Windows Server 20212 R2 (Essentials): Feb. 2023 updates drops install error 0x800F0922

[German]I got several reports from administrators that the February 2023 security updates to Windows Server 20212 R2 (and Windows 8.1) are causing issues and the installation is aborting with error 0x800F0922. With Windows 8.1 it is clear, because of the end of support. But with Windows Server 20212 R2, administrators may thank Microsoft's AI-powered Extended Support update check. I'll just thread together some information I have now here.

Windows Server 2012 R2 Feb. 2023 updates

Microsoft released security update KB5022899 (Monthly Rollup for Windows 8.1 and Windows Server 2012 R2) and update KB5022894 (Security Only Quality Update for Windows 8.1 and Windows Server 2012 R2) on Feb. 14, 2023. I had reported the details in the blog post Patchday: Windows 11/Server 2022 Updates (February 14, 2023).

Update install errors

Here I do not have Windows Server 2012 R2 for testing. But there is still a Windows 8.1 system and Microsoft has released the updates also for Windows 8.1 Embedded (see e.g. this entry in the Microsoft Update Catalog). So I tried on a test basis whether the rollups are installable for Embedded or for Windows Server 2012 R2.

Update not suitable for PC

However, I was unsuccessful at first, the update installer of Windows 8.1 told me after a while that the update was not suitable for my machine. I received similar feedback from the readership, see this German comment. However, this problem could be solved, because when I evaluated the CBS.log file in the Windows Logs folder, I found the note that the Servicing Stack Update (SSU) KB5018922 from October 11, 2022 is missing. I downloaded this SSU from the Microsoft Update Catalog and was able to install it.

Windows 8.1: Update KB5022899 throws error 0x800F0922

Then I tried to install update KB5022899 (Monthly Rollup for Windows 8.1 and Windows Server 2012 R2) afterwards, but got error 0x800F0922 reported already during installation.

At this point, the cause was clear to me: Windows 8.1 has fallen out of support in January 2023 and the update installation is therefore not possible. The above experience is also confirmed by a reader in this comment.

Windows Server 20212 R2: Update KB5022899 throws error 0x800F0922

However, I also have a number of feedbacks on the blog that update KB5022899 on Windows Server 20212 R2 aborts with installation error 0x800F0922. Blog reader Lition, for example, reports this installation error in this comment (German, translation below):

I can also confirm the problem with KB5022899:

With kb5022899 on a bare metal system running Windows 2012 R2 Essentials, I keep getting error 0x800F0922.

No chance to install the update. It goes up to 96% and then a rollback occurs.

More administrators confirm this in follow up comments. And here's where things get strange, since Windows Server 20212 R2 is still in support until October 2023. Because of the 0x800F0922 installation error on Windows Server 2012 R2, I had then published the follow-up post Windows: Update installation errors (Feb. 2023), which addresses the issue.

Whether the installation of SSU KB5018922 brings improvement, I can not currently evaluate due to lack of test system.

Addendum: This cquestion an be denied – I have received various feedback from readers that the error occurs even though SSU KB5018922 is installed.

Error 0x800F0922: Extended Support Update-Prüfung check is to blame

Thanks to my readers I am now one step further in my knowledge. Blog reader broland commented on my blog post Windows: Update installation errors (Feb. 2023) (thanks for that):

I am also having the same problem installing KB5022899 on a Windows Server 2012R2 Essentials physical server. Scouring the CBS.log file says the problem is the Extended Support Update check

The reader looked at the CBS.log in the Windows Logs subfolder in an editor and found that the Extended Support Update check was responsible for the 0x800F0922 installation error on Windows Server 2012 R2. Here is the excerpt from the CBS.log that the reader posted.

Installer name: [38]"Extended Security Updates AI installer"
2023-02-16 18:33:26, Info CSI 0000005c Performing 1 operations; 1 are not lock/unlock and follow:
(0) LockComponentPath (10): flags: 0 comp: {l:16 b:871196115f42d90134000000b4019001} pathid: {l:16 b:871196115f42d90135000000b4019001} path: [l:238{119}]"\SystemRoot\WinSxS\amd64_microsoft-windows-s..edsecurityupdatesai_31bf3856ad364e35_6.3.9600.20821_none_59d19e7ff626dfcd" pid: 1b4 starttime: 133210638955739993 (0x01d9425ecf427b59)
2023-02-16 18:33:26, Info CSI 00000001 ESU: Product = 50 (0x00000032).
2023-02-16 18:33:26, Info CSI 00000002 ESU: Pre IMDS checks failed, Not Eligible:HRESULT_FROM_WIN32(1605)
2023-02-16 18:33:26, Info CSI 0000005d Performing 1 operations; 1 are not lock/unlock and follow:
(0) LockComponentPath (10): flags: 0 comp: {l:16 b:aa379d115f42d90136000000b4019001} pathid: {l:16 b:aa379d115f42d90137000000b4019001} path: [l:234{117}]"\SystemRoot\WinSxS\x86_microsoft.windows.s..ation.badcomponents_31bf3856ad364e35_6.3.9600.16384_none_cd3183f2deb856d2" pid: 1b4 starttime: 133210638955739993 (0x01d9425ecf427b59)
2023-02-16 18:33:26, Error [0x01805c] CSI 0000005e (F) Failed execution of queue item Installer: Extended Security Updates AI installer ({4e9a75dd-0792-460c-a238-3f4130c39369}) with HRESULT HRESULT_FROM_WIN32(1605). Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable (2)[gle=0x80004005]
2023-02-16 18:33:27, Info CBS Added C:\Windows\Logs\CBS\CBS.log to WER report.

The check returns the error Pre IMDS checks failed, Not Eligible, the machine has been classified as "not eligible for the update". With Windows Server 2012 R2 this is of course bullshit (thanks to the AI component within the check feature, I guess), the developers have broken something and the check for eligibility is faulty.

Only Windows Server 2012 R2 Essentials affected?

Addendum: Based on this blog post (German and English), there have been a number of user feedbacks and there is a growing suspicion that the update install error 0x800F0922 only occurs with Windows Server 2012 R2 Essentials.

Blog reader Mark left a comment, pointing to a post Windows Server Essentials 2012 R2 can't install KB5022899 (2023-02 Security Monthly Quality Rollup) at Microsoft's Q&A section, addressing the same issue. Browsing the discussion gave me new insights.

• The title already addresses "Essential", and within the thread I saw that all messages about the error 0x800F0922 refer to Windows Server 2012 R2 Essentials.
• There is also an excerpt from the CBS.log shown that addresses the "Extended Security Updates AI installer" reporting an error.
• This causes a rollback of the action after processing the "installer queue" – exactly what is observed.

The trace in CBS.log posted within the Q&A section mentions a Microsoft-Windows-SLC-Component-ExtendedSecurityUpdatesAI component. The acronym SLC is likely to stand for "Software Licensing Client" and there is an SLC.dll that checks if a license exists. Certain cracks programs manipulate this SLC.dll to bypass the license check.

In the comments, more affected people confirm the Windows Server 2012 R2 Essentials update bug, and as of Feb. 18, 2023 (after the first version of this blog post was published here), aboddi86 has come forward, adding the following comment:

They added ESU component to block Windows 8.1 Client, apparently they missed adding ServerSolution as supported edition, lol.

no fix other than re-releasing new version of 2023-02 updates with corrected ESU component

And my German edition of the blog post triggered, that two other comments. Reader Mark commented that he has an OEM_COA_NSLP (Original Equipment Manufacturer_Certificate Of Authenticity_Non-System Locked Preinstallation) license. Then blog reader Deniz Ö has come forward to respond to Mark's comment:

Hmm … all I can say is that the servicing stack references four activation IDs explicitly:

{c7e5dd52-ef14-4bf6-bc71-1bf5f5794cd0} (Server 2012 R2 Standard OEM:SLP)
{5b338ef7-8d99-45cb-bb59-618bd328b4a4} (Server 2012 R2 Standard OEM:NONSLP)
{66d129b6-eae9-414e-a39a-ea5b8be961cc} (Server 2012 R2 Datacenter OEM:SLP)
{1226e046-263d-414c-824f-0d4f458cee3a} (Server 2012 R2 Datacenter OEM:NONSLP)

(No signs of activation IDs for Essentials.)

These are used for product ID range checking, but I'm not sure whether the code flow actually arives there.

Only four activation IDs are listed in the servicing stack, affecting the Server 2012 R2 Standard, and Datacenter variants. An entry for Server 2012 R2 Essential is missing. Deniz Ö adds:

In any case, I wonder if update installation succeeds on Standard or Datacenter machines that have been activated with a retail key or a MAK.

At this point, the following assumptions crystallize for me:

• Only Windows Server 2012 R2 Essentials systems seems to be affected.
• It could be that Microsoft's developers "forgot" to include the activation IDs for Windows Server 2012 R2 Essentials before the extended check by the "Extended Security Updates AI installer" took place.
• Or the extended check by the "Extended Security Updates AI installer" is broken – after all the check should pass all Windows Server 2012 R2 editions.

At this point, the only conclusion is: Redmond has screwed up and will have to make improvements.

Addendum: Fix is available, seeWindows Server 2012 R2 (Essentials): SSU KB5022922 fixes installation error 0x800F0922 on Feb. 2023 update

Similar articles:
Microsoft Security Update Summary (February 14, 2023)
Patchday: Windows 10 Updates (February 14, 2023)
Patchday: Windows 11/Server 2022 Updates (February 14, 2023)
Windows 7/Server 2008 R2; Server 2012 R2: Updates (February 14, 2023)
Patchday: Microsoft Office Updates (February 14, 2023)

Windows: Update installation errors (Feb. 2023)