Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Unable to supprimer Feature Web-Server

ayi

Have a host of issues, but figured I'd focus on one that I think will at least let me reset IIS.

On Windows Server 2019 Standard, uninstalling the Web-Server Feature from an elevated PowerShell session fails with a file not found error.

Uninstall-WindowsFeature -Name Web-Server -Restart

Error:

Uninstall-WindowsFeature: 
The request to add or remove features on the specified server failed.
Removal of one or more roles, role services, or features failed.
The system cannot find the file specified. Error: 0x80070002
At line:1 char:1
+ Uninstall-WindowsFeature -Name Web-Server -Restart
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (@{Vhd=; Credent...Name=localhost}:PSObject) [Uninstall-WindowsFeature
   ], Exception
    + FullyQualifiedErrorId : DISMAPI_Error__Failed_Disabling_Updates,Microsoft.Windows.ServerManager.Commands.RemoveW
   indowsFeatureCommand

This started when my CI/CD failed to work on a deploy. It is looking for the ApplicationHost.config file in:

c:\Windows\system32\inetsrv\config\applicationHost.config

I've tried to restore from history and fails too.

Windows update KB5060531 fails too, it reaches 100% for install, and fails at the end.

ApplicationHost.config is not in the directory it should be. Nothing I do can put a copy there.

Failed to deploy web package to IIS website.
Error: Filename: \\?\C:\Windows\system32\inetsrv\config\applicationHost.config
Error: Cannot read configuration file
Error count: 1.
Error: The process 'C:\azagent\A5\_work\_tasks\IISWebAppDeploymentOnMachineGroup_1b467810-6725-4b6d-accd-886174c09bba\0.257.0\node_modules\azure-pipelines-tasks-webdeployment-common\MSDeploy\M142\MSDeploy3.6\msdeploy.exe' failed with exit code 4294967295 (0xFFFFFFFF)

Just hoping somebody knows what to do here.

ayi

This turned out to be a malware situation.

Larva-25003

It does a tricky thing in adding a driver to the system, in my case winkbj.sys and registers a bad IIS module IsapiCachesModule. Then makes the applicationhost, caches.dll, and winkbj.sys files not show in windows explorer (even when you state to show hidden and protected files).

All covered here.

What isn't covered is how to fix this.

Get a clean copy of your applicationhost.config file, you can look in your c:\Inetpub\history folder, but be sure to open the file and remove any reference to the above module and dll (you'll have a few places to update). Save that file in a new folder that is easy to find (I did c:\temp).
Log into your computer in SafeMode. This was problematic for me as I have a dedicated server. I had to find a 3rd party solution compatible with my host (Like TightVNC). If you use TightVNC be sure to do what is covered in the following link.
Delete c:\windows\system32\drivers\winkbj.sys and c:\windows\system32\inetsrv\caches.dll.
Move your fresh/safe ApplicationHost.config file to c:\windows\system32\inetsrv\config

As always, be sure to back up anything you are changing before hand.