Microsoft Windows SBS 2008 system hang-up after Windows Security Update

Problem Description from Internet source:
You do a windows update and it asks for a reboot, after a reboot windows will stop at the stage below and it won’t start. It may start rebooting itself (loop).
Configuring updates Stage 3 of 3, 0% completed

Traditional MS Solution on TechNet

Find your install media.  Remember to hit F8 to get into the recovery console.
But here’s the workaround:
- Using the install media, the server was booted into the recovery console.
- In the following directory, c:\windows\winsxs, the pending.xml file was
renamed pending.old
you may delete  pending files, and it will create new one on next windows update

you may use another recovery disk as we did but if you are using windows DVD to do this steps you may need to follow :

1. Insert the Windows Server 2008 installation DVD and restart the computer from the DVD.
Note During the start-up process, when you are prompted to Press any Key to restart from the CD or DVD, press a key.

2. Select your language settings, and then click Next.
3. In the Setup window, click Repair your computer.

Note If you are asked whether you want to do a system restore, click No .

4. In the System Recovery Options window, select the operating system, and then click Next.

Note : If the repair process detects problems starting Vista, it runs Start-up Repair to automatically fix the problems. If this occurs, click Cancel, and then click
View advanced options for system recovery and support.

5. In the System Recovery Options window, click Command Prompt
6.Type the following commands and press ENTER after each command:

icacls c:\windows\winsxs\pending.xml /grant administrators:F
del c:\windows\winsxs\pending.xml

Successful alternative 

Step 1:

Reboot the server with bootable media ‘ERD Commander 2007’ (a third party software recovery product)

Using this tool we could access the Pending.xml file (if using windows disks you need to change permissions for pending.xml) we changed it to pending.old.


Step 2:

 Change some registry keys as below:
Undo changes to the registry using the following process (YES, you NEED to do this)
1. Type regedit, and then press ENTER.
2. Select HKEY_LOCAL_MACHINE.
3. On the File menu, click Load Hive.
4. Locate the following folder      C:\windows\system32\config\components
5. When you are prompted for a name, type Offline_Components
6. In Registry Editor, locate and then delete the following registry subkey:
1.      HLKM\Offline Components\AdvancedInstallersNeedResolving
2.      HKLM\Offline Components\PendingXmlIdentifier


Step 3:

Recreate HKLM\BaseSystem\CurrentControlSet\Control\Session Manager /v SetupExecute /t REG_MULTI_SZ
If was there we should delete the value for the key, it should be empty
1. Open Registry Editor
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP and create the following Multi-string value: DependOnService
3. Double click the new DependOnService entry
4. Type CRYPTSVC in the Value Data field and click OK.
This will prevent LSAS.exe to go into deadlock.


Step 4:

Restart the server into safe mode, which will bypass the windows update but you can’t log in since all services are stopped.
Restart the server into normal windows mode, now you can log in but majority of services are stopped and you can’t stop start anything.
At this moment some services might stuck on ‘stopping or starting’ status. And if you check Service Control Management as below you will get the message showing the service database is locked. And that’s why services are not starting.

Run the following command from the command Prompt:
scquerylock
The output below is indicating that the SCM database is currently locked:
QueryServiceLockstatus - Success
IsLocked : True
LockOwner : .\NT Service Control Manager
LockDuration : 1090 (seconds since acquired)


Step 5:
Uninstall WSUS if it’s running on the same server
1.      On the WSUS server, click Start, click Server manager, and then click server roles
2.      Click Windows Server Update Services, and then click Uninstall.
3.      In the Remove Windows Server Update Services pane, click Database, click Log Files, click Downloaded Updates, and then click next.
4.      Click Next to start uninstalling WSUS. Be aware that as soon as you start uninstalling this software, you will be unable to cancel the process.
5.      When the uninstall process is completed, click Finish to exit the wizard.


Step 6:

Disabled the Background Intelligent Transfer Service
To do this, follow these steps:
1.      Log on to the affected server.
2.      On the Start menu, click Run, type services.msc, and then click OK.
3.      Select Standard services
4.      In the Results pane, find a Background Intelligent Transfer Service and disabled from the properties

       
                       
Step 7:
Once you managed to reboot the server to the normal windows mode execute following to remove latest windows update to which caused issues
Follow these steps:
1. Click Start  -  select  Run  'appwiz.cpl'
2. Click View installed updates.
3. Click on respective security update (KB article) and then click Uninstall.
                    
Important note: At any of the restart caused system hang up then ‘ERD Commander 2007’CD is to be used to disabled the Exchange, SQL services

Step 8:

IPV6 should be enabled to start most of the core windows services in SBS 2008

SBS 2008 is designed to fully support IPv6 and has IPv6 enabled by default. You can make it work with IPv6 disabled but every time you run one of the SBS wizards it will be re-enabled.
1. Click Start
2. Start run
3. Ncpa.cpl
Re-check IPv6 in the properties of the NIC
NOTE: IPv4 must also be enabled.


Step 9:

Manually start the AD topology, RPC, DNS, DHCP, Exchange, SQL services and set to automatic
If Windows informs you that a problem occurred when the Exchange Server services tried to start, you can manually start all required Exchange Server services.
To do this, follow these steps:
1.      On the Start menu, click Run, type services.msc, and then click OK.
2.      In the Results pane, find a Microsoft Exchange service.
3.      Right-click the service, and then click Restart.
4.     Repeat steps 3 and 4 for all Exchange services that do not start.

Note:Start any other typical windows services as needed either manually or by setting to automatic (need to restart the sever)


Step 10:

Check list
1. Check DNS – console and make sure there no issues
Start –run- dnsmgmt.msc

2. Check DHCP – console and make sure there no issues
Start –run- dhcpmgmt.msc

3. Check Active directory services
Start –run- dsa.msc
Check exchange 2007
4. Open exchange console and check the exchange database
Servers – mailbox – database (should already be mounted)
5. Check all the SQL services
6. Check event viewer
Start – run – eventvwr