Win Update KB5121003 Windows 11 Cumulative Update build 26100.9168 (24H2) and 26200.9168 (25H2) - Aug. 11

pseymour · 2026-08-20T11:39:54-0400

That's not what we're seeing. The component store still needs to be repaired after setup runs.

hader · 2026-08-20T11:52:27-0400

gunrunnerjohn said:
For reasons that you obviously don't get, I'm pretty reluctant to do a clean install because it entails many hours of work to install and configure some of my software packages. Not everyone has the time to blow doing endless installs of their Windows environment.

Since a bunch of people here are experiencing the exact same symptoms, I feel it's something that Microsoft should be addressing. If a bunch of people in this forum are seeing the exact same error, over the roughly one billion Win11 users, surely there's a lot of people that have the same failure. In addition, since the repair install seems not to fix it, I suspect that the component store is fine, it was just totally replaced! Also, SFC runs clean, another indication that this is not a component store issue.

I get your hesitation but this is the only way to get rid of this problem. SFC checks other things. RestoreHealth is doing it's job for 95%. That leaves only 5% that can not be fixed. I had 2 incidents with this in the past, tried everything. Also In-Place-Installments. Nothing worked. A new installement solved everything.

I know that you have to save all your personal data first, make a backup and after that has to re-install many programs and restore you previous saved personal data... It's a lot af work, I know. It just starts with a good preparation. Identify what personal data you have to save. A copy of the complete c:\users\<username> is a good start. Some file can't be copied because certain file are held possible by running programs. Those are temporary files and is not important. And by looking AppData and c:\Programdata not everything is important. I use a script to copy all files from C;\Users\<Username> only to an other location and leave files that I don't own alone. All personal data is copied to that backup location.

After a new installation you can copy that all back to it's original location. If you find something that you forgot to save first you can retrieve those file by using the backup and restore a tree or individual files. There is also a benefits to be found with a fresh install. Some programs are by using them not enough to not reinstall these. If you use OneDrive all your passwords and browserlinks will be automatilccaly restored. If you don't use OneDrive; save them both. The browser is capable to export them to an other location. I install an a regular basis install programs and after a while de-install them with Windows Manager that searches for leftovers and remove them from disk and the registry.

Despite this all there is still a gap that as well Microsoft and some third party's overlooked. Directory's that belong to programs are created inside C:\Programdata and C:\Users\<Username>\Appdata\Local, LocalLow and Roaming. They are always left alone despite the fact the program is gone. I remove those directory's by hand. Sometimes they are difficult to recognize because the directory-name is name in such a way that it is not clear to which program they belong. In case of a new install; you can leave those directory's behind at their saved location. Install the program again and these are created again by the programs. If they see; they are missing something check the directory difference with the ones on that save location. You can see a new directory's appear where there was not one before. You know which directory's they are now. You can copy those back again from the save location with all the files underneath back again.

Normally you leave those 2 directory's alone. They are still there if you install a new program with an empty content.
Yes the preparation takes up some time. And after reinstalling and copy this back again you are for 98% back again. You have to spend one evening to complete it all. You only have to change some setting in the new installation such as your background image, icons spaces and some other things. In the end you are back again with a new installation that does not contain errors.

You can wait and hope a solution falls from the sky... It never does! The problem does not go away on it's own. And Microsoft is doing nothing to help you. There are always other means. You have to do it yourself in this case. Done this many times and I always end up with absolutely no loss of any personal data what so ever!!..... Your choice....

garlin · 2026-08-20T12:58:15-0400

pseymour said:
I don't believe that's correct. (@garlin? Thoughts?) Setup does replace a lot of Windows components and may refresh servicing-related files, but it is not the same operation as a DISM RestoreHealth.

DISM when used with /limitaccess, can only use the local WinSxS component store as it's reference source. It can detect some consistency problems (missing or altered/corrupted files based on digital hashes), but cannot tell if it's missing entire components or they're mismatched versions.

