DISM Fails with 0x800F0906 if WSUS Is Installed

I ran the following command on a Server 2012 R2 running WSUS:

DISM.exe /Online /Cleanup-image /Restorehealth

It failed with error 0x800F0906

Various posts online tell you that the solution for that error is to rename C:\Windows\SoftwareDistribution\Download and C:\Windows\System32\catroot2 then reboot. When I did that, I broke my WSUS installation and started getting errors like these:

Log Name:      Application
Source:        MSSQL$MICROSOFT##WID
Event ID:      18456
Task Category: Logon
Level:         Information
Keywords:      Classic,Audit Failure
User:          NETWORK SERVICE
Description:
Login failed for user ‘NT AUTHORITY\NETWORK SERVICE’. Reason: Failed to open the explicitly specified database ‘SUSDB’. [CLIENT: <named pipe>]
Some research took me back to KB3159706. My Installed Updates doesn’t list that update, but my hunch is that it is included in a later cumulative update. So I applied (or re-applied) the “postinstall” task described in KB3159706, which I blogged about here. That got WSUS working again.

Fortunately, I stumbled across this article on repairing a .NET Framework 3.5 installation error. For 0x800F0906, it advises setting group policy to tell WSUS that it’s okay to download repair sources directly from Windows Update, which makes sense:

https://support.microsoft.com/en-us/help/2734782/net-framework-3-5-installation-error-0x800f0906-0x800f081f-0x800f0907

So I updated my WSUS group policy to enable Computer Configuration > Policies > Administrative Templates > System > Specify settings for optional component installation and component repair:

After that, DISM was able to complete successfully.