Jun

28

BITS, SENS, and EventSystem superfail

Filed Under Fixes, Technical, Windows 2000

Go here first for an update with more precise instructions, or read this article for the backstory.

I've had two Windows 2000 Professional machines in as many days that are unable to download updates. The usual Dial-a-fix Windows Update fix routines changed little about the situation. I found out that BITS couldn't start because SENS couldn't start because EventSystem couldn't start. On the second machine, EventSystem was starting, but then SENS was the final failure point. (NetMan and several other services that usually run under SvcHost were also failing with the Event 700x error listed below.)

The event log gets flooded with Event 7000 (SENS), Event 7001 (BITS), Event 4097 (EventSystem), and DCOM event 10005.

7000:

The System Event Notification service failed to start due to the following error:
The executable program that this service is configured to run in does not implement the service.

7001:

The Background Intelligent Transfer Service service depends on the System Event Notification service which failed to start because of the following error:
The executable program that this service is configured to run in does not implement the service.

4097:

The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043B from line 42 of .\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

10005:

DCOM got error "The dependency service or group failed to start. " attempting to start the service BITS with arguments "" in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}

The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.

The fix is to change the "netsvcs" REG_MULTI_SZ in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost. You can save the following block of text as a .reg file and double-click it to import it (it's for Windows 2000 only). Then restart the computer. All of the services that failed before should now work fine, and Windows Update should work again (and/or Dial-a-fix will finally be able to help).

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost]
"netsvcs"=hex(7):45,00,76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,\
6d,00,00,00,49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,00,49,\
00,72,00,6d,00,6f,00,6e,00,00,00,4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,\
4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,74,00,00,00,52,00,61,\
00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,00,6d,00,61,00,6e,00,\
00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,63,00,65,00,73,00,73,\
00,00,00,53,00,45,00,4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,\
61,00,63,00,63,00,65,00,73,00,73,00,00,00,54,00,61,00,70,00,69,00,73,00,72,\
00,76,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,00,00,57,00,5a,00,\
43,00,53,00,56,00,43,00,00,00,00,00
"rpcss"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"wugroup"=hex(7):77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,00,00,00
"BITSgroup"=hex(7):42,00,49,00,54,00,53,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\BITSGroup]
"DefaultRpcStackSize"=dword:00000008

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\wugroup]
"CoInitializeSecurityParam"=dword:00000001

Here is a link to the .reg for right-click-save purposes. (If you single-click on it and it looks funny, that's because it's Unicode).

Also take a look at the update to this article.

Tags: Operating systems

Comments

47 Responses to “BITS, SENS, and EventSystem superfail”

# aqmxv on July 20th, 2006 9:24 AM

You saved my intranet server's life with this one. Somehow this key had gotten corrupted, and it was bleeding all over the system event log. Your explanation made sense, and the pre-fab .reg file made it even more painless.
# DjLizard on July 20th, 2006 9:24 PM

Congrats on getting it fixed :)
# nNathan on August 3rd, 2006 7:10 AM

thank you very much. I almost invested whole of my day figuring this out. Did google, digged microsoft website but of no help. Had lost all my hope, and I was thinking of reinstalling OS, but in the end I came across this web site and all my issues were finally resolved.
Thanks
# monty on September 26th, 2006 1:23 AM

Thanks, your the man. I had gotten to the same point sens failing because..same type of deal I also was digging away through microsoft did a google search (using some of the eventlog unhelpful cryptic text and landed on your site) It wasn't a server it was my work computer and my support guy lets just say I am more qualified and leave it at that, but anyway all fixed up. I believe this problem could have been the result of an improper shutdown, as I kicked the power strip under my desk, (and no I didn't do it on purpose the outlet has a shortage honest:)
# Krispin Sullivan on October 17th, 2006 1:13 PM

Did the fix, it worked great, and THEN I updated from Microsoft and surprise, surprise, the error is back all over again, no Network Connections, no BITS, no Automatic Update.

It seems that something being downloaded and installed changes the registry. I believe it has to do with MU (Microsoft Update) instead of WU (Windows Update) and since so many other things don't work when this happens (like my LAN icon disappears) this is very bad stuff. Any comments from others?
I have Win2K SP4
Office 2003
and will go back to Windows Update and Office Update (or just check for updates myself) instead of the new combined MU which does both products.
# Massimo on November 7th, 2006 3:44 AM

You are great!!!!!

After 6 hours of research i found you…you are my solution!