When you specify DISM /source, then it can use another image's component store as the reference source (because you believe this version is correct and intact). In more recent W11 releases, DISM can use online sources (Windows Update servers) to compare against.

The reason you see DISM "hang" at 60%, is DISM is essentially downloading an entire component store from MS into a temp folder and comparing it against your local WinSxS. It's not pulling a literal install image, but it's practically the same size which is why it takes forever to finish. Since DISM doesn't know what it could be missing, it practically has to check every possible component that exists in a currently updated Windows.

Windows Setup doesn't do a "repair", instead what it cares about is comparing what's in the install image versus what you have in WinSxS. Anything new that exists in the image, or is a higher component version is applied. Setup doesn't have to perform a consistency check because it's forcing new files to your mounted Windows volume.

None of this solves the problem if the different install images or update packages have errors in how their metadata is encoded. Unless you're MS and working inside the Windows team, how do you know if this is a DISM bug, or sloppy packaging work?

You can always apply a newer DISM to an older Windows image. Say you installed the latest DISM to the oldest 24H2 image (GA) and don't allow new updates. Do you see the same pattern of /RestoreHealth and /ScanHealth reporting problems? Which one is broken? Is it DISM or Windows itself?

Many users are noticing obvious problems, but whether they're harmful is another matter. Also I find many of the "answers" as speculative, especially those that lean on AI queries. I mostly trust someone like abbodi1406 for his opinion, because he's constantly tinkering with package data. And knows how to hack around it.

omnescient · 2026-08-20T13:06:58-0400

pseymour said:
I don't believe that's correct. (@garlin? Thoughts?) Setup does replace a lot of Windows components and may refresh servicing-related files, but it is not the same operation as a DISM RestoreHealth.

I can tell you that we're seeing, on about 25% of devices, a component store that's repairable, and RestoreHealth doesn't work. We have to run a repair setup, after which ScanHealth says the component store is still repairable. But after the repair setup, RestoreHealth works. So setup must be fixing enough of the servicing components to allow RestoreHealth to work on subsequent runs.

So for us, on this 25% of machines, it's

RestoreHealth (fails)

Repair setup (succeeds)

ScanHealth - still Repairable, not Healthy

RestoreHealth (succeeds)

Have you detected any pattern that differentiates the 25% devices that fail and the others?
I don't know how many systems you repair/service, but I suspect it's a sufficiently high number for you to notice if there are any significant differences between them.
[caveat] I don't have a technical background, so my question employs an assumption that may have no validiy.

gunrunnerjohn · 2026-08-20T13:07:33-0400

garlin said:
None of this solves the problem if the different install images or update packages have errors in how their metadata is encoded. Unless you're MS and working inside the Windows team, how do you know if this is a DISM bug, or sloppy packaging work?

Well, If I use MCT to obtain the ISO, either a DISM bug or sloppy packaging would be a Microsoft issue, right?

Zardoc · 2026-08-20T13:13:03-0400

garlin said:
The reason you see DISM "hang" at 60%, is DISM is essentially downloading an entire component store from MS into a temp folder and comparing it against your local WinSxS. It's not pulling a literal install image, but it's practically the same size which is why it takes forever to finish. Since DISM doesn't know what it could be missing, it practically has to check every possible component that exists in a currently updated Windows.

That's right. Unfortunately with restore health even if you point to the ISO same image (26200.9267) DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:H:\sources\install.wim:2 /LimitAccess
it still goes Wacko and can't find files.

Zardoc · 2026-08-20T13:16:41-0400

On another note, there is definitely an issue with this build not only with certain games but in my case Snagit.
App opens but takes 1 minute before capture shows up in editor. I tested on an older build no issues and update problem shows up.

garlin · 2026-08-20T13:17:30-0400

Zardoc said:
That's right. Unfortunately with restore health even if you point to the ISO same image (26200.9267) DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:H:\sources\install.wim:2 /LimitAccess
it still goes Wacko and can't find files.

The test would be install 25H2 GA, immediately disable installing new updates, and manually apply the latest SSU update.
Now run the same command against the 25H2 GA ISO you just installed.

