BITS, SENS, and EventSystem superfail
- June 28th, 2006
- Posted in Fixes . Technical . Windows 2000
- Write comment
Go here first for an update with more precise instructions, or read this article for the backstory.
I've had two Windows 2000 Professional machines in as many days that are unable to download updates. The usual Dial-a-fix Windows Update fix routines changed little about the situation. I found out that BITS couldn't start because SENS couldn't start because EventSystem couldn't start. On the second machine, EventSystem was starting, but then SENS was the final failure point. (NetMan and several other services that usually run under SvcHost were also failing with the Event 700x error listed below.)
The event log gets flooded with Event 7000 (SENS), Event 7001 (BITS), Event 4097 (EventSystem), and DCOM event 10005.
7000:
The System Event Notification service failed to start due to the following error:
The executable program that this service is configured to run in does not implement the service.
7001:
The Background Intelligent Transfer Service service depends on the System Event Notification service which failed to start because of the following error:
The executable program that this service is configured to run in does not implement the service.
4097:
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043B from line 42 of .\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.
10005:
DCOM got error "The dependency service or group failed to start. " attempting to start the service BITS with arguments "" in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}
The server {E60687F7-01A1-40AA-86AC-DB1CBF673334} did not register with DCOM within the required timeout.
The fix is to change the "netsvcs" REG_MULTI_SZ in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost. You can save the following block of text as a .reg file and double-click it to import it (it's for Windows 2000 only). Then restart the computer. All of the services that failed before should now work fine, and Windows Update should work again (and/or Dial-a-fix will finally be able to help).
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost]
"netsvcs"=hex(7):45,00,76,00,65,00,6e,00,74,00,53,00,79,00,73,00,74,00,65,00,\
6d,00,00,00,49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,00,49,\
00,72,00,6d,00,6f,00,6e,00,00,00,4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,\
4e,00,77,00,73,00,61,00,70,00,61,00,67,00,65,00,6e,00,74,00,00,00,52,00,61,\
00,73,00,61,00,75,00,74,00,6f,00,00,00,52,00,61,00,73,00,6d,00,61,00,6e,00,\
00,00,52,00,65,00,6d,00,6f,00,74,00,65,00,61,00,63,00,63,00,65,00,73,00,73,\
00,00,00,53,00,45,00,4e,00,53,00,00,00,53,00,68,00,61,00,72,00,65,00,64,00,\
61,00,63,00,63,00,65,00,73,00,73,00,00,00,54,00,61,00,70,00,69,00,73,00,72,\
00,76,00,00,00,4e,00,74,00,6d,00,73,00,73,00,76,00,63,00,00,00,57,00,5a,00,\
43,00,53,00,56,00,43,00,00,00,00,00
"rpcss"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"wugroup"=hex(7):77,00,75,00,61,00,75,00,73,00,65,00,72,00,76,00,00,00,00,00
"BITSgroup"=hex(7):42,00,49,00,54,00,53,00,00,00,00,00[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\BITSGroup]
"DefaultRpcStackSize"=dword:00000008[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs]
"CoInitializeSecurityParam"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\wugroup]
"CoInitializeSecurityParam"=dword:00000001
Here is a link to the .reg for right-click-save purposes. (If you single-click on it and it looks funny, that's because it's Unicode).
Also take a look at the update to this article.
This article helped me to resolve similar issue on Windows 2003 server Std.
The value of "netsvcs" is, in fact, a double-byte text, stored as hexadecimal value.
regedit displays it as a normal text. It is the list of services. I have just copied it from an working server to the bad one.
Possibly cause of destruction on this field – interruped WSUS installation process