Troubleshooting of five common Windows Service Startup Problems

Many users in Microsoft news groups have asked questions about the failure of Windows services, such as the failure to start the "Logical Disk Manager" service. Errors of such services are often varied and difficult to judge, and some problems cannot be solved by viewing Microsoft Knowledge Base articles. So here is a simple summary to help beginners solve common service startup problems.
Special reminder
When reading this article, please strictly follow the fault phenomenon for troubleshooting!
If registry operations are involved, you must back up the relevant registry items and create a Restore Point.
If the system cannot be started smoothly, press Reset to restart the system, press F8, and select "restore to the latest correct configuration" from the Windows Advanced Startup menu, in this way, the previous HKLM/SYSTEM/ControlSet00NOverwrite the incorrect CurrentControlSet (ControlSet00NInNSpecified by the LastKnownGood key value of HKLM/SYSTEM/Select ).
Error2: The specified file cannot be found.
1. Fault symptom
Try to manually start The service in the "services" snap-in window. The system prompts "Error 2: the system cannot find The specified file" (Error 2: the system cannot find The file specified .), 1.
 
2. Cause Analysis
There are two possibilities:
(1) the executable files of the service are lost or damaged.
(2) The value of the registry key value ImagePath of the service is tampered with, and the SCM cannot load the executable files of the service.
In the "service" management unit window, you can see the executable file path of each service. Please carefully check the path of the executable file shown in 2. If it does not match the correct configuration of the reference system, it indicates that the value of the registry key value ImagePath is incorrect. If the configuration is correct, the executable file is lost or damaged.

3. Solution
Take the "Task Scheduler" service as an example.
If the value of the registry key value ImagePath is tampered with, you can locate the following registry key:
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Schedule
Locate the ImagePath key value on the right, change the value to the correct value, and restart the system.
Or use the SC command:
SC config Schedule binpath = "% SystemRoot %/System32/svchost.exe-k netsvcs"
If the executable file is lost or damaged, replace it with the correct copy and restart the system. In this example, the executable file is svchost. If the file is damaged, the system cannot run normally.
Error1053: The service does not initiate or control requests in a timely manner.
1. Fault symptom
When you try to manually start the service in the "service" management unit window, the system prompts "error 1053: the service has not started or controlled the request in time", as shown in 3.
 
2. Cause Analysis
2. The configuration of the additional command parameters in the executable file is incorrect, which may cause problems.
3. Solution
Use the SC command or Registry Editor to troubleshoot the attached command parameters by referring to the preceding method.
Error1083: The service configured to run in the executable program cannot run the service.
1. Fault symptom
When you try to manually start the service in the service management unit window, the system prompts "error 1083: the service configured to run in the executable program cannot execute this service", 4.
 
2. Cause Analysis
This fault usually occurs on the service started by the svchost service host process. You know that Windows XP SP2 can start up to seven svchost process instances (six process instances are actually started) and start a group of services respectively. The services started by each svchost instance are determined by the following registry items:
HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/SvcHost
There are seven key values: DcomLaunch, HTTPFilter, imgsvc, LocalService, netsvcs, NetworkService, rpcss, and termsvcs. Each key value defines one or more services, that is, a group of services that can be started by each svchost process instance.
In this example, "the executable program of the Task scheduler”service is “svchost.exe-k netsvcs", and the corresponding svchost process before starting the service, check whether the service definition is available in the netsvcs key value under HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/SvcHost. If not, the fault will occur.
3. Solution
First, open the Properties dialog box of the Service to view the command parameters of the executable program (netsvcs in this example), as shown in 2.
Enter the following registry key:
HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/SvcHost
Locate the corresponding key value on the right. In this example, It is netsvcs. Add the service name to its value data. In this example, It is Schedule, 5, and restart the system.
 
PromptWhy do we usually only start six svchost process instances? It's all about TermService! TermService (Terminal ready-k DcomLaunch ", that is to say, no svchost process instance is actually responsible for starting the termsvcs Service Group!Error126: The specified module cannot be found.
1. Fault symptom
When you try to manually start The service in The service management unit window, The system prompts "Error 126: The specified module cannot be found" (Error 126: The specified module cocould not be found .), 6.

2. Cause Analysis
This fault usually occurs on the service started by the svchost service host process. In this type of Windows Services, a svchost process is inserted as a dll module. If the dll file is damaged or the key value of the registry is tampered with, the problem may occur.
The Dll files corresponding to such Services are composed of HKLM/SYSTEM/CurrentControlSet/Services/ServiceNameThe ServiceDll key value under the/Parameters registry key is defined (ServiceNameIs the service name). If the registry key value is incorrect or the corresponding Dll file is damaged, this problem will occur. Many netizens in the Microsoft news group complained that the "Disk management" window could not be opened. The root tracing result was that the "Logical Disk Manager" service could not be started. One of the cases is that the system is infected by the trojan PCShare. The Trojan modifies the registry key value of the "Logical Disk Manager" service, direct the value of ServiceDll under the key value of the HKLM/SYSTEM/CurrentControlSet/Services/dmserver/Parameters registry to the Trojan file "% SystemRoot %/System32/drivers/Ybfbqufe. "sys", although the anti-virus software was used to remove Trojans, but the anti-virus software was not able to handle the tampering of the registry key value by the trojan, resulting in the failure to open the "disk management ".
Note:Do not confuse the fault with "Error 2: The system cannot find the specified file!
3. Solution
For problems with the "Logical Disk Manager" service, use the following registry key:
HKLM/SYSTEM/CurrentControlSet/Services/dmserver/Parameters
Make sure that the value of the ServiceDll key value under it is changed to "% SystemRoot %/System32/dmserver. dll ".
If the registry key value is correct, replace the original dll file with the correct file copy and restart the system.
Error1079: The account of this service is different from the account of other services running on the same process.
1. Fault symptom
When you try to manually start the service in the "services" snap-in window, the system prompts "error 1079: the account for this service is different from the account for other services running on the same process", as shown in 7.
 
2. Cause Analysis
This fault usually occurs on the service started by the svchost service host process. As mentioned above, Windows XP SP2 can start up to seven svchost process instances and start a group of services respectively. Each service in a group of services must run under the same startup account as the corresponding svchost process instance.
For example, if the Alert Service belongs to the LocalService group and its corresponding svchost process instance runs under the