🟠 High   ⏱ 5–30 min  Last verified: 04 June 2027
Affected versions: Windows Server 2019

📖 ~1 min read

Table of contents
  1. Symptom & Impact
  2. Environment & Reproduction
  3. Root Cause Analysis
  4. Quick Triage
  5. Step-by-Step Diagnosis
  6. Solution — Primary Fix
  7. Solution — Alternative Approaches
  8. Verification & Acceptance Criteria
  9. Rollback Plan
  10. Prevention & Hardening
  11. Related Errors & Cross-Refs
  12. References & Further Reading

Symptom & Impact

Standalone MSU installation on Windows Server 2019 aborts with a corrupt package or hash mismatch error.

Environment & Reproduction

Reproduces when applying an offline cumulative update fetched from a mirror or pendrive.

wusa.exe windows10.0-kb5034000-x64.msu /quiet /norestart

Root Cause Analysis

The MSU file is truncated, downloaded over an unreliable link, or its catalog signature has been altered by AV scanning.

Quick Triage

Validate the file hash against the Microsoft Update Catalog published checksum.

Get-FileHash .windows10.0-kb5034000-x64.msu -Algorithm SHA256

Step-by-Step Diagnosis

Inspect CBS and DISM logs for catalog or signature errors during expansion.

Get-Content C:WindowsLogsCBSCBS.log -Tail 200 | Select-String -Pattern 'corrupt|hash|sig'
Get-Content C:WindowsLogsDISMdism.log -Tail 100
Illustrative mockup for windows-server-2019 — terminal_or_powershell
Diagnostic output for packaging/msu-corrupt — Illustrative mockup — Progressive Robot

Solution — Primary Fix

Redownload the MSU from the Microsoft Update Catalog over HTTPS and reapply.

Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

Invoke-WebRequest -Uri https://catalog.s.download.windowsupdate.com/.../kb5034000-x64.msu -OutFile fresh.msu
Get-FileHash fresh.msu -Algorithm SHA256
wusa.exe fresh.msu /quiet /norestart
Illustrative mockup for windows-server-2019 — error_dialog
Resolution for packaging/msu-corrupt — Illustrative mockup — Progressive Robot

Solution — Alternative Approaches

Expand the CAB inside the MSU and apply with DISM directly when wusa rejects the wrapper.

expand fresh.msu -F:* C:msu_expanded
dism /online /add-package /packagepath:C:msu_expandedwindows10.0-kb5034000-x64.cab

Verification & Acceptance Criteria

Installed updates list contains the expected KB and pending reboot completes cleanly.

Get-HotFix | Where HotFixID -EQ KB5034000

Rollback Plan

Uninstall the update with wusa if it caused regression after install.

wusa.exe /uninstall /kb:5034000 /quiet /norestart

Prevention & Hardening

Distribute MSUs via WSUS or an internal share with verified hashes rather than ad-hoc downloads.

# Compare to published hash before deployment

Related: DISM 0x800f081f missing source, CBS package corruption, and ServicingStack prerequisite errors.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn documentation for offline servicing, MSU packages, and update catalog hashes.

Need Expert Help?

If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.