Offline Servicing: Failed to install update with error code 5 #sysctr

In general and more specific for Configuration Manager there Antivirus Exclusions lists available in order to let Configuration Manager function optimally thorough security level from anti-malware and antivirus perspective.

During a Configuration Manager implementation I was running into an issue with Offline Servicing. Scheduled Offline Servicing ended up in unpredicted results like not all Windows Updates (randomly) were applied of even images which got corrupted.

Failed to install update with error code 5    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:03:55    2448 (0x0990)
InstallUpdate returned code 0x80070005    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:03:55    2448 (0x0990)
STATMSG: ID=7911 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_OFFLINE_SERVICING_MANAGER" SYS= SITE=E00 PID=4132 TID=2448 GMTDATE=di mrt 19 14:03:55.834 2013 ISTR0="13442" ISTR1="E000008D" ISTR2="1" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:03:55    2448 (0x0990)
Failed to install update with ID 13442 on the image. ErrorCode = 5    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:03:55    2448 (0x0990)
Checking if update (4 of 14) with ID 13446 needs to be applied on the image. 1 content binarie(s) are associated with the update.    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:03:55    2448 (0x0990)
Applicability State = APPLICABLE, Update Binary = D:\ConfigMgr_OfflineImageServicing\29b91e22-5061-4ed5-86fb-f1305d175f25\windows6.1-kb2790655-x64.cab.    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:03:58    2448 (0x0990)
Applying update with ID 13446 on image at index 1.    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:03:58    2448 (0x0990)
Failed to install update with error code -2146498512    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:04:01    2448 (0x0990)
InstallUpdate returned code 0x800f0830    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:04:01    2448 (0x0990)
STATMSG: ID=7911 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_OFFLINE_SERVICING_MANAGER" SYS= SITE=E00 PID=4132 TID=2448 GMTDATE=di mrt 19 14:04:01.599 2013 ISTR0="13446" ISTR1="E000008D" ISTR2="1" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:04:01    2448 (0x0990)
Failed to install update with ID 13446 on the image. ErrorCode = 2096    SMS_OFFLINE_SERVICING_MANAGER    19-3-2013 15:04:01    2448 (0x0990)

Troubleshooting this issue I used the following log files:

• %windir%\LOGS\DISM/Dism.log
• %program files%\Microsoft Configuration Manager\Logs\OfflineServicingMgr.log

Despite the Antivirus Exclusions applied accordance to best practices for Configuration Manager and excluded the folders below, Offline Servicing process wasn’t stable as mentioned.

• %windir%\TEMP\ and subfolders
• <driveletter>\ConfigMgr_OfflineImageServicing and subfolders

Using Resource Monitor I noticed the above folders were extensively used by dism.exe and dismhost.exe processes.

Added both processes dism.exe and dismhost.exe to the Antivirus Exclusions list solved our problem and were able successfully to servicing images offline without missing updates or getting corrupted.

The customer uses Symantec Endpoint Protection manager 12 (SEP) but there similar issues known for example with McAfee.