Thanks man!
# Kashiko on November 7th, 2006 9:55 AM

I hate clever bastards… no i dont really…. i love 'em. You saved me thank you!!
# Connie on November 28th, 2006 4:33 PM

Thank you!!!
This solved a problem that I (and Windows Support) have been working on for weeks!
My network icons are back, the services are running, Hurrah!
Thanks again!
# Eric on January 7th, 2007 3:43 PM

Thank you! Solved my problem.
# Nibbs on February 2nd, 2007 5:26 AM

Absolutely fantastic!! I spent the whole of yesterday trying to fix this and now it is magically sorted out… thank you so much. For all your information, I implemented WSUS in our customers Win2k AD environment, the Win2k SP4 (it is a DC aswell) server I installed and setup WSUS on would not Automatically update from itself, i.e WSUS could see the server in the console but Auto Updates would not run to enable me to install the patches needed. By the way I am using Group Policy to push out the updates. After many fixes which didn't work I was left with Com+ Event System, BITS and Auto Update services failing….. until I came across this fix. I imported the reg key, started all the services and not Auto Updates is working perfectly with the Group Policy and WSUS. Thank you!!!!
# rash on February 27th, 2007 6:33 AM

Does anyone has this registry code for windows server 2003???
I am facing a similar problem with my windows server 2003 box.
Thanks
# Francesco on March 8th, 2007 11:38 AM

Thank you very much! I spent days trying to solve that… You had the ONLY solution on the web. Thanks again!
# DjLizard on March 8th, 2007 9:12 PM

Glad it helped, thanks for the comment! :)
# michael on April 16th, 2007 5:11 PM

this has fixed more than 15 windows 2000 servers having this issue. run the reg. reboot, done.
# Adam on May 25th, 2007 7:55 AM

I got into this mess on a Windows 2000 Pro machine after applying a cure-all script to deal with recent SVCHOST 100% CPU utilization problems with Windows Update in my enterprise. Long story short, I had to reinstall COM+ and after that, the errors above began to surface. It seems like such a simple thing that Microsoft could have a KB article for!

This fix worked like a champ. I now have "0" errors in my system, and application event logs!

-A
# phill baker on June 12th, 2007 5:48 AM

does thisfix work on win 2003 server we are having a simliler problem and cannot get any services to load.
# lazamazu on June 14th, 2007 2:37 AM

A big thank you, indedd.
BTW how did you realize the trick?
# DjLizard on June 15th, 2007 5:36 PM

I don't have a Server 2003 version of this (I don't have Server 2003), but if you compare the areas of the registry between a good and a bad machine you can probably figure out the rest.

I compared that area of the registry between the affected machine and my personal machine and noticed entries were missing, so I simply copied them from my machine.
# Soeren Moller on June 28th, 2007 2:21 AM

You are super great, my servers run like a dream now.
# DjLizard on June 28th, 2007 6:54 AM

Consider donating $5 via PayPal to help my 'get out of debt' fund :D
# LJ on October 4th, 2007 5:15 PM

Just used this on my workstation after 5 hours of troubleshooting. WORKS GREAT! WHAT A RELIEF that I don't have to re-install!!! YOU ROCK!!
# Bill Nesting on October 17th, 2007 10:43 AM

GENIUS!!
# Gaven on November 5th, 2007 6:26 PM

Thank you for posting this fix. I'm just sad it took 5 hours of troubleshooting to find this fix!
# Moracca on November 9th, 2007 11:59 AM

I ran into the same problem on an XP machine, and since this is just for 2000, I had to play with it a bit more. Basically, on a customer's xp machine, the netsvcs key had gotten its entries replaced.
I checked my computer and that key had the following value:
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
ERSvc
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Messenger
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
wscsvc
xmlprov
BITS
wuauserv
ShellHWDetection
helpsvc
WmdmPmSN

I changed the client to match, and suddenly all the services were magically able to start. Good luck!
# Paul on December 31st, 2007 3:54 PM

Just wanted to also say thanks and let everybody know this worked great on my Small Business Server 2000. Thanks alot for posting this.
# Munawar on January 7th, 2008 6:12 PM

THANK YOU !!!!

You are a life saver. The fix worked like a charm.

keep up the good work !

Cheers
# diegoj on February 12th, 2008 11:51 AM

I just want to say THANKS.
# Sabman on March 15th, 2008 4:10 AM

Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you! Thank you!
# Rob on April 9th, 2008 12:48 PM

Your awesome, thanks a ton.
# Ian on May 4th, 2008 8:36 PM

Well after a few hours of trying EVERYTHING I could to fix this error, I ran into this page.

After running the reg file and rebooting. I see icons again!

Needless to say I just did a "Dance of Joy" in the server room, don't think anyone seen me!

THANK YOU! (NO really, Thanks.)
# MadArtists on May 15th, 2008 9:50 PM

This worked perfectly! My Event Viewer is so clean, you could eat off it.
# Steve B on December 20th, 2008 9:11 PM

THANK YOU! What an awesome service you have provided for me here.

This fixed my Win2K updates problem immediately.

Hats-off to you, sir!
# Phil on December 26th, 2008 4:37 AM

Thank you so much, ! as well Ditto, to above,
I fixing my sister-in-laws computer for xmas. Yes its 12-26. All good except. below, that is next !

Windows updates geenrateds

Error number: 0×800706D3]
The website has encountered a problem and cannot display the page you are trying to view. The options provided below might help you solve the problem.
# Dan on January 1st, 2009 3:59 AM

I've just noticed the DCOM error {4991D34B-80A1-4291-83B6-3328366B9097} on my Windows XP event viewer. I was in the process of installing an ATI video card update which uninstalls old files and updates, then the blue screen of death, so I went to add and remove and tried to use the ATI Uninstaller and the same happened. I turned on the BITS service of which I disabled.

The exact note reads:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. " attempting to start the service BITS with arguments "" in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}

The event viewer also revealed this error:
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{DCBCA92E-7DBE-4EDA-8B7B-3AAEA4DD412B}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18). This security permission can be modified using the Component Services administrative tool.

Important note I have no trouble with windows Update so far, so can anyone help.
Thank You, Dan
# Keith on January 1st, 2009 1:32 PM

I had to use the method of 2 computers for 2003! But it worked great, Thank you so much for this post.

Heres Mine
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"HTTPFilter"=hex(7):48,00,54,00,54,00,50,00,46,00,69,00,6c,00,74,00,65,00,72,\
00,00,00,00,00
"LocalService"=hex(7):41,00,6c,00,65,00,72,00,74,00,65,00,72,00,00,00,57,00,65,\
00,62,00,43,00,6c,00,69,00,65,00,6e,00,74,00,00,00,4c,00,6d,00,48,00,6f,00,\
73,00,74,00,73,00,00,00,57,00,69,00,6e,00,48,00,74,00,74,00,70,00,41,00,75,\
00,74,00,6f,00,50,00,72,00,6f,00,78,00,79,00,53,00,76,00,63,00,00,00,57,00,\
33,00,32,00,54,00,69,00,6d,00,65,00,00,00,00,00
"NetworkService"=hex(7):36,00,74,00,6f,00,34,00,00,00,44,00,48,00,43,00,50,00,\
00,00,44,00,6e,00,73,00,43,00,61,00,63,00,68,00,65,00,00,00,00,00
"WinErr"=hex(7):45,00,52,00,73,00,76,00,63,00,00,00,00,00
"netsvcs"=hex(7):41,00,70,00,70,00,4d,00,67,00,6d,00,74,00,00,00,41,00,75,00,\
64,00,69,00,6f,00,53,00,72,00,76,00,00,00,42,00,72,00,6f,00,77,00,73,00,65,\
00,72,00,00,00,43,00,72,00,79,00,70,00,74,00,53,00,76,00,63,00,00,00,44,00,\
4d,00,53,00,65,00,72,00,76,00,65,00,72,00,00,00,45,00,76,00,65,00,6e,00,74,\
00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,48,00,69,00,64,00,53,00,65,00,\
72,00,76,00,00,00,49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,\
00,49,00,72,00,6d,00,6f,00,6e,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,\
53,00,65,00,72,00,76,00,65,00,72,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,\
00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,\
4d,00,65,00,73,00,73,00,65,00,6e,00,67,00,65,00,72,00,00,00,4e,00,65,00,74,\
00,6d,00,61,00,6e,00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,\
73,00,76,00,63,00,00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,\
00,61,00,74,00,69,00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,\
67,00,65,00,6e,00,74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,\
00,52,00,61,00,73,00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,\
65,00,61,00,63,00,63,00,65,00,73,00,73,00,00,00,53,00,61,00,63,00,73,00,76,\
00,72,00,00,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,00,00,53,00,\
65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,53,00,45,00,4e,00,53,00,00,\
00,53,00,68,00,61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,00,73,00,73,00,\
00,00,54,00,68,00,65,00,6d,00,65,00,73,00,00,00,54,00,72,00,6b,00,57,00,6b,\
00,73,00,00,00,54,00,72,00,6b,00,53,00,76,00,72,00,00,00,57,00,33,00,32,00,\
54,00,69,00,6d,00,65,00,00,00,57,00,5a,00,43,00,53,00,56,00,43,00,00,00,57,\
00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,00,00,\
77,00,69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,77,00,75,00,61,00,75,00,73,\
00,65,00,72,00,76,00,00,00,42,00,49,00,54,00,53,00,00,00,53,00,68,00,65,00,\
6c,00,6c,00,48,00,57,00,44,00,65,00,74,00,65,00,63,00,74,00,69,00,6f,00,6e,\
00,00,00,75,00,70,00,6c,00,6f,00,61,00,64,00,6d,00,67,00,72,00,00,00,57,00,\
6d,00,64,00,6d,00,50,00,6d,00,53,00,4e,00,00,00,78,00,6d,00,6c,00,70,00,72,\
00,6f,00,76,00,00,00,41,00,65,00,4c,00,6f,00,6f,00,6b,00,75,00,70,00,53,00,\
76,00,63,00,00,00,68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,00,00,00
"rpcss"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"tapisrv"=hex(7):54,00,61,00,70,00,69,00,73,00,72,00,76,00,00,00,00,00
"regsvc"=hex(7):52,00,65,00,6d,00,6f,00,74,00,65,00,52,00,65,00,67,00,69,00,73,\
00,74,00,72,00,79,00,00,00,00,00
"imgsvc"=hex(7):53,00,74,00,69,00,53,00,76,00,63,00,00,00,00,00
"termsvcs"=hex(7):54,00,65,00,72,00,6d,00,53,00,65,00,72,00,76,00,69,00,63,00,\
65,00,00,00,00,00
"iissvcs"=hex(7):77,00,33,00,73,00,76,00,63,00,00,00,00,00
"swprv"=hex(7):73,00,77,00,70,00,72,00,76,00,00,00,00,00
"DcomLaunch"=hex(7):44,00,63,00,6f,00,6d,00,4c,00,61,00,75,00,6e,00,63,00,68,\
00,00,00,00,00
"HPZ12"=hex(7):50,00,6d,00,6c,00,20,00,44,00,72,00,69,00,76,00,65,00,72,00,20,\
00,48,00,50,00,5a,00,31,00,32,00,00,00,4e,00,65,00,74,00,20,00,44,00,72,00,\
69,00,76,00,65,00,72,00,20,00,48,00,50,00,5a,00,31,00,32,00,00,00,00,00
"hpdevmgmt"=hex(7):68,00,70,00,71,00,63,00,78,00,73,00,30,00,38,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\HTTPFilter]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\iissvcs]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
"CoInitializeSecurityParam"=dword:00000001
"AuthenticationCapabilities"=dword:00002000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
"CoInitializeSecurityParam"=dword:00000001
"AuthenticationCapabilities"=dword:00003020

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\PCHealth]
"CoInitializeSecurityParam"=dword:00000002
"AuthenticationCapabilities"=dword:00000040

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\swprv]
"CoInitializeSecurityParam"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
"CoInitializeSecurityParam"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\WinErr]
"CoInitializeSecurityParam"=dword:00000001
"AuthenticationCapabilities"=dword:00003020
# Connie Smith on February 19th, 2009 6:59 PM

Just wanted to thank you and let you know that this thread is still relevant for us Luddites on W2K! Once again this site has saved my compie from the ravages of Microsoft Update! THANKS!!!!
# jonathon subia on March 23rd, 2009 7:58 AM

I have the same exact problem been working on it for 2 weeks but I have windows XP can you help??
# Harry on May 25th, 2009 6:50 AM

Jonathan, see Moracca on November 9th, 2007 11:59 AM. This should fix XP?
This reg is awesome. But why is a repair more than once needed? Anyone any idea?
# David on May 28th, 2009 3:14 PM

I would like to kiss you on the mouth for posting this. Thank you thank you thank you!!!
# Jason on June 10th, 2009 9:24 AM

Thank you! I had this issue on an XP machine and thanks to your tip I was able to look at another XP machine and find the problem – the netsvcs entry in the key you pointed to was missing almost everything. I typed in all the stuff from my other machine and viola! it worked!
# Myrt Webb on October 8th, 2009 5:14 PM

I have never worked with a .reg file before. Can someone send me step by step instructions so I can fix the 4 Win 2k workstations that have this problem?
# Yoyo on October 11th, 2009 11:08 PM

Same with Keith, I had to use the method of 2 computers for 2003 too. And it worked really great… Thank you very much for this post.
# T Ramalingam on November 9th, 2009 5:36 AM

hi dear,

can i use the registry available here for windows xp professional. otherwise, please, can you provide me the registry for win xp sp3.
# John G. on November 17th, 2009 3:23 PM

Just thought I'd say thanks as well.. this fixed the prob I was having on a win2k system.
# nem0 on November 18th, 2009 11:50 AM

This worked perfectly on an old Dell laptop that needed to be fixed fast before sending it back out in the field for another month. Thanks!
# Mohan on December 24th, 2009 12:26 AM

Simply superb..Thank you very much
# Joe on February 1st, 2010 9:45 AM

YOU ROCK!!!!

I have been working on this for 2 days straight….THANK YOU SOOOO MUCH>

this fixed my errors.

Leave a Reply

Non-technical

Technical

Categories

Archives

Jun

28

BITS, SENS, and EventSystem superfail

Comments