DISM and Windows updates can sometimes become a huge pain. Especially when a CU update fails with errors that don't seem to make sense.

 

First things first, I need to explain a key component to the Windows "WinSXS", also known as the "Side-By-Side" folder and the Component Store Registry also known as  "CBS" store 

It’s important to know that the contents of the WinSxS folder shouldn’t simply be deleted, as this can significantly impair the system’s functionality. In this article, we show you how you can reduce the size of WinSxS without harming your system.

Windows stores important system information in the WinSxS folder. If you delete or move the folder, certain processes may not be able to run properly.

Lets dive a little deeper:

The Windows SXS folder is used to store updates and copies of previous update files for rollback or removals or corruption repairs. 
You can't simply remove files or folders in here without causing a lot of pain simply because there are important links between the Registry, Updates, and Drivers that are dependent on this folder. From a storage disk level its special as well by utilizing soft-links everywhere.  Because of this. if you look at the folder size , it is miss-leading . Explorer looks at it from a flat file view, meaning that it doesn't see soft-links and will add up the storage overall much higher than actual on disk.

*Special Notes
Generally the older the OS gets, the WINSXS folder gets larger. 

• 6-9 Gigs | Fresh install same year as release.
•  10-12 Gigs | 3-5 yrs old OS
• 14-17 Gigs | Consistent with an OS that is 5Yrs and up.

If your folder is larger than these, good chance it's needing a cleanup. I'll explain how to do this further down.

Lets look further into the SXS folder.  Most of the folders are the packages themselves, They contain the updates, Drivers and such. 
There are a few other important files here as well. 

 Backup: Contains the past Manifest files that tell what dependencies there are for a particular package. Usually files here are getting ready to be purged.
Catalogs: This Contains the catalog files from each package update applied. .cat files keep the certificate signatures and the hash's that validate the files that are original and intact from the publisher and not easily changed. 

I'm going to skip a few folders for now since they are a bit off topic. 

 

Manifests: Like the Catalogs, manifests contains the inter-dependencies within the updates like what files and versions of the file belong to which package deployment.

For instance:

• KB4405 is an update to KB4403.
• Or  file "sysdriver.drv" needs to have a previous version installed of 4.06 required file version before proceeding.
  

If this area gets corrupt, the system will fail on updates. Microsoft usually does "ok" in keeping these straight, but sometimes on occasions, a manifest is removed but not "unregistered" out of the component store. This will report back as component store corruption and will cause update failures.



Further down we see a few more interesting folders. 
As installations take place, there's a sort of shuffling of files.

Inflight: These are packages that are in the process of being updated. Often times you have a "reboot pending" from recent updates applied, those packages are stored here to be applied on next boot.. as these packages are applied they are stored in the general winsxs for future rollbacks or corrections. 
PendingDeletes: These are package instructions to the OS during Pre-boot of what files to delete, usually because they were locked "in-use" when the OS was running and could not be swapped without causing interruptions. So before the system starts up." in a perfect world"  it will process all the delete requests and this folder should be empty.
PendingRenames: These are just that.. During pre-boot, once the file that is to be swapped as been deleted, the package file will be renamed to the final name something like Package_00465.cab to StoreOn.drv for example, completing the update. 

 These folders have a very tight relationship with the "component store" in the Registry so take care of what you do here as well. 

This concludes the general overview of the WINSXS contents. 

 

When an update is triggered either by WSUS "WUSA" or DISM, A special user account is used to install the package. This is called the "TrustedInstaller"
TrustedInstaller is special because its the system Built-in account that has the most access to all areas of the OS, one of the few accounts with kernel access.  

Everything trusted installer does through DISM is logged under the CBS.log located under  C:\windows\logs\cbs\cbs.log 
In here you can find all sorts of information on missing packages or issues that are keeping you from completing your updates. 
We will revisit this log later for the advanced repair tutorials.