Share via

Installation errors during the security patch update KB5078752

Dhanushree R 20 Reputation points
2026-04-26T03:07:15.0266667+00:00

Title

Windows Server 2019 VM fails to boot (BSOD 0x50) after installing KB5078752 – CBS shows 0x80070002 errors

Question

I am attempting to install the security update KB5078752 on a Windows Server 2019 Datacenter VM (OS Build 17763.7922).

However, after the update installation completes and the VM reboots, the system fails to boot and encounters a Blue Screen error:

PAGE_FAULT_IN_NONPAGED_AREA (0x50)

CBS Log Findings

From the CBS logs, I observed multiple file extraction failures:

Failed to extract file TOC.xml from cabinet ...\SSU-17763.8381-x64.cab [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]

Windows Update Log Findings

Adding Windows10.0-KB5078752-x64.cab to request list

Observations

  • The update download and signature validation succeed
  • The SoftwareDistribution cache appears to be cleaned during the process
  • Required update files are missing at install time (0x80070002)
  • This results in a failed or partial installation
  • After reboot, the VM crashes with PAGE_FAULT_IN_NONPAGED_AREA

Question

  • What is the recommended approach to bypass or resolve these file-not-found (0x80070002) errors during update installation?
  • How can I ensure a clean and consistent installation of KB5078752 without causing a boot failure?

Additional Context

  • Disk space is sufficient
  • Antivirus (Trend Micro) was placed in maintenance mode
Windows for business | Windows Server | Devices and deployment | Install Windows updates, features, or roles
0 comments

Answer accepted by question author

  1. Tracy Le 8,070 Reputation points Independent Advisor
    2026-04-26T04:09:09.26+00:00

    Hi Dhanushree R,

    Manually extracting CAB files and trying to stitch the component store back together is a nightmare and rarely works for this specific extraction failure. The root cause is right at the bottom of your post: Trend Micro.

    Placing Trend Micro in "maintenance mode" or "disabled" does not unload its anti-malware filter driver from the Windows kernel. During the update, this filter driver aggressively locks the temporary files, preventing TrustedInstaller from extracting the nested SSU cab files (hence the 0x80070002 - ERROR_FILE_NOT_FOUND). When Windows reboots and the kernel tries to access these missing binaries in the non-paged pool, it crashes with a BSOD 0x50.

    Here is the clean, guaranteed way to get this update installed:

    Recover the VM: If it is still caught in a BSOD loop, boot into Windows RE (Recovery Environment), open the command prompt, and run: dism /image:C:\ /cleanup-image /revertpendingactions

    Remove the Blocker: Completely UNINSTALL Trend Micro from the VM. Do not just pause it. You must remove the filter driver entirely. (You can reinstall it after the update).

    Purge the Corrupted Cache: Open an elevated CMD and run these exact commands to clear the broken payload:

    • net stop wuauserv
    • net stop cryptSvc
    • net stop bits
    • net stop msiserver
    • ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
    • ren C:\Windows\System32\catroot2 catroot2.old
    • net start wuauserv (and start the other 3 services).

    Without the antivirus filter driver interfering, the extraction will succeed and the VM will boot normally.

    Tracy Le.

    Was this answer helpful?

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Q&A Assist
    2026-04-26T03:07:33.63+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    The 0x80070002 errors in CBS during KB5078752 installation indicate missing or corrupt update payload files, which leads to a partial install and, in this case, a boot failure. The supported remediation is to identify and restore the missing files, then re-run servicing so the update can complete cleanly.

    A practical approach is:

    1. Back up and collect logs
      • Ensure a backup/snapshot of the VM OS disk before further repair, as recommended for Windows Update repair scenarios.
      • Confirm you have copies of C:\Windows\Logs\CBS\CBS.log and C:\Windows\WindowsUpdate.log for analysis.
    2. Analyze CBS.log for all missing/corrupt files (0x80070002)
      • Open %WinDir%\Logs\CBS\CBS.log and search for 0x80070002 and ERROR_FILE_NOT_FOUND.
      • Identify each missing or corrupt file and its full path (for example, DLLs or other payloads under C:\Windows\WinSxS or files referenced from the SSU/LCU packages).
      • Also note any CSI Payload Corruption, CBS MUM Missing, or CSI Manifest Corruption entries and the associated package names and version/UBR numbers.
    3. Map the corruption to the relevant KBs and download the packages
      • From the CBS entries, extract the Update Build Revision (UBR) numbers in the file paths for the corrupted/missing components.
      • Match those UBR numbers to their KBs using the Windows update history page for your OS version, then download the corresponding updates from the Microsoft Update Catalog.
      • This gives you the .msu files that contain the correct versions of the missing or corrupt files.
    4. Extract the .msu/.cab and stage the missing files as a repair source
      • Create a local source folder, for example: 
             mkdir C:\temp\Source
      • Use the documented PowerShell script and process in Scripts: Extract .msu and .cab files to extract the downloaded .msu packages.
      • From the extracted content, copy each required file (those identified as missing/corrupt in CBS) into C:\temp\Source, for example: 
             Copy-Item "C:\path\extractedFiles\corruptedfile.dll" -Destination "C:\temp\Source"
      • Repeat until all missing/corrupt files reported in CBS are present in C:\temp\Source.
    5. Repair the component store with DISM using the local source
      • Open an elevated command prompt and run: 
             DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\temp\Source\ /LimitAccess
      • After it completes, verify that corruption is resolved: 
             DISM /Online /Cleanup-Image /ScanHealth
      • Re-check CBS.log to confirm there are no remaining errors for the previously missing files.
    6. Reattempt the update installation cleanly
      • Once DISM reports a healthy store and CBS shows no unresolved corruption, reattempt installing KB5078752, preferably using the standalone package from the Microsoft Update Catalog rather than relying solely on the existing SoftwareDistribution cache.
      • Because the component store is now consistent and the missing files have been restored, the 0x80070002 file-not-found errors during extraction/installation should no longer occur, reducing the risk of another partial install and subsequent BSOD.
    7. If failures persist or CBS corruption is extensive
      • If CBS still reports widespread corruption that cannot be repaired with the above steps, or if the update continues to roll back, consider a repair/reinstall of the current Windows version as a last resort, then reapply updates.
      • For complex or repeated failures, collect logs as per the TSS guidance and open a support case so the CBS and setup logs can be reviewed in detail.

    This workflow directly addresses the 0x80070002 (file not found) condition by restoring the missing payloads into the component store and using DISM with an explicit source, which is the recommended advanced method to ensure a clean, consistent installation of problematic cumulative updates.

    References:

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.