Zardoc · 2026-08-20T13:25:27-0400

garlin said:
The test would be install 25H2 GA, immediately disable installing new updates, and manually apply the latest SSU update.
Now run the same command against the 25H2 GA ISO you just installed.

Thanks. I'll check.

hader · 2026-08-20T13:27:59-0400

pseymour said:
That's not what we're seeing. The component store still needs to be repaired after setup runs.

(Maybe is is a good idea to use the original 25H2 v2 ISO (full official version from MS) with build 26200.8037. Then update everything to 8655 and then update your system to 9168.)

I checked my ComponentStore (9168) and there is absolutely nothing wrong with it. There is no issue with RestoreHealth at this moment. Maybe something is weird introduced with an MCT build. I could not find any also. Just make sure the device management does not contain errors or missing drivers etc.

Just made a new VM with as source an MCT build 26200.8168. (It's smaller and does not contain other languages because you have to choose the language first before you are able to download that version.)
After running setup; It installs itself with no errors. SFC finds nothing, Also RestoreHealth finds nothing.
As it is the case it always downloads 256Mb that is not necessary. Examining the CBS.log: It finds and repairs "CSI FileFlags Corrupt: 1265" Those are only flags and not packages. It still reports: "The restore operation completed successfully." This seems to be sometimes the case with these fresh installments (with 9168) or updates (9168) A second run also downloads 256Mb and finds and repairs nothing. Look in the CBS for evidence.

So claiming that after a new install the corruption is still there is false. Maybe you are talking about a In-Place-Installment (you did not mentioned that); then it does not solve things either in some cases. Can only be resolved with a fresh new install.

pseymour · 2026-08-20T13:36:30-0400

garlin said:
Many users are noticing obvious problems, but whether they're harmful is another matter. Also I find many of the "answers" as speculative, especially those that lean on AI queries. I mostly trust someone like abbodi1406 for his opinion, because he's constantly tinkering with package data. And knows how to hack around it.

I'd have to agree with that. Way back when we first started deploying Windows 11, we had a large percentage of the devices (although the number of devices was in the 200-300 range), get stuck on the August, 2023 update. Troubleshooting, blah blah blah, I ended up creating a process in Intune to periodically ScanHealth, and if needed, RestoreHealth. The devices resumed updating after that. So that DISM dance was to fix an actual issue.

Today, the only reason I know about this current issue is because that Intune process still exists. I can't say that I would notice any real-world problem if I wasn't basically going looking for errors by having the Intune agent report back what it finds.

omnescient said:
Have you detected any pattern that differentiates the 25% devices that fail and the others?
I don't know how many systems you repair/service, but I suspect it's a sufficiently high number for you to notice if there are any significant differences between them.

No. It's scattered all over campus, with different software sets, machines setup for different purporses. With machines in the same room, setup identically, some are fine and some are not. The ones that are not, some will RestoreHealth just fine; others need additional help. And yes, I have thousands of devices in my purview, so I get decent sample sizes when something like this comes up.

Phirevixen · 2026-08-20T14:16:15-0400

gunrunnerjohn said:
For reasons that you obviously don't get, I'm pretty reluctant to do a clean install because it entails many hours of work to install and configure some of my software packages. Not everyone has the time to blow doing endless installs of their Windows environment.

Exactly and nobody should have to do that just because they don't know how to properly code and test anymore.

Zardoc · 2026-08-20T14:18:45-0400

garlin said:
I mostly trust someone like abbodi1406

Humm, abodi1406. Doesn't he lead a Digital life ? :think:

Manesh · 2026-08-20T16:37:02-0400

I still keep getting this SCEP/AIK error every time I start my PC, and I’m just wondering if anyone else is seeing the same thing and if it’s something I should even care about. Everything on my system works fine, but this keeps popping up in Event Viewer.

SCEP certificate registration for Local System using the endpoint:https://amd-keyid-3f3e4f1ac024f29b0...-v2.microsoftaik.azure.net/templates/Aik/scep failed.

