Issues Installing Security Update KB5087539 on Server 2025

Hi McMeekin, Robert I. (IT Director),

The steps you have already taken were absolutely the right path to start with. Looking at your CBS.log file, the error code 0x800736b3 translates to ERROR_SXS_ASSEMBLY_NOT_FOUND. This tells us that your Windows component store is missing a specific side-by-side assembly file needed to complete the installation, and your previous repair attempts showed that standard update channels cannot replace this missing historical file.

To fix this, you will need to bypass Windows Update and feed the repair tool a known-good local source. You can do this by downloading a Windows Server 2025 installation ISO and mounting it to your virtual machine. Once mounted, open an elevated command prompt and run the repair command pointing to the install.wim file on that ISO. The command looks like DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:D:\sources\install.wim:1 /LimitAccess, where you replace D with your actual mounted drive letter. You must also ensure you replace the 1 with the correct index number for your specific server edition, which you can check by running a quick Get-WimInfo command against that same file path. The LimitAccess switch is critical here as it forces the system to pull the missing assembly directly from your provided file rather than querying the internet.

If the exact corrupted assembly is not present in the base ISO or if the corruption is too deep, your most reliable fallback is an in-place repair upgrade. You can run the setup executable directly from that same mounted ISO while logged into your server. By choosing the option to keep all your personal files and applications, setup will safely rebuild the core operating system and generate a completely fresh, uncorrupted component store without altering your current server configuration or roles.

Hope this answer brought you some useful information. If it did, please hit “accept answer”. Thank you :)

Domic V.

Error 0x800736b3 is ERROR_SXS_ASSEMBLY_NOT_FOUND, which indicates component store (WinSxS) corruption or a missing assembly for the update. The CBS log snippets confirm that the Servicing Component Store cannot find a required assembly and the transaction fails.

The steps already taken (DISM /RestoreHealth, sfc /scannow, Windows Update reset) are correct prerequisites. For this specific type of CBS/component store corruption, use the more advanced DISM-based repair path that supplies a known-good source and, if needed, manually repairs the missing payload.

Follow these steps in order:

1. Back up and ensure admin access
   • Back up the OS disk or take a VM snapshot before proceeding.
   • Run all commands from an elevated Command Prompt.
2. Run DISM with an explicit repair source Since the default /RestoreHealth did not fix the corruption, point DISM to a known-good source (same build and edition as the affected Server 2025 VM):

      DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:\\<servername>\c$\Windows /LimitAccess
   

   • Replace <servername> with a working Server 2025 machine running the same OS version/build.
   • Ensure that machine can be reached over the network and that its C:\Windows is accessible.
   • After this completes, rerun:

      sfc /scannow
   

   • Then retry installing KB5087539.
3. If DISM still reports repairable corruption: advanced CBS repair If the component store remains repairable or the update still fails with 0x800736b3, use the advanced manual CBS repair approach:
   1. Create a local source folder:

            mkdir C:\temp\Source
      

   2. Obtain the .msu or .cab for KB5087539 (or the relevant cumulative update) and extract it using the documented PowerShell script from Scripts: Extract .msu and .cab files. Extract all payloads into a working folder, then copy the specific files corresponding to the corrupted components (as identified in CBS.log) into C:\temp\Source. Example copy command:

            Copy-Item "C:\path\extractedFiles\corruptedfile.dll" -Destination "C:\temp\Source"
      

      Repeat for each corrupted file referenced in the CBS log.
   3. Run DISM again using the local source:

            DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\temp\Source\ /LimitAccess
      

   4. Verify the store and logs:

            DISM /Online /Cleanup-Image /ScanHealth
      

      • Confirm that DISM reports no remaining corruption.
      • Review %windir%\Logs\CBS\CBS.log to ensure errors like STATUS_SXS_ASSEMBLY_NOT_FOUND are no longer present.
   5. Run sfc /scannow again and then retry KB5087539.
4. If updates still fail
   • If the component store continues to show repairable corruption even after supplying a correct source, or if CBS.log still shows ERROR_SXS_ASSEMBLY_NOT_FOUND for the same TLC, collect logs (CBS.log, DISM logs) and consider escalating via Microsoft support using the recommended data collection tooling.

These steps directly target CBS/component store corruption and missing payloads, which are the root cause indicated by the 0x800736b3 and the STATUS_SXS_ASSEMBLY_NOT_FOUND errors in the CBS log.

References:

• Fix Windows Update corruptions and installation failures