It is not the first time when I have encountered the following issue on Windows Server 2016 (2012 R2 or 2008 R2): after the installation of updates or some roles/features, a server prompts to be restarted. Then the message “Preparing to configure Windows. Do not turn off your computer” appears and the server gets stuck for hours. However, the server is accessible over the network, but a number of services, including RDP, are unavailable.

The first tip when such a problem appears is to do nothing. Just try to wait until the updates are installed. The Windows component update process can take a long time, especially on older slow devices, or if you haven’t installed Windows updates for a long time. If the installation of updates takes more than 2 hours, this is no longer normal and you can try to solve the problem according to this article.

If there is no time to wait, you can try to quickly solve the problem of simply restarting the server/computer using a hard reset. You can reset the physical server from the HP ILO console, Dell iDRAC (etc.), or from the Hyper-V/vSphere console, for virtual machines. However, this can negatively affect Windows or your applications. It is better to use a more “soft” way to reset the host that is stuck during the update installation phase on reboot.

To fix the issue, you will need another Windows computer (or server) located on the same network as the problem host. Run the Services mmc snap-in (services.msc) on it and remotely connect to the stuck server (Action -> Connect to another computer -> specify the name or IP address of the problem server).

In the list of services of the remote server, it is easy to find Windows Modules Installer in the Stopping state. Obviously, this service is preventing Windows from performing a correct reboot.

You cannot end or pause the TrustedInstaller service, because the service control buttons are inactive. In the properties of the service, you can find the name of the executable: C:\Windows\servicing\TrustedInstaller.exe

Our task is to force this process to stop. The easiest way to use the way described in the article How to Kill a Windows Service which is stuck at stopping? bearing in mind that you will have to do all steps remotely.

Open the command prompt on any computer on the same network, and run the following command against the server lon-man02 to stop the TrustedInstaller.exe process:

taskkill.exe /s lon-man01 /u corp\maxbak_adm /p Pa$$w0rdd! /im TrustedInstaller.exe

You can also kill the process remotely using the Pskill utility from the PSTools toolkit:

pskill.exe \\lon-man01 TrustedInstaller.exe

Or PsExec:

psexec \\lon-man01 taskkill /IM TrustedInstaller.exe /F

After that, the message Shutting down will appear on the screen of the stuck server, and in some moments it should reboot correctly.

Windows can stuck on preparing for configuring phase when installing components or updates due to Windows Modules Installer service issues not only on Windows Server but also on desktop version (Windows 10 and Windows 8.1).

If you are faced with the message “Preparing to configure Windows. Do not turn off your computer” every time you restart or shut down your computer, you need to clear the Windows Update Service cache and run integrity checks on the Windows image.

To clear all updates in the local Windows Update cache, follow these steps.:

1. Stop the wuaserv and bits services:
   net stop bits
net stop wuauserv
net stop appidsvc
net stop cryptsvc
2. Rename the folders SoftwareDistribution and catroot2:
   Ren %systemroot%\SoftwareDistribution SoftwareDistribution.bak
Ren %systemroot%\system32\catroot2 catroot2.bak
3. Start Windows update services:
   net start bits
net start wuauserv
net start appidsvc
net start cryptsvc
4. After restarting the wuauserv service will recreate the SoftwareDistribution and catroot2 directories and start checking and downloading updates.

Check the integrity of your Windows image and fix the errors found using DISM and SFC:

DISM.exe /Online /Cleanup-Image /Restorehealth

sfc /scannow