Windows Servicing Reference
CBS Log Cheat Sheet
INTRO
What Are CBS Logs & When Should You Use Them?
What is CBS.log?
The Component Based Servicing (CBS) log is Windows' primary record of every servicing operation performed on the OS — including Windows Updates, hotfixes, feature installations, role changes, and DISM operations. It is written by the TrustedInstaller service and captures every decision the servicing engine makes: what packages were evaluated, which were applied, which were skipped, and any errors encountered along the way.
Located at C:\Windows\Logs\CBS\CBS.log, it is one of the most detailed and reliable sources of truth for diagnosing update failures on Windows Server and Windows Desktop environments. When the log grows beyond a certain size, older entries are archived to CBS.persist.log in the same directory.
What Does CBS.log Contain?
✓ Package Applicability Checks
Every update is evaluated against the OS version, edition, and architecture before being applied. CBS records the full verdict.
✓ Installation Progress
Step-by-step record of each package being staged, installed, or skipped — including DPX decompression progress.
⚠ Warnings & Skipped Items
Missing optional components, absent parent packages for non-matching editions, and non-fatal conditions.
✗ Errors & HRESULT Codes
Failed operations with specific error codes, missing files, access denials, and component store corruption markers.
ℹ Dependency Resolution
Full trace of how CBS resolves package dependencies, prerequisite chains, and version conflicts before applying changes.
ℹ Rollback & Supersession
Records when older package versions are unprojected or superseded as part of applying a newer cumulative update.
When Should You Open CBS.log?
| Scenario | What to Look For |
|---|---|
| Windows Update stuck at 0% or hanging | HRESULT codes, timeout errors, BITS failures |
| Update shows "Failed" in Windows Update history | Error entries near the timestamp of the failure |
| DISM /RestoreHealth fails or takes unusually long | Corruption markers, missing source file errors |
| Server not patched for extended period | Aborted entries, repeated failures on same KB |
| Feature or role installation fails | Package applicability failures, missing parent packages |
| Post-patching instability or unexpected reboots | Incomplete commit entries, pending reboot markers |
| Security scan flags outdated component versions | Installed vs targeted state mismatches for specific packages |
| PSWindowsUpdate or Salt patching script errors | Correlate script error timestamps with CBS entries |
💡 Pro Tip —
CBS.log is verbose by design. The presence of
Warning or Info level entries about absent packages or skipped components is completely normal. Only focus on Error level entries and lines containing HRESULT, failed, or corruption when troubleshooting.
PART 01
Component Abbreviations
| Abbreviation | Full Name | What It Does |
|---|---|---|
| CBS | Component Based Servicing | Core Windows servicing engine — orchestrates all updates and component changes |
| CSI | Component Servicing Infrastructure | Handles low-level component installation, registration, and deployment |
| DPX | Delta Package Expander | Expands and decompresses delta/compressed update packages |
| DISM | Deployment Image Servicing and Management | Manages Windows images and component store integrity |
| TI | Trusted Installer | Windows Modules Installer — physically applies component changes to disk |
| BITS | Background Intelligent Transfer Service | Downloads update packages in the background with bandwidth throttling |
| WU | Windows Update | Update detection, cataloging, and orchestration service |
| POQ | Primitive Operation Queue | Low-level file operation queue executed during servicing transactions |
| OC | Optional Component | Windows optional features such as IIS, DirectPlay, Hyper-V roles |
| WCP | Windows Component Platform | Platform abstraction layer for component lifecycle management |
| SQM | Service Quality Management | Telemetry and diagnostics collection during servicing operations |
| EXEC | Execution Engine | The CBS sub-component that physically applies packages and file operations |
| APPL | Applicability Engine | Evaluates whether a given package or update is applicable to this system |
| RESL | Resolver | Resolves dependencies and conflicts between packages before installation |
| PLOG | Primitive Log | Very low-level operation logging below the CBS layer |
| PLAN | Planning Engine | Builds the execution plan — which packages to install, update, or remove |
PART 02
Log Entry Format & Anatomy
2026-08-08 02:56:22, Info CBS Exec: Skipping Package: Microsoft-Windows-IIS~amd64~~10.0.26100.1 because it is already in the correct state
Timestamp
2026-08-08 02:56:22
Log Level
Info / Warning / Error
Source
CBS
Sub-Component
Exec / Appl / Plan / Resl
Message
Actual operation detail
Log Levels
| Level | Meaning |
|---|---|
| Info | Normal operation — no action needed |
| Warning | Unexpected but non-fatal condition |
| Error | Operation failed — investigation required |
Sub-Components in Log
| Sub-Component | Role |
|---|---|
| Exec | Physically applying package changes |
| Appl | Evaluating package applicability |
| Plan | Building installation execution plan |
| Resl | Resolving package dependencies |
PART 03
Package States
| State | Meaning | Action Required? |
|---|---|---|
