Failed to grab execution mutex. System error 258 / 1618

 

An MSI install exiting with a 1618 error and including a Failed to grab execution mutex. System error 258 might just need a restart on the target system.

Windows 10 / 11 Optional Features installation problem error 0x800f0954

OpenSSH Client and OpenSSH Client are Windows 10 optional features (OFs). Some OFs can’t be installed from powershell or the GUI (Apps & Features_Optional Features) because they are not included in the original image or accessible from WSUS or Windows Update.

Attempts to install via the GUI or powershell fail. The latter returning an error code 0x800f0954:






The GUI attempt helpfully responds:

Installation failed
Contact your administrator to get this feature

In order to install some optional features they must first be obtained from a separate media set known as Features On Demand (FOD). This is downloadable from Microsoft Volume Licensing Service Center (VLSC)

FODs do not appear to be Windows 10 version specific. Using the latest available seems to have backward compatibility. e.g. The 2004 FOD media has been used to apply the OpenSSH features to a Windows 10 20H2 verison. There is no 20H2 FOD media available on VLSC.

These can be mounted and the required CAB files copied out to the required location.

The recommended installation method is to copy the cabs to a folder on the target machine e.g. C:\temp\OpenSSHFODs then run the following elevated powershell command:

add-windowscapability -online -name OpenSSH.Client~~~~0.0.1.0 -source C:\temp\OpenSSHFODs -LimitAccess

Verify status of features

get-windowscapability -online | where name -like 'OpenSSH*'

Note that in this case with OpenSSH, related windows services may need to set from manual to automatic if required at system startup.

references:

Add-WindowsCapability (DISM)

Available features on demand

Use DISM in Windows PowerShell

Enable or Disable Windows Features Using DISM

Get started with OpenSSH for Windows

Scheduled Task Failure Error Code 0x80073a99

 

Scheduled Task Failure Error Code 0x80073a99

I set up two scheduled tasks with EventID triggers.  One with Basic and the other with Custom event specification.  The custom one failed to configure on the target as a scheduled task and the error code showed in the GPResult report for the target.

I used a custom event definition for the trigger because the the Event Source was not selectable in basic mode on the server where the GPO(GPP) was being defined.

The resolution was to define the GPO(GPP) on a computer where the Event Source could be selected in Basic Mode.  This computer needs to have the Admin Tools installed for the Group Policy Management tool to be available.

Supersedence Clash 0x87d00266

 

In this scenario an application with a dependency could be seen in the assigned application list but would not appear in the software center or initialize download or installation.

The clue was errors in the AppIntentEval .log

CAppIntnentSolver::Solve failed with error = 0x87d00266

This line and the lines above provide the references for the applications involved.

In this case App1 was deployed with a dependency e.g. Dependency1

A different App2 was then deployed with a similar but upgraded version of Dependency1.  We'll call it Dependency2.

Dependency2 had been configured to Supersede Dependency1.

Because of the clash App2 and Dependency2 would not install.  The expected behaviour would be for Dependency2 to install(upgrade) Dependency1 and then install App2.  However it appears that unless App1 has Dependency2 added to its dependency group the App2 and Dependency2 do not satifisy the necessary rules to install.

There is a much better explanation of this here by Horatiu Vladasel

https://www.advancedinstaller.com/dependency-supersedence-configuration-manager.html

Find the command line for an Appx (UWP) app

 Well this doesn't feel like a great solution but it works for now.  If I find a better way I'll come back and update this.

Scan your AppX package details and pull out ones that have a key word.  In this case we'll use Camera as an example

get-appxpackage | ?{$_.PackageFullName -like "*camera*"}

which returns

Name              : Microsoft.WindowsCameraPublisher         : CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Architecture      : X64
ResourceId        :
Version           : 2021.105.10.0
PackageFullName   : Microsoft.WindowsCamera_2021.105.10.0_x64__8wekyb3d8bbwe
InstallLocation   : C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2021.105.10.0_x64__8wekyb3d8bbwe

IsFramework       : False

PackageFamilyName : Microsoft.WindowsCamera_8wekyb3d8bbwe
PublisherId       : 8wekyb3d8bbwe

IsResourcePackage : False
IsBundle          : False
IsDevelopmentMode : False
NonRemovable      : False

Dependencies      : {Microsoft.NET.Native.Framework.2.2_2.2.29512.0_x64__8wekyb3d8bbwe, 

                    Microsoft.NET.Native.Runtime.2.2_2.2.28604.0_x64__8wekyb3d8bbwe, 

                    Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe}

IsPartiallyStaged : False
SignatureKind     : Store
Status            : Ok

Go to the InstallLocation and open the AppxManifest.xml and locate the Application ID.  In this case the line appears:

<Application Id="App" Executable="WindowsCamera.exe" EntryPoint="Microsoft.CameraApp.Windows.App">

Now we have the items to create the command line

explorer.exe shell:appsfolder\<PackageFamilyName>!<Application ID>

e.g.

explorer shell:appsfolder\Microsoft.WindowsCamera_8wekyb3d8bbwe!App

Quick Assist elevating

My preferred method of working around the pause screen when it stops you dead on a quick assist session attempting anything that challenges using user account control (UAC).  I say now that it requires the user to click the yes button on a UAC prompt when you launch regedit.  After that this technique lowers the default UAC level until it is set back to the default setting.  I had to use this approach to help a user during the pandemic.  Normally I would have just waited until the next time I went round to visit.

Run cmd as the user and then

runas /user:admin cmd.exe

This then prompts for the password and you have a cmd window running as the admin; but it is not elevated.  If you attempted to run a software installer which required elevation you you still get the pause screen while the user was prompted about if they wanted to run the installer and change the computer settings etc.

At this point run regedit.exe and request that the user selects the Yes button. Regedit is now elevated.

Under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

set
PromptOnSecureDesktop from 1 (default) to 0
ConsentPromptBehaviorUser 1 (default) to 3

Note the US spelling of Behavior!

UAC prompts will no longer cause pause screens.  It is possible to launch a cmd.exe (Run As Administrator) to make it fully elevated.

This is based on a remoting into a standalone workgroup computer.  Attempting similar on a domain computer would still work however group policy could reverse the settings at anytime.  It is therefore probably not as useful for domain joined computers with group policies.

Unable to update the password

 

This can be super annoying.  You need to change your password but when you enter a completely legitimate, compliant new password you just get:

Unable to update the password.  The value provided for the new password does not meet the length, complexity, or history requirements of the domain.

WHY!?  It's NONE of those.

There may be a policy in force that limits the number of times you can change your password within a specific time period.  If it set to 12 hours and your password was changed less than 12 hours ago you will get the above response.