DISM repairs for (old) updates still requiring reboot

The reason for this post is to share my ‘solution’ for getting around an old cumulative windows update still needing a reboot that was obstructing a newer cumulative update. Clearly something gone wrong during install and corrupted the windows installer registration.

Below is the results of my various attempts to fix this issue and have Windows Security Updates to resume its automated operation.

Normally one is instructed to start with:


that fixes most issues. However in my case SFC could not repair my Windows 10 installation.

Next up un such case is running:

DISM /Online /Cleanup-Image /RestoreHealth

Reading its logs revealed some files from the stuck install where still missing or incorrect.

So I downloaded the full *.msu files from Microsoft for the stuck update, in my case and this example:


I extracted this msu into a temporary folder (‘C:\Temp\msu’ in this example) using

EXPAND  -f:*.* “C:\Temp\msu\Windows10.0-kb4569751-x64-ndp48_99e0fedbc8108ac53c27032c7d2fa08e21bcd22f.msu” c:\temp\msu

This results in a small number of files, one of them being the Windows10.0-KB4569751-x64-NDP48.cab file.


The other 3 files:

  • Windows10.0-KB4569751-x64-NDP48.xml,
  • Windows10.0-KB4569751-x64-NDP48-pkgProperties.txt,
  • WSUSSCAN.cab

can be ignored.

I extracted/expanded this Windows10.0-KB4569751-x64-NDP48.cab file into a temporary folder: 

EXPAND -f:*.* “C:\Temp\msu\Windows10.0-KB4569751-x64-NDP48.cab c:\temp\msu\Windows10.0-KB4569751-x64-NDP48


I had to create this folder:


in this example,  before issuing the EXPAND command.

In the ‘c:\temp\msu\Windows10.0-KB4569751-x64-NDP48’ folder one should now see a number of folders, xml files and manifest files.

Note: The popular archive tool WinRAR is able to extract the cab file yet does not apply filenames correctly, rendering the result useless.

Using this folder as source I ran DISM again:

DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\Temp\msu\Windows10.0-KB4569751-x64-NDP48

to restore corrupted/mismatched manifest files.

The result I checked with:


The SFC logs still show a few dynamic link libraries (dll’s) as being corrupted and not repairable by SFC.

Running DISM again fixed the missing dll’s (after the manifests are corrected it finally knows the exact .Net dll’s versions):

DISM /Online /Cleanup-Image /RestoreHealth /Source:C:\Temp\msu\Windows10.0-KB4569751-x64-NDP48

Again checking the results:


shows that SFC is finally able to restore/repair the remaining issues. as it shows:

Windows Resource Protection found corrupt files and successfully repaired them. For online repairs, …

as message. Performing another SFC run to check:


finally shows:

Windows Resource Protection did not find any integrity violations’.


DISM /Online /Cleanup-Image /RestoreHealth

finally shows:

The restore operation completed successfully. The operation completed successfully’.

And at last:

Settings | Update & Security | Windows Update

now shows:

You’re up to date’

instead of an error/retry message.

Thanks to the authors of these two post:

for showing how to extract an *.msu file and use it as DISM input, albeit in a different manner and for other purposes).

for showing how to correctly extract the *.cab file.

This entry was posted in Windows and tagged , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s