PkiStatus(11): SCEPDispositionPendingChallengeEnrollStatus(32): EnrollUnknownOperation completed successfully. 0x0 (WIN32: 0)SubmitDoneSubmitV2Attestation: Bad Request

Message:"V2 Protocol AIK certificate requests with P-256 ECC public keys are not supported.Public key algorithm: 1.2.840.10045.2.1, Key length: 256."

HTTP/1.1 400 Bad RequestDate: Thu, 20 Aug 2026 20:00:00 GMTContent-Length: 154Content-Type: application/json; charset=utf-8X-Content-Type-Options: nosniffStrict-Transport-Security: max-age=31536000;includeSubDomainsx-ms-request-id: 92fc9b06-988f-4e1a-8b72-a0b3353dbc2c

Method: POST (1782ms)Stage: SubmitDoneBad Request (400). 0x80190190 (HTTP_E_STATUS_BAD_REQUEST)

garlin · 2026-08-20T16:42:01-0400

Manesh said:
I still keep getting this SCEP/AIK error every time I start my PC, and I’m just wondering if anyone else is seeing the same thing and if it’s something I should even care about. Everything on my system works fine, but this keeps popping up in Event Viewer.

Try this fix (using ViveTool):

Code:

vivetool /disable /id:62861611

Manesh · 2026-08-20T16:59:32-0400

garlin said:
Try this fix (using ViveTool):

Code:

vivetool /disable /id:62861611

I’m not using ViveTool and I’d rather avoid it. I just wanted to ask whether this issue is something I should worry about. For now I’ll just wait until Microsoft fixes it.

Zardoc · 2026-08-20T17:04:16-0400

Manesh said:
I’m not using ViveTool and I’d rather avoid it. I just wanted to ask whether this issue is something I should worry about. For now I’ll just wait until Microsoft fixes it.

Just wait. I have it also.

garlin · 2026-08-20T17:09:35-0400

July Preview/August 2026 rolled out a workaround to some AIK v2 reporting errors, but it doesn't fix all of them because it depends on your TPM's HW features. If you have an older TPM chip, this error might not ever go away.

What happens is shortly after boot, Windows tries to read the TPM attestation details and finds out you don't have a fully compliant TPM under the new security rules. So your PC tries to reach out to a MS server to reconfirm the current security keys, and that request fails since your TPM doesn't meet the requirements.

PurSpyk!! · 2026-08-20T17:35:30-0400

garlin said:
July Preview/August 2026 rolled out a workaround to some AIK v2 reporting errors, but it doesn't fix all of them because it depends on your TPM's HW features. If you have an older TPM chip, this error might not ever go away.

What happens is shortly after boot, Windows tries to read the TPM attestation details and finds out you don't have a fully compliant TPM under the new security rules. So your PC tries to reach out to a MS server to reconfirm the current security keys, and that request fails since your TPM doesn't meet the requirements.

This error randomly appears on my system, I have an i9 14900KF CPU so I would assume this is a new TPM.

Zardoc · 2026-08-20T18:12:39-0400

Zardoc said:
On another note, there is definitely an issue with this build not only with certain games but in my case Snagit.
App opens but takes 1 minute before capture shows up in editor. I tested on an older build no issues and update problem shows up.

OK, update. This build does mess-up Snagit. I rolled back to 9168 and the problem is gone.

Available	Next Step
	This update downloads and installs automatically from Windows Update and Microsoft Update.
	To install this release from the Microsoft Update Catalog, select the option that matches your device architecture (arm64 or x64), and then follow the instructions.

Win Update KB5121003 Windows 11 Cumulative Update build 26100.9168 (24H2) and 26200.9168 (25H2) - Aug. 11

Announcements and messages​

Improvements​

Components updates​

Known issues in this update​

How to get this update​

Deployment​

Install this update​

File information​

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

tell me again what you think about OneDrive

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Dazed & Confused

My Computer My Computer

At a glance

Similar threads

Announcements and messages

Improvements

Components updates

Known issues in this update

How to get this update

Deployment

Install this update

File information

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer