)
0000000f (F) 80073717 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14103 (0x3717) #280# from
= 112 (0x00000070), pSink = NULL, disp = 0)
(0x0007),Code=14103 (0x3717) #279# 4126 us from
= 0x00000070, pSink = NULL, disp = 0)
b:a0b197085159c60103000000f00e8808} pid: ef0 starttime:
127887843993028000 (0x01c65951084b85a0)
00000012@2006/4/6:08:06:39.817 CSI Transaction @0x296f78 destroyed
Diagnosis
Look for the last failure (F) in the logs and then find the corresponding code in
Winerror.h. In the sample case, Code=14103 corresponds to
ERROR_SXS_ASSEMBLY_IS_NOT_A_DEPLOYMENT.
ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY
This error occurs when you try to add a file that is not specified using a <file> tag in the
component manifest.


0000000e Performing 1 (0x00000001) operations:
StageFile (2): flags: 00000008 app: (null) comp: FileNotPartOfAsm-
Component, Version = 6.0.5500.0, Type neutral, TypeName neutral,
neutral, ProcessorArchitecture = 0 (0x0000), VersionScope = 1 nonSxS;
pk e94932d042bb516b v-i pk a735ffc38c53a887 s-i pk 87b6a64737475d17
file: [ml:42{21},l:40{20}]"FileNotPartOfAsm.exe" srcfile: @0x34d030
0000000f Unable to validate file installation request; attempt to
stage a file that is not part of the corresponding component.
Id: FileNotPartOfAsm-Component, Version = 6.0.5500.0, Type
neutral, TypeName neutral, PublicKeyToken = {l:8 b:31bf3856ad364e35},
(0x0000), VersionScope = 1 nonSxS; pk e94932d042bb516b v-i pk
a735ffc38c53a887 s-i pk 87b6a64737475d17
Function: CCSDirectTransaction::ValidateFileInstallationRequest
Line: 2794
Expression: (null)
Status: c015001f [Error,Facility=21 (0x0015),Code31 (0x001f)
00000011 (F) c015001f [Error,Facility=21 (0x0015),Code31 (0x001f)
Line: 3160
Expression: (null)
Status: 80073718 [Warning,Facility=FACILITY_WIN32
(0x0007),Code=14104 (0x3718)
(0x0007),Code=14104 (0x3718) #519# from
Windows::ServicingAPI::CCSITransaction::ICSITransaction_AddFile(Flags
= 0, a = FileNotPartOfAsm-Component, Version = 6.0.5500.0, Type
neutral, TypeName neutral, PublicKeyToken = {l:8 b:31bf3856ad364e35},
a735ffc38c53a887 s-i pk 87b6a64737475d17, fn =
[20]"FileNotPartOfAsm.exe", fp =
[74]"C:\diagnosability\ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY\FileNotPar
tOfAsm.exe", disp = 0)
(0x0007),Code=14104 (0x3718) #518# from
Windows::ServicingAPI::CCSITransaction_ICSITransaction::AddFile(flags
= 0, pdi = @0x326c10, pfn = [20]"FileNotPartOfAsm.exe", pfp =
[74]"C:\diagnosability\ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY\FileNotPar
tOfAsm.exe", disp= 0)
Install (5): flags: 00000000 tlc: (url (none), [FileNotPartOfAsm-
nonSxS], inst [l:0{0}]"") ref: ( flgs: 00000000 guid: {d16d444c-56d8-
11d5-882d-0080c847b195} name: [l:0{0}]"" ncdata: [l:0{0}]"")
thumbprint: (null)
00000016 Calling primitive installers with change list, 2
(0x00000002) entries:

{(null) -> 6.0.5500.0, FileNotPartOfAsm-Deployment, Type neutral,

(0x0000), VersionScope = 1 nonSxS; pk fc9f98fbb75f30ed v-i pk
50026d500d96c895 s-i pk 9b0d0c72abeb3c99}
{(null) -> 6.0.5500.0, FileNotPartOfAsm-Component, Type neutral,
a735ffc38c53a887 s-i pk 87b6a64737475d17}
Diagnosis
ERROR_SXS_FILE_NOT_PART_OF_ASSEMBLY. This is then followed by the file name (with
its corresponding path) that is causing the issue.
ERROR_SXS_COMPONENT_STORE_CORRUPT
This occurs when the component store is corrupted.
Diagnosis
ERROR_SXS_COMPONENT_STORE_CORRUPT.
ERROR_DUP_NAME
This error mapped from STATUS_DUPLICATE_OBJECTID.
Diagnosis
This happens when two or more components write the same file or registry value to the
same location (that is, duplicate ownership of resources). This is a CQP issue.
Winerror.h. In the sample case, Code=52 corresponds to ERROR_DUP_NAME.
Settings Management Infrastructure (SMI) Errors

This section describes how to diagnose SMI-specific errors and warnings. When the
<settings> section of the answer file contains bad information, an error or warning
message is logged to Setupact.log during the Setup.exe process
(%WINDIR%\Panther\Setupact.log) or Cbs.log during the Pkgmgr.exe process
(%WINDIR%\Logs\Cbs\Cbs.log).
 Error message. This corresponds to invalid and unsupported authoring of <settings>

sections that would cause the corresponding executable (Setup.exe or Pkgmgr.exe)
to fail.
 Warning message. Some <settings> sections trigger a warning message,
specifically in the case of <settings> sections that contain components that do not
apply to the targeted Windows image. This will not cause an execution failure, but
the settings in these components will not be applied.
To prevent errors when authoring the <settings> section of an answer file, you should
always use Windows System Image Manager (Windows SIM).

Format of SMI Error Messages/Warning

The following describes the basic format of an SMI error message or warning as it
appears in Setupact.log and Cbs.log.
Reading SMI errors in Setupact.log
In Setupact.log, the basic format of an SMI error or warning contains the following
information.
<Date> <time>, <Error/Warning> [setup.exe] SMI
data results dump: Source = <component identity> <setting’s key and
name>
This is followed by the error/warning description.

<Date> <time>, <Error/Warning> [setup.exe] SMI
data results dump: Description = <warning/error message>
In Cbs.log, a common way to look for this the messages is to search for the phrase ―SMI
data results dump‖. In the following example, component name Microsoft-Windows-
TerminalService-LocalSessionManager (together with its identity) has a setting name
fDenyTSConnections. This setting is assigned with a value that has an invalid format (for
example, an integer type setting is assigned with a string value).
2006-06-21 08:14:50, Error [setup.exe] SMI
data results dump: Source = Name: Microsoft-Windows-TerminalServices-
LocalSessionManager, Language: neutral, ProcessorArchitecture: x86,
PublicKeyToken: 31bf3856ad364e35, VersionScope: nonSxS,
/settings/fDenyTSConnections
2006-06-21 08:14:50, Error [setup.exe] SMI
data results dump: Description = Value is in invalid format.
Reading SMI errors in CBS.log
In Cbs.log, the basic format of an SMI error or warning contains the following
information.
<Date> <time>, Error/Info CBS [Setting Override
Warning/Error] <error code> / Source=Name: <the component identity>
<setting’s key if available> Description=<warning/error message>
In Cbs.log, a common way to look for this the messages is to search for the phrase
―setting override‖. In the following example, a component name SMIDemo (together with
its identity) has a setting name IconSize assigned with an invalid value. For example, a
positive integer type setting is assigned with a negative value.
2006-07-20 13:18:04, Error CBS hr=0x80220005 /
Source=Name: SMIDemo, Language: neutral, ProcessorArchitecture: x86,
PublicKeyToken: 31bf3856ad364e35, VersionScope: nonSxS,
/settings/IconSize / Description= Value is invalid
For both logs, always start from the bottom of the log when searching for the
corresponding phrase. This will bring you to the most recent authoring issues in the
<settings> section of your answer file.

