Home / server / Questions / 83806
Accepted
Antitribu
Asked: 2009-11-12 15:02:23 +0800 CST

Windows Server 2008 Services won't start after patch

  • 772

After installing the run of the mill patches today on a Windows Server 2008 (Running as an AD controller and Exchange 2007 Server) the machine came back up with "configuring updates stage 3 of 3 0% complete".

The machine had been kept reasonably up to date so this likely was caused by a very recent patch. At the leaste the following patches were installed:

KB973037
KB969947
KB973565

Restarting the server into safe mode and then subsequently rebooting (with no changes made) allowed the computer to restart and I can now log in normally.

However none of the critical services start; including but not limited to Exchange, DNS and Terminal Services (Obviously if DNS doesn't start other things will break). I am unable to run Internet Explorer but Chrome will work.

There are no meaningful errors in the event logs as to why services won't start.

Under KDC I have

The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart     card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.

This is going to be an evil one to debug and I'm kinda hoping someone has encountered it and knows the answer off hand.

Thanks all.

windows

6 Answers

  1. Best Answer

    This issue has now been resolved with the help of Microsoft tech support. It involved some registry changes on the part of them to svchost. It apparently is a known issue with vista/2k8 and solved in 2k8r2/win7.

    More info to come, they promised to let me know more next week.

    • 8

  2. I had the same issue and just got off the phone with Microsoft - The svchost.reg file didn't fix my issue. However, this fixed my issue maybe it'll fix yours.

    Set Cryptsvc as DependOnService on HTTP driver.

    HKLM\CurrentControlSet\Serivces\HTTP and create following value.

    Name: DependOnService Value: reg_multi_sz (this is a multi string)

    Click DependOnService Set CryptSvc on the value.

    Reboot the server

    • 8

  3. I have a server with serious problems with services. A large number of them will not start, and do not raise any issues in the Event Viewer. I just tried the "Set Cryptsvc as DependOnService on HTTP driver" fix above, and it worked like a charm. The above instructions do miss something in registry path. Here is the correct version:

    HKLM\System\CurrentControlSet\Serivces\HTTP and create following value.

    Name: DependOnService Value: reg_multi_sz (this is a multi string)

    Click DependOnService Set CryptSvc on the value.

    Reboot the server

    • 3

  4. Are you able to tell us what the recent updates were (Look in the Windows Event Log / System for "WindowsUpdateClient" events) ?

    I've noticed that a patch that breaks on one server will work just fine on lots of other servers, so I suspect you will need to do some further investigation in the the nature of your problem.

    The first place to start is your Event Logs - in particular look in the System and Application event logs for "Stop" events relating the the services that won't start, but also look for any other red "Stop" events that appear after power-up, they might give a clue as to why the other services won't start. I have seen problems in the past where RPC, COM, and DCOM services failed to start and a lot of other services depended on them

    Once you have an idea what the update was, then google the KB # for that update, there will be an MSDN Technet page that lists exactly what files are updated. Then using the service start errors, you can work out a plan to repair the damage.

    The more info you can post on this site the more help people may be able to offer.

    • 1

  5. Wow. We run a web hosting company with about 60 shared windows server 2008 servers. This is the second time I've had to come back to this article. The first time, we had 6 hours of downtime until I found this article. We were about to do a full system restore which would have cost us hours in restoring individual user files.

    Thanks to the user who posted this solution.

    FYI -

    If the update is stuck at Step 3 of 3 (0% done), it is possible this is the underlying issue. We waited for an hour until I went ahead and put it into safe mode. Safe mode goes through the update quickly but then the underlying issue (this, where the network and critical services wont start) pops up. The registry key edit then resolves this issue.

    Thanks again.

    • 1

  6. This same issue happened again last night after all these years. Server 2008, not a DC, running SPS. At first I thought the issue was a group policy problem (and maybe I had 2 separate issues here, because I got a security error when I tried to start them manually)), but the services did not start back up again until I made this registry change. Wasted an entire day.

    KB2656368
KB2677070
KB890830
KB2686827
KB2699988
KB2686833
KB967723
KB2709162
KB2656374
KB2685939
    • 1