Forum Discussion
Unable to Uninstall Security Update (KB5094128) on Azure Hosted Windows Server 2022 VM
Hi All,
I'm building up a system on Azure of Windows Server 2022 VMs for a PoC. Each Windows Server 2022 VM has been created using a company hardened golden image.
After configuring the VM successfully, I am unable to run a software. Through research, the solution to run the software is to uninstall 'Security Update for Microsoft Windows (KB5094128)'.
The issue is that I cannot uninstall the update normally. I have looked up various solutions and the following have been unsuccessful:
Attempt #1 Powershell (Admin):
sfc /scannow
wusa /uninstall /kb:5094128
Result: Error 0x800f0905.
Attempt #2 Powershell (Admin):
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /RestoreHealth
wusa /uninstall /kb:5094128
Result: No corruption detected, error 0x800f0905.
Attempt #3 Powershell (Admin):
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old
net start wuauserv
net start cryptSvc
net start bits
net start msiserver
wusa /uninstall /kb:5094128
Result: All services started and stopped. Error error 0x800f0905.
Attempt #4 Windows Update Troubleshooter:
Running the windows update troubleshooter gives the following output.
The event viewer is suggesting there is a corrupted file error, but as seen above nothing is wanting to remove that file.
Does anyone have any other options they could suggest? Or has anyone had success with this issue before?
Is it a lost cause as we have to use company hardened golden images?
Any suggestions would be appreciated!
2 Replies
Thanks for the detailed response!
So running the Get-PackageInfo cmdlet on the package that I suspect is the KB5094128 package yields in the following error:Looking at the dism.log file, I've identified the following as the error relating to the cmdlet:
Error DISM DISM Package Manager: PID=7404 TID=5220 Failed to load identity from package name: Package_for_ServicingStack_5251~31bf385. - CDISMPackageManager::Internal_CreatePackageByName(hr:0x80070057)
Error DISM DISM Package Manager: PID=7404 TID=5220 Failed to get the underlying cbs package. - CDISMPackageManager::OpenPackageByName(hr:0x80070057)
Error DISM DISM Package Manager: PID=7404 TID=5220 Failed opening package with the name "Package_for_ServicingStack_5251~31bf385" - CPackageManagerCLIHandler::Private_GetPackageNameFromCommandLine(hr:0x80070057)
Error DISM DISM Package Manager: PID=7404 TID=5220 Failed to get the list of packages from the command line. - CPackageManagerCLIHandler::ProcessCmdLine_GetPackageInfo(hr:0x80070057)
Error DISM DISM Package Manager: PID=7404 TID=5220 Failed while processing command get-packageinfo. - CPackageManagerCLIHandler::ExecuteCmdLine(hr:0x80070057)
Info DISM DISM Package Manager: PID=7404 TID=5220 Further logs for online package and feature related operations can be found at %WINDIR%\logs\CBS\cbs.log - CPackageManagerCLIHandler::ExecuteCmdLine
Error DISM DISM.EXE: DISM Package Manager processed the command line but failed. HRESULT=80070057
This is making me think that there is a corruption somewhere - have you got any ideas?
On the note this not being safe - I agree. Our system is thankfully airgapped and this was identified as a potential quick fix. We are feeding back to the software developer to patch for this erroThe screenshots show a healthy component store, KB5094128 listed in Installed Updates, and WUSA consistently returning 0x800f0905. KB5094128 is the June 2026 cumulative security update for Windows Server 2022, and not every Windows update package supports removal. Before trying anything else, snapshot or clone the Azure VM. Use DISM /Online /Get-Packages to identify the exact package, then DISM /Online /Get-PackageInfo /PackageName:<name> to inspect its state and release type. If Windows reports the package as permanent or removal remains unsupported, do not delete files from WinSxS or edit CBS registry data; that can leave the image unserviceable. For this proof of concept, deploy a test VM from an approved pre-update image or test a newer cumulative update instead. The software vendor should provide a compatibility fix, because permanently removing a current security update is not a safe production solution.