SMI Error Messages

After executing Pkgmgr.exe, you can obtain the error level value by executing the
following command.
" echo %errorlevel%"
This will return a decimal value corresponding to the following set of error messages:
Return Code Message Diagnosis

Errorlevel = The Some <component> attributes have a set of values that
-2145255382 processorArchitecture they can accept. (For example, processorArchitecture can
attribute has an invalid only be assigned x86, amd64, or ia64.) Assigning a
value. different value will cause this error to occur.
hr =
0x8022002a For example, amd64 with a missing letter ―d,‖
<component name="Desktop”
language="neutral"
publicKeyToken="31bf3856ad364e35"
versionScope="nonSxS"
processorArchitecture="am64">
...
Errorlevel = Value is invalid. Some settings have a restriction on the set of value that it
-2145255419 can accept. For example, a positive integer setting could
not be assigned a negative number, or a setting with
hr = restrictions may only be assigned a value from 0 to 10.
0x80220005 For example, given a positive integer setting name
IconSize,
<IconSize>-1</IconSize>
This will cause an error to occur. Please refer to the

documentation to find the set of valid values for a specific
setting.
Errorlevel = Setting is not defined A setting defined in the answer file under a component may
-2145255419 in this component. not belong in that component.
For example, the desktop resolution setting is defined in
hr = the Internet Explorer component (which does not have
0x80220005 such a setting),
<component name="IE” language="neutral"
processorArchitecture="x86">
...
<desktopResolutionX>1256</desktopResoluti
on>
...
</component>
Settings that are Some settings have the option not to be created. These
marked with settings are known as nillable settings. For example,
xsi:nil='true' should <settingName xsi:nil=”true”/>
not contain a value.
Settings that need to be removed should not be assigned
with a value. For example,
<settingName
xsi:nil=”true”>1</settingName>

Errorlevel = The same namespace This message indicates that there are multiple instances of
-2145255379 should not appear <component> which contain the same set of contents. For
twice in a single example,
settings section. <component name="SMIDemo"
hr =
language="neutral"
0x8022001b publicKeyToken="31bf3856ad364e35"
...
</component>
<component name="SMIDemo"
language="neutral"
processorArchitecture=”x86”/>
Non-list settings This applies to settings that can be set once (non-list
should not be set settings), but which appear more than once in the answer
twice in a single file. For example,
settings section. <BackgroundPicture>50</BackgroundPicture>
<BackgroundPicture>50</BackgroundPicture>
Errorlevel = This list setting is For a list setting, its items should not have the same key
-2145255419 marked for Add, but a value. This will trigger the warning message. For example,
list item with the same <extension>
hr = key value already <extensionItem
exists. wcm:keyValue=”1”>valueSetting1</extension
0x80220005
Item>
<extensionItem
wcm:keyValue=”1”>valueSetting2</extension
Item>
</extension>
Errorlevel = The value is in an Setting can be an integer, string, hexBinary or boolean, and
-2145255418 invalid format. so on. Writing a setting with the wrong value format will
trigger this error message.
hr = For example, a boolean setting cannot be assigned an
0x80220006 integer value. It can only accept ―true‖ and ―false‖ values.
hr = 0x221006 Unable to find a This refers to a non-existent component that is defined in

component matching the answer file. Some common causes of this include the
the given namespace. following:
 An amd64 component is defined in the answer
file, but the machine to be installed into is x86.
 A misspelled component name (in the component
identity) in the answer file.
For example, the component name Desktop with
missing letter K,
<component name="Destop”
language="neutral"

