已解决：2026 7月安全更新 KB5101650 安装失败 0x80070005

PhozeAMTB

2026-07 安全更新(KB5101650) 反复安装失败。
系统为Windows 11 25H2 26200.8737 专业工作站版，原版未精简

CBS日志显示

1. 
   
2. 2026-07-16 20:44:08, Info                  CBS    Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Percent progress: 15.
   
3. 2026-07-16 20:44:09, Error                 CSI    00000001 (F) STATUS_ACCESS_DENIED #21229# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation|AllowTransactionalConflict), handle = {provider=NULL, handle=0, name= ("null")}, da = (DELETE|SYNCHRONIZE|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|FILE_READ_DATA), oa = @0xd7eb67b770->OBJECT_ATTRIBUTES {s:48; rd:null; on:[69]'\??\C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe'; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xd7eb67b7e8, as = (n[gle=0xd0000022]
   
4. 2026-07-16 20:44:09, Error                 CSI    ull), fa = (FILE_ATTRIBUTE_NORMAL), sa = 0, cd = FILE_OPEN, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT|FILE_OPEN_REPARSE_POINT), eab = NULL, eal = 0, disp = Invalid)
   
5. [gle=0xd0000022]
   
6. 2026-07-16 20:44:09, Error                 CSI    00000002 (F) STATUS_ACCESS_DENIED #21228# from Windows::Rtl::SystemImplementation::CSystemIsolationLayer::OpenFilesystemFile(flags = (SharingViolationIsOk|TransactionalConflictIsOk), da = (DELETE|SYNCHRONIZE|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|FILE_READ_DATA), fn = [l:69]'\??\C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe', sa = 0, oo = (FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE|FILE_OPEN_FOR_BACKUP_INTENT|FILE_OPEN_REPARSE_POINT), file = NULL, disp = Invalid)
   
7. [gle=0xd0000022]
   
8. 2026-07-16 20:44:09, Info                  CSI    00000003 Direct SIL provider: Number of files opened: 2504.
   
9. 2026-07-16 20:44:09, Info                  CBS    Failure in poqexec.exe while processing updates. [HRESULT = 0x80070005 - E_ACCESSDENIED]

复制代码

提示无法操作 C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe ，怀疑WD自保护导致安装失败。
禁用WD后再次更新显示

1. 2026-07-16 20:44:09, Error                 CSI    00000001 (F) STATUS_ACCESS_DENIED #21229# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation|AllowTransactionalConflict), handle = {provider=NULL, handle=0, name= ("null")}, da = (DELETE|SYNCHRONIZE|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|FILE_READ_DATA), oa = @0xd7eb67b770->OBJECT_ATTRIBUTES {s:48; rd:null; on:[69]'\??\C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe'; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xd7eb67b7e8, as = (n[gle=0xd0000022]
   
2. 2026-07-16 20:44:09, Error                 CSI    ull), fa = (FILE_ATTRIBUTE_NORMAL), sa = 0, cd = FILE_OPEN, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT|FILE_OPEN_REPARSE_POINT), eab = NULL, eal = 0, disp = Invalid)
   
3. [gle=0xd0000022]
   
4. 2026-07-16 20:44:09, Error                 CSI    00000002 (F) STATUS_ACCESS_DENIED #21228# from Windows::Rtl::SystemImplementation::CSystemIsolationLayer::OpenFilesystemFile(flags = (SharingViolationIsOk|TransactionalConflictIsOk), da = (DELETE|SYNCHRONIZE|FILE_READ_ATTRIBUTES|FILE_WRITE_ATTRIBUTES|FILE_READ_DATA), fn = [l:69]'\??\C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe', sa = 0, oo = (FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE|FILE_OPEN_FOR_BACKUP_INTENT|FILE_OPEN_REPARSE_POINT), file = NULL, disp = Invalid)
   
5. [gle=0xd0000022]
   
6. 2026-07-16 20:44:09, Info                  CSI    00000003 Direct SIL provider: Number of files opened: 2504.
   
