Windows Server 2016 Essentials has been unable to use normal Windows Update for more than a year, so updates have been installed manually after keeping the servicing stack current. The latest attempt to install KB5123099 fails with error 0x8007000D, meaning the installer reports that the data is invalid.
The problem occurs even before installation: extracting the MSU with expand fails while processing the package CAB and returns "Delta Package Expander Returned 0x8007000d." DISM and SFC have not revealed anything useful, and recent cumulative and servicing stack updates installed successfully.
The same MSU produces a HashMismatch result from Get-AuthenticodeSignature on multiple unrelated Windows systems, including machines outside the network and without VPN or security inspection. Earlier Server 2016 MSUs extract normally, while 7-Zip also fails on the CAB inside this particular package. Could KB5123099 itself have been published incorrectly, and is there anything else worth checking locally?
3 Answers
The extraction failure and the signature result point strongly to a damaged or incorrectly published MSU, not a problem with Windows Update or the server's component store. 0x8007000D is ERROR_INVALID_DATA. If the package cannot be expanded and Get-AuthenticodeSignature reports HashMismatch on several independent systems, the file contents do not match its embedded signature.
Check the file's Digital Signatures properties and compare its SHA-256 hash with a trusted copy. Re-download it from the Update Catalog, preferably from a different connection, and avoid using the current file if the signature still fails. A proxy or inspection appliance can cause this, but since the same result occurs on unrelated machines, a bad catalog or CDN publication is also plausible. The practical fix may be to wait for Microsoft to replace the package or install a superseding update.
It is still worth checking CBS.log and DISM.log, along with the servicing stack level and component-store health. On a system that has missed clean patching for a year, run DISM /Online /Cleanup-Image /RestoreHealth followed by sfc /scannow. However, those checks are less likely to explain a package that fails extraction and signature validation on multiple other computers.
Since earlier Server 2016 packages extract correctly but 7-Zip and expand both fail on the CAB inside this one, I would document the hash and signature failure, then report it through the normal Microsoft support channel or wait for a corrected catalog revision. Also, with Server 2016 support ending in January 2027, this is a good time to prioritize migrating whatever workload is still running on Essentials instead of spending too much time repairing one malformed update.
The recent cumulative update and servicing stack update installed successfully. The same MSU reports HashMismatch on multiple systems, including machines outside the network, so this looks more like a bad package than component-store corruption.