Windows Update Errors

The Windows Update (WU) log also contains CBS errors as well as Windows update
errors. This log file is created at %WINDIR%\Windowsupdate.log. The WU log file
contains the following types of errors:
 WU errors
 CBS root level errors
To determine if the WU log contains errors search the log for the word "FATAL" or
"WARNING".
You can increase logging by creating this registry value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Windows
Update\Trace
Flags = 0x17
Example of WU related error:
In this example, when you search for the key word FATAL, it would take you to the error
code. In this example, it is 0x80072EEF. From there, you can search the log file to find
the closest WARNING.
2005-06-
02 04:32:01 992 158 Setup FATAL:
IsUpdateRequired failed with error 0x80072eef
2005-06-
02 04:32:01 992 158 Misc WARNING:
Send failed with hr = 80072eef.
2005-06-
02 04:32:01 992 158 Misc WARNING:
SendRequest failed with hr = 80072eef. Proxy List used: <Test:80 >
Bypass List used : <(null)> Auth Schemes used : <NTLM;Negotiate (NTLM
or Kerberos);>
2005-06-
02 04:32:01 992 158 Misc WARNING:
WinHttp: SendRequestUsingProxy failed for
<http://update.microsoft.com/v6/windowsupdate/redir/wuredir.cab>.
error 0x80072eef
In this case, the error is WU-related and you should contact the WU component owners
for further investigation. There are many types of WU errors. This is just one example.
Example of CBS Root Level Error:
In this example, when you search for the word FATAL, you might see the following.
2006-08-
28 09:17:03:927 1100 e00 Handler F
ATAL: CBS called Error with 0x800f081e
The error that you located is 0x800F081E. In this case, the error is reported by way of
CBS and you can then start diagnosing the CBS log file.

Device Management Infrastructure (DMI) Errors

This section describes how to diagnose DMI specific errors. When a driver injection into
an offline Windows image fails, an error message is logged to Setupact.log during the
Setup.exe process (%WINDIR%\Panther\Setupact.log) or to Cbs.log during the
Pkgmgr.exe process (%WINDIR%\Logs\Cbs\Cbs.log).
You can also look at the SetupAPI log files for additional driver installation issues.
SetupAPI log files (Setupapi.dev.log and Setupapi.app.log) can be found in
%WINDIR%\inf.
Generating a separate driver log file

Cbs.log contains all errors generated during installation and may be difficult to sort
through for driver specific errors. You can create a separate log file with only driver-
specific errors. To create a separate log file, create the following registry key with the
appropriate values.
HKLM\Software\Microsoft\Windows\CurrentVersion\Device Installer
Key: DebugPkgMgr
Type: DWord
Value: 1
This will create a file named Drivers.log in the same directory where Package Manager
(Pkgmgr.exe) is executed. This file will contain logs of all the operations that are related
to driver installation.
Note The Drivers.log file contains only a subset of the logs contained in Cbs.log. Driver
installation failures might be a result of other failures which might not be reflected in this
subset.
DMI Error Messages

The following is a list of common DMI errors.
Error Description
ERROR_ACCESS_DENIED The share pointed to in the unattend file might not be
accessible.
CBS fails to initialize The unattend file specifies a different architecture for the
offline image than the actual image.
For multiple driver locations in the unattend file, wcm:keyValue must be unique for each
<DriverPath> element.
The quickest way to determine whether the driver injection operation succeeded is to
enumerate the Oem*.inf files in the %WINDIR%\inf directory of the mounted image. For
a clean image (before the driver injection operation), there should be no Oem*.inf files
present. After the operation, you should have at least as many Oem*.inf files as the
number of driver packages on the share or drive pointed to in the unattend file.

