{"id":3200,"date":"2024-08-16T09:30:58","date_gmt":"2024-08-16T08:30:58","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=3200"},"modified":"2024-09-05T14:18:49","modified_gmt":"2024-09-05T13:18:49","slug":"windows-server-aug2024-patch-issues-kb5041578","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=3200","title":{"rendered":"WINDOWS SERVER AUG2024 PATCH ISSUES | KB5041578"},"content":{"rendered":"\n

I have seen big problems with KB5041578 on Windows 2019 causing disk i\/o issues with massive writes to c:\\windows\\catroot2\\edb.log.<\/p>\n\n\n\n

In the beginning, we noticed SAN i\/o issues, so it took a few hours to identify the root-cause why VMs were sending massive writes to storage.<\/p>\n\n\n\n

\n

Impacted servers throws an JET error -1811 in the bottom of file c:\\windows\\system32\\catroot2\\dberr.txt<\/strong>.

CatalogDB: 09:39:40 16-08-2024: catdbsvc.cpp at line #7085 encountered JET error -1811
CatalogDB: 09:39:40 16-08-2024: catdbsvc.cpp at line #4876 encountered JET error -1811
CatalogDB: 09:39:40 16-08-2024: catdbsvc.cpp at line #3779 encountered JET error -1811
CatalogDB: 09:39:40 16-08-2024: catdbcli.cpp at line #624 encountered JET error -1811
CatalogDB: 09:39:40 16-08-2024: catadnew.cpp at line #2481 encountered JET error -1811<\/p>\n<\/blockquote>\n\n\n\n

You can also see if you are impacted by using resource monitor as shown in the picture below.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Solution<\/h2>\n\n\n\n

Delete the folder C:\\windows\\system32\\catroot2<\/strong>, which will reset the management database. You need to stop the Cryptographic service.<\/p>\n\n\n\n

You can boot the server into Safe Mode and delete the files.<\/p>\n\n\n\n

If you have enough resources to run Powershell session, you can also run this:<\/p>\n\n\n\n

Set-service CryptSvc -StartupType Disabled\nStop-service Wuauserv -Force\nStop-service cryptsvc -Force\nStop-service bits -Force\nRemove-Item -Path C:\\windows\\system32\\catroot2 -Recurse -Force\nSet-service CryptSvc -StartupType Automatic\nStart-service Wuauserv\nStart-service cryptsvc\nStart-service bits\n$Dependencies = Get-service CryptSvc | select -expand DependentServices\n$Dependencies | ForEach-Object { start-service -Name $_.Name -PassThru }<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
More info from Microsoft<\/h2>\n\n\n\n
The issue is now mentioned in the known issues in the release info<\/a><\/p>\n\n\n\n
Example of how to apply the KIR (Known Issue Rollback) is commented here<\/a>. <\/p>\n\n\n\n
\n
Personally I have not tried KIR. I don’t feel confident WHAT the goal is for this KIR. Does it uninstall the impacted hotfix and block it in the future ? Or is the better approach to reset the db by deleting CATROOT2-folder and then apply the update if removed. <\/p>\n\n\n\n
I feel the last method is better for the future, as the machine stay protected of the  vulnerabilities included in the patch. Removing the update puts the server both in unnecessary risk but also a odd support situation, where servers are not patched to the same level.<\/p>\n<\/blockquote>\n\n\n\n
\"\"<\/figure>\n\n\n\n
#MVPbuzz<\/a> #Microsoft<\/a> #PatchTuesday<\/a> #Windows<\/a> #Issues<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
I have seen big problems with KB5041578 on Windows 2019 causing disk i\/o issues with massive writes to c:\\windows\\catroot2\\edb.log. In … <\/p>\n
Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[165],"tags":[],"class_list":["post-3200","post","type-post","status-publish","format-standard","hentry","category-microsoftsecurityupdates","infinite-scroll-item"],"featured_image_src":null,"author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3200"}],"version-history":[{"count":10,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3200\/revisions"}],"predecessor-version":[{"id":3278,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3200\/revisions\/3278"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}