| Absent | Package is not installed and not staged on disk | Normal if not applicable to this edition |
| Staged | Package files are present on disk but not yet active | Will be installed on next servicing pass or reboot |
| Resolved | Package dependencies have been successfully resolved | Ready for installation |
| Installed | Package is fully installed and active on the system | No action needed |
| Superseded | Package has been replaced by a newer version | Old version can be cleaned up with DISM |
| Default | No explicit state set — follows parent package state | Normal planning state |
| Invalid | Package is in a broken or unknown state | Run DISM /RestoreHealth |
| Detect | CBS is in detection/evaluation mode only — no changes made | Informational only |
PART 04
Common Log Keywords & Meanings
| Keyword / Phrase | Meaning | Status |
|---|---|---|
| Appl: detectParent | Checking if prerequisite or parent package is present on the system | Info |
| Appl: Evaluating package applicability | Determining whether this update applies to the current OS edition and version | Info |
| Exec: Skipping Package | Package already in the correct state — no changes needed | OK ✓ |
| Exec: Unproject package | Removing or rolling back a superseded package version | Normal |
| Plan: Merge into existing execution | Combining package operations for efficiency in one transaction | Info |
| parent state: Absent | A prerequisite package for this edition is not present — normal for non-matching editions | Usually Normal |
| parent state: Installed | Required parent package confirmed present — update can proceed | OK ✓ |
| applicable state: Installed | Final applicability verdict — update is applicable and cleared for installation | OK ✓ |
| Not able to find .mum in directory | Package manifest file missing from local Software Distribution cache | Warning |
| Failed to find file | A required file is missing from the update package | Error ✗ |
| Commit complete | Update transaction successfully committed to disk | Success ✓ |
| Failed with HRESULT | Operation failed — error code follows for diagnosis | Error ✗ |
| Mark store corruption | CBS has detected corruption in the Windows component store | Critical ✗ |
| Reboot required | A pending reboot is needed to complete the servicing operation | Action Needed |
| External EvaluateApplicability | An external plugin or CBS extension is evaluating applicability | Info |
| Unprojecting Package | Uninstalling a specific deployment of a component | Normal |
| Resolving package | Working out dependency chain for a package before installation | Info |
PART 05
Common HRESULT Error Codes
| Error Code | Meaning | Recommended Action |
|---|---|---|
| 0x80070002 | File not found | Clear SoftwareDistribution cache and retry |
| 0x80070005 | Access denied | Ensure you are running as Administrator |
| 0x8007000D | Invalid / corrupted data | Delete cached download and re-download update |
| 0x80070020 | File in use by another process | Reboot server and retry update |
| 0x800705B4 | Operation timed out | Check network connectivity to WSUS or Microsoft Update |
| 0x80072EFE | Connection was aborted | Check firewall rules — server may be air-gapped or proxy blocked |
| 0x80072EE2 | Network timeout — cannot reach update server | Verify WSUS server reachability or internet connectivity |
| 0x80073712 | Component store is corrupted | Run DISM /Online /Cleanup-Image /RestoreHealth |
| 0x8024200D | Update files are corrupt | Clear SoftwareDistribution folder and force rescan |
| 0x80242016 | Installer encountered an error | Review CBS.log for the specific failing package |
| 0x800F0805 | Package not applicable to this OS edition | Verify correct update for OS version and edition |
| 0x800F0906 | DISM source files not found | Provide source with /Source flag or mount Windows ISO |
| 0x800F0922 | CBS transaction timeout | Check disk space and disable antivirus during patching |
| 0xC1900101 | Driver compatibility failure | Common during feature updates — update drivers first |
| 0x80096004 | Certificate validation error | Check system clock sync and Windows Update certificate store |
| 0x800B0109 | Certificate chain not trusted | Ensure root certificates are up to date |
PART 06
Package Naming Convention
Microsoft-Windows-ErrorReportingCore-Package~31bf3856ad364e35~amd64~~10.0.26100.7309
Package Name
Publisher Token (Microsoft)
Architecture
Version (Major.Minor.Build.Rev)
Architecture Values
| Value | Architecture |
|---|---|
| amd64 | 64-bit x86 (most servers) |
| x86 | 32-bit |
| arm64 | ARM 64-bit |
| wow64 | 32-bit layer on 64-bit OS |
| neutral | Architecture independent |
Version Number Format
| Segment | Example | Meaning |
|---|---|---|
| Major | 10 | Windows 10/11/Server |
| Minor | 0 | Always 0 for Win10+ |
| Build | 26100 | OS build number |
| Revision | 7309 | Patch/update number |
Common OS Build Numbers
| Build | OS Version |
|---|---|
| 14393 | Windows Server 2016 / Windows 10 1607 |
| 17763 | Windows Server 2019 / Windows 10 1809 |
| 20348 | Windows Server 2022 |
| 25398 | Windows Server 2025 (early) |
| 26100 | Windows Server 2025 / Windows 11 24H2 |
| 22000 | Windows 11 21H2 |
| 22621 | Windows 11 22H2 |
| 22631 | Windows 11 23H2 |
PART 06B
Windows Update Error Codes
These error codes appear in WindowsUpdate.log, Get-WUHistory output, PSWindowsUpdate results, and the Windows Update UI. They are distinct from CBS HRESULT codes but often accompany them during patching failures.