In addition, the following logs can help with driver related issues:
 %WINDIR%\Panther\Setupact.log contains debugging messages from the Kernel-

Mode Driver Framework co-installer, which is a Microsoft Win32 DLL that assists in
device installation.
 %WINDIR%\Panther\Setuperr.log contains setup failures.
 %WINDIR%\Inf\Setupapi.app.log contains application installation messages.
 %WINDIR%\Inf\Setupapi.dev.log contains device and plug and play installation
messages.
For more information about troubleshooting driver issues, see the following:
 ―Debugging Device Installation in Windows Vista―

(http://go.microsoft.com/fwlink/?LinkId=96502). Specifically, the ―Gathering
Information‖ and ―Using the SetupAPI logs‖ sections.
 "Plug and Play Device Driver Deployment in Windows Vista and Windows Server
2008" (http://go.microsoft.com/fwlink/?LinkId=89602)
 Troubleshooting KMDF Driver Installation
(http://go.microsoft.com/fwlink/?LinkId=96503)
 "Driver Package Compatibility for Windows Vista"
Additional Information
 Package Manager Technical Reference
 OCSetup Log Diagnoser (http://go.microsoft.com/fwlink/?LinkId=84909).
 System Error Codes (http://go.microsoft.com/fwlink/?LinkId=83027)
For additional assistance, contact your Microsoft representative.

Windows Deployment Error Diagnostic Guide

Uploaded by

Copyright:

Available Formats

Windows Deployment Error Diagnostic Guide

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Windows Deployment Error Diagnostic Guide

Uploaded by

Copyright:

Available Formats

Windows Vista Deployment Error

Summary: Provides information for OEM and Corporations to diagnose Windows

MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS

© 2007 Microsoft Corporation. All rights reserved.

 Component-Based Servicing (CBS) Errors – Errors related to servicing Windows

© 2007 Microsoft Corporation. All rights reserved.

 Device Management Infrastructure (DMI) Errors – Errors related to offline

1. Click Start, click Run, and then type Calc.exe.

Component-Based Servicing (CBS) Errors

 CBS related errors with the format 0x800fnnnn

[HKLM\Software\Microsoft\Windows\CurrentVersion\Component Based Servicing]

Syntax of CBS Error Messages

<TimeStamp> <Severity> <Component> <Type>: <Description>

© 2007 Microsoft Corporation. All rights reserved.

<Type> Specifies the type of operation that the message is about.

Versions and Elevation Values

In the following example, the version is 6.0.5520.20481.

© 2007 Microsoft Corporation. All rights reserved.

Elevation Type Value Description

Install State Value Description

Appl: Messages about the applicability of the update.

© 2007 Microsoft Corporation. All rights reserved.

Shtdn: Messages about shutting down the Trusted Installer.

Watchlist: Messages logged by the Watchlist feature.

Appl message examples

This is the evaluation of the non detectUpdate applicability rules.

The following table describes the verification results:

Field Field Description Possible Value Description

© 2007 Microsoft Corporation. All rights reserved.

Non detectUpdate was

In the following message, the applicability is 1, 2, or 4 as described above, but the

Field Description Possible Value Description

1003 Detect. This means that the

© 2007 Microsoft Corporation. All rights reserved.

Exist 6 Less than

In the next two messages, there is another potential parent (Microsoft-Windows-

2006-06-08 16:54:07, Info CBS Appl: detectParent

In the following message, the package applicability is evaluated according to its

© 2007 Microsoft Corporation. All rights reserved.

Exec message examples

This particular package requires a reboot to finish installation.

© 2007 Microsoft Corporation. All rights reserved.

Uninstallation has started.

The component is removed from the project.

The cleanup of the component is scheduled for system shutdown.

The execution phase of the uninstallation of the product is complete.

The following table describes what to expect for these messages:

© 2007 Microsoft Corporation. All rights reserved.

Scavenging will only occur if it was previously scheduled as part of an uninstallation.

The following message is logged when shutdown processing is complete.

© 2007 Microsoft Corporation. All rights reserved.

See the following table for other possible actions:

Value Action Description

© 2007 Microsoft Corporation. All rights reserved.

3 Install Indicates that the component was installed.

CBS Error Codes

Error Code Description Resolution

© 2007 Microsoft Corporation. All rights reserved.

© 2007 Microsoft Corporation. All rights reserved.

0x800f0812 CBS attempted to validate a Search for a Knowledge Base article