7. 2026-07-16 20:44:09, Info                  CBS    Failure in poqexec.exe while processing updates. [HRESULT = 0x80070005 - E_ACCESSDENIED]

复制代码

1. 2026-07-16 20:44:56, Error                 CSI    0000000d (F) Error: ResolvePendingTransactions called after poqexec failure (call 1)
   
2.   Status = STATUS_ACCESS_DENIED, Operation = HardLinkFile, DiagString = [l:206]'\SystemRoot\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.26100.8875_none_e0433f03f8ff0610\OfflineScannerShell.exe, \??\C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe'
   
3. [gle=0x80004005]
   
4. 2026-07-16 20:44:56, Info                  CBS    Reporting poqexec status with status: 0xc0000022, failed file: OfflineScannerShell.exe, interfering process: , context: PSRL, first merged sequence: 131
   
5. 2026-07-16 20:44:56, Error                 CBS    Startup: Primitive operations failed, startupPhase: 0.  The transaction will be cancelled. [HRESULT = 0x800f0921 - CBS_E_PRIMITIVES_FAILED]

复制代码

求解决方法


[更新]
2026-07 预览更新 (KB5101684) (26200.8968)\(26200.8973) 均有尝试通过WindowsUpdate 更新Program Files下的WD或WinSXS下的WD组件，而WD自保护阻止这些更新，似乎导致0x80070005错误。

1. 2026-07-31 16:30:44, Error                 CSI    000000e3@2026/7/31:08:30:44.532 (F) onecore\base\wcp\sil\ntsystem.cpp(2867): Error STATUS_ACCESS_DENIED originated in function Windows::Rtl::SystemImplementation::WorkAroundBackupIntentForFilesystem expression: (null)
   
2. [gle=0x80004005]
   
3. 2026-07-31 16:30:44, Info                  SXS        C(14800) Staging shsvcs.dll.mui (RD)
   
4. 2026-07-31 16:30:44, Error                 CSI    000000e4@2026/7/31:08:30:44.532 (F) Attempting to mark store corrupt with category [l:18 ml:19]'CorruptPayloadFile'[gle=0x80004005]
   
5. 2026-07-31 16:30:44, Info                  SXS    Delta files missing for Windows-Defender-Service.Resources, version 10.0.26100.8972, arch amd64, culture [l:5]'zh-CN', nonSxS, pkt {l:8 b:31bf3856ad364e35} MpAsDesc.dll.mui in rebase scenario, will attempt hydration back to non-RTM baseline
   
6. 2026-07-31 16:30:44, Info                  SXS    Could not find a path to hydrate file MpAsDesc.dll.mui from Windows-Defender-Service.Resources, version 10.0.26100.1, arch amd64, culture [l:5]'zh-CN', nonSxS, pkt {l:8 b:31bf3856ad364e35} to Windows-Defender-Service.Resources, version 10.0.26100.8972, arch amd64, culture [l:5]'zh-CN', nonSxS, pkt {l:8 b:31bf3856ad364e35} failed.: 800f0993 [Error,Facility=(000f),Code=2451 (0x0993)]
   
7. 2026-07-31 16:30:44, Info                  SXS    Hydration back to non-RTM baseline succeeded using MpAsDesc.dll.mui, Windows-Defender-Service.Resources, version 10.0.26100.8968, arch amd64, culture [l:5]'zh-CN', nonSxS, pkt {l:8 b:31bf3856ad364e35}
   
8. 2026-07-31 16:30:44, Info                  SXS        C(15616) Staging MpAsDesc.dll.mui
   
9. 2026-07-31 16:30:44, Info                  SXS        C(15015) Staging TpmTasks.dll.mui (RD)
   
10. 2026-07-31 16:30:44, Info                  SXS        C(15664) Staging wpncore.dll.mui (RD)
    
11. 2026-07-31 16:30:44, Info                  SXS        C(15784) Staging CertEnroll.dll.mui (RD)
    
12. 2026-07-31 16:30:44, Info                  SXS        C(13775) Staging wmlaunch.exe (RD)
    