| Error Code | Hex Code | Common Name | Meaning & Fix |
|---|---|---|---|
| 0x80070002 | -2147024894 | ERROR_FILE_NOT_FOUND | Update file missing from cache — clear SoftwareDistribution and retry |
| 0x80070005 | -2147024891 | ERROR_ACCESS_DENIED | Permissions issue — ensure TrustedInstaller and SYSTEM have full access |
| 0x80070020 | -2147024864 | ERROR_SHARING_VIOLATION | File locked by another process — reboot and retry immediately |
| 0x8007007E | -2147024770 | ERROR_MOD_NOT_FOUND | Required DLL or module missing — may need SFC /scannow |
| 0x800700C1 | -2147024703 | ERROR_BAD_EXE_FORMAT | Corrupt update binary — re-download the update package |
| 0x8007041D | -2147023843 | ERROR_SERVICE_REQUEST_TIMEOUT | Windows Update service timed out — restart wuauserv and retry |
| 0x80070422 | -2147023838 | ERROR_SERVICE_DISABLED | Windows Update service is disabled — set wuauserv to Manual or Automatic |
| 0x80070570 | -2147023504 | ERROR_FILE_CORRUPT | Corrupt file in update package — clear download cache, run CHKDSK |
| 0x800705B4 | -2147023436 | ERROR_TIMEOUT | Connection timed out — check WSUS reachability and network latency |
| 0x80072EE2 | -2147012894 | WININET_E_TIMEOUT | Cannot reach Windows Update / WSUS server — check firewall and DNS |
| 0x80072EFD | -2147012867 | WININET_E_CANNOT_CONNECT | No connection to update server — verify WSUS URL and port 8530/8531 |
| 0x80072EFE | -2147012866 | WININET_E_CONNECTION_ABORTED | Connection dropped mid-download — firewall or proxy terminating connection |
| 0x80072F8F | -2147012721 | WININET_E_DECODING_FAILED | TLS/SSL certificate issue — check system time and root certificates |
| 0x80073712 | -2147010798 | ERROR_SXS_COMPONENT_STORE_CORRUPT | Component store corrupted — run DISM /Online /Cleanup-Image /RestoreHealth |
| 0x8007371B | -2147010789 | ERROR_SXS_TRANSACTION_CLOSURE_INCOMPLETE | Incomplete servicing transaction — reboot, then run SFC /scannow |
| 0x80096004 | -2146869244 | TRUST_E_CERT_SIGNATURE | Certificate signature invalid — sync system clock, check root CA store |
| 0x8024000B | -2145124341 | WU_E_CALL_CANCELLED | Update operation was cancelled — retry, check for conflicting WU tasks |
| 0x8024000E | -2145124338 | WU_E_XML_INVALID | Windows Update XML data invalid — clear SoftwareDistribution\DataStore |
| 0x80240016 | -2145124330 | WU_E_INSTALL_NOT_ALLOWED | Install blocked — another install in progress or pending reboot required |
| 0x80240017 | -2145124329 | WU_E_NOT_APPLICABLE | Update not applicable to this system — OS version or edition mismatch |
| 0x8024001E | -2145124322 | WU_E_SERVICE_STOP | Windows Update service stopped unexpectedly — restart wuauserv |
| 0x8024001F | -2145124321 | WU_E_NO_CONNECTION | No network connection available — check NIC, DNS, and routing |
| 0x80242006 | -2145116154 | WU_E_UH_INVALIDMETADATA | Update metadata invalid — re-sync WSUS or clear WU cache |
| 0x8024200D | -2145116147 | WU_E_UH_NEEDANOTHERDOWNLOAD | Update files corrupt or incomplete — delete cached files and re-download |
| 0x80242016 | -2145116138 | WU_E_UH_POSTREBOOTUNEXPECTEDSTATE | Update in unexpected state after reboot — re-run Windows Update |
| 0x8024402C | -2145107924 | WU_E_PT_WINHTTP_NAME_NOT_RESOLVED | WSUS/WU server DNS resolution failed — check DNS and WSUS hostname |
| 0x80244010 | -2145107952 | WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS | Too many round trips to server — WSUS server overloaded or throttling |
| 0x80245003 | -2145107965 | WU_E_REDIRECTOR_ID_SMALLER | Redirector cabinet file version mismatch — clear WU cache and retry |
| 0xC1900101 | -1056505087 | MOSETUP_E_DRIVER_COMPAT | Driver compatibility failure during feature update — update all drivers first |
| 0xC1900200 | -1056505344 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | System does not meet minimum requirements for the update |
| 0xC1900208 | -1056505336 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | Incompatible app blocking upgrade — uninstall flagged application first |
| 0x800F0805 | -2146963451 | CBS_E_INVALID_PACKAGE | Update package not valid for this OS edition — verify correct KB for OS |
| 0x800F0906 | -2146963194 | CBS_E_MISSING_EXECUTION_SOURCE | Source files not found for DISM — mount ISO or provide /Source path |
| 0x800F0922 | -2146963166 | CBS_E_INSTALLERS_FAILED | One or more installers failed — low disk space or antivirus interference |
| 0x800F081F | -2146963425 | CBS_E_SOURCE_MISSING | Source for .NET or feature package missing — use DISM with Windows ISO |
💡 DPX Progress Note —
DPX Progress : 80 in CBS.log means the Delta Package Expander is 80% through decompressing the update package. Values 0–99 indicate active decompression; 100 means expansion is complete and CBS will proceed to installation. If this value does not advance for 15+ minutes and TiWorker shows 0% CPU, the operation is stuck and a WU component reset is needed.
PART 07
PowerShell Grep Commands for Troubleshooting
Find all errors and failures
Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "error|failed" | Select-Object -Last 30
Find specific HRESULT error codes
Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "HRESULT"
Find component store corruption markers
Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "corrupt|corruption"
Find reboot pending entries
Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "reboot"
Find entries for a specific KB
Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "KB5012345"
View last 100 lines
Get-Content "C:\Windows\Logs\CBS\CBS.log" | Select-Object -Last 100
Find entries from a specific time window
Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "2026-08-08 03:"
Find missing file errors specifically
Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "Not able to find|Failed to find"
Export all errors to a text file for review
Select-String -Path "C:\Windows\Logs\CBS\CBS.log" -Pattern "error|failed|HRESULT" | Out-File "C:\Temp\CBS_Errors.txt"
View archived/older CBS log
Get-Content "C:\Windows\Logs\CBS\CBS.persist.log" | Select-Object -Last 100
PART 08
Common Scenarios & What to Look For
⚠ Update Stuck at 0%
Search: "HRESULT", "timeout", "connection"
Check BITS service status and SoftwareDistribution folder size. If static, reset WU components.
✗ Update Failing / Aborted
Search: "Error", "Failed", "Aborted", "HRESULT"
Note the HRESULT code and cross-reference with Part 5. Most common fix is clearing SoftwareDistribution cache.
✗ Component Store Corrupted
Search: "mark store corruption", "0x80073712"
Run
DISM /Online /Cleanup-Image /RestoreHealth then retry Windows Update.⚠ Missing Package Files
Search: "Not able to find", "Failed to find file"
Package manifest (.mum) or payload files missing from cache. Usually resolves after clearing SoftwareDistribution.
✓ Update Completed Successfully
Search: "Commit complete", "success"
Servicing transaction committed. May still require reboot to finalize — check for "reboot required" entries.
⚠ Reboot Pending
Search: "reboot required", "pending"
Kernel drivers and some components can only be replaced after reboot. Schedule maintenance window.
ℹ Applicability Check (Normal)
Search: "applicable state", "detectParent"
CBS evaluating which editions/versions the update applies to. "Absent" parent states for non-matching editions are normal.
✗ Access / Certificate Error
Search: "0x80070005", "0x80096004", "certificate"
Check Administrator privileges, system clock synchronization, and root certificate store integrity.
⚠ Network / WSUS Connectivity
Search: "0x80072EFE", "0x80072EE2", "connection"
Server cannot reach update source. Verify WSUS server URL in registry and firewall rules for port 8530/8531.
Quick Fix — Reset Windows Update Components
Run as Administrator — resets WU cache and services
# Stop services Stop-Service wuauserv, BITS, cryptsvc -Force # Clear corrupted cache Remove-Item "C:\Windows\SoftwareDistribution\*" -Recurse -Force Remove-Item "C:\Windows\System32\catroot2\*" -Recurse -Force # Restart services Start-Service cryptsvc, BITS, wuauserv # Force rescan UsoClient StartScan UsoClient StartDownload