13. 2026-07-31 16:30:44, Error                 CSI    000000e5@2026/7/31:08:30:44.548 (F) onecore\base\wcp\sil\ntsystem.cpp(2867): Error STATUS_ACCESS_DENIED originated in function Windows::Rtl::SystemImplementation::WorkAroundBackupIntentForFilesystem expression: (null)
    
14. [gle=0x80004005]
    
15. 2026-07-31 16:30:44, Error                 CSI    000000e6@2026/7/31:08:30:44.548 (F) Attempting to mark store corrupt with category [l:18 ml:19]'CorruptPayloadFile'[gle=0x80004005]
    
16. 2026-07-31 16:30:44, Info                  SXS    Delta files missing for Windows-Defender-Service.Resources, version 10.0.26100.8972, arch Host=amd64 Guest=x86, culture [l:5]'zh-CN', nonSxS, pkt {l:8 b:31bf3856ad364e35} MpAsDesc.dll.mui in rebase scenario, will attempt hydration back to non-RTM baseline

复制代码

1. 2026-07-31 16:30:56, Error                 CSI    000000e9@2026/7/31:08:30:56.172 (F) onecore\base\wcp\sil\ntsystem.cpp(3572): Error STATUS_ACCESS_DENIED originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
   
2. [gle=0x80004005]
   
3. 2026-07-31 16:30:56, Error                 CSI    000000ea (F) STATUS_ACCESS_DENIED #5315939# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = 0, handle = {provider=NULL, handle=0, name= ("null")}, da = (FILE_GENERIC_READ|DELETE|WRITE_DAC|WRITE_OWNER|FILE_WRITE_ATTRIBUTES|ACCESS_SYSTEM_SECURITY), oa = @0x752fc7e588->OBJECT_ATTRIBUTES {s:48; rd:null; on:[135]'\??\C:\WINDOWS\WinSxS\amd64_<font color="#ff0000">windows-defender</font>-service.resources_31bf3856ad364e35_10.0.26100.8968_zh-cn_6ad4e1389e4573ca\MpAsDesc.dll.mui'; a:(OBJ_CASE_INSENSITI[gle=0xd0000022]
   
4. 2026-07-31 16:30:56, Error                 CSI    VE)}, iosb = @0x752fc7e7e8, as = (null), fa = (FILE_ATTRIBUTE_NORMAL), sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT), eab = NULL, eal = 0, disp = Invalid)
   
5. [gle=0xd0000022]
   
6. 2026-07-31 16:30:56, Error                 CSI    000000eb (F) <font color="#ff0000">STATUS_ACCESS_DENIED</font> #5315938# from Windows::Rtl::SystemImplementation::CSystemIsolationLayer::TransferFileEx(flags = (OpenForBackupIntent|OpenForSecurityAccess|ClearReadOnly|CorruptFileIsOk|DeleteCorruptFile|ManageVolumePrivAlreadyAcquired), op = 'Move', odir = (null), oname = [l:132]'\SystemRoot\WinSxS\amd64_<font color="#ff0000" style="">windows-defender</font>-service.resources_31bf3856ad364e35_10.0.26100.8968_zh-cn_6ad4e1389e4573ca\<font color="#ff0000">MpAsDesc.dll.mui</font>', sfile = (null), ndir = \SystemRoot\WinSxS\Temp\InFlight\d1e170ccc620dd01665[gle=0xd0000022]
   
7. 2026-07-31 16:30:56, Error                 CSI    20000043a742e\, nname = [l:49 ml:63]'dd3926e8c620dd01716b0000043a1433_mpasdesc.dll.mui', disp = Unmapped disposition: 0)
   
8. [gle=0xd0000022]

复制代码

落华无痕

复制文件备份后，文件粉碎wd驱动wdfilter.sys，可能有两处，重启再粉碎defender目录。更新完复制备份的文件回去

PhozeAMTB

落华无痕 发表于 2026-7-17 19:57
复制文件备份后，文件粉碎wd驱动wdfilter.sys，可能有两处，重启再粉碎defender目录。更新完复制备份的文件 ...

成功更新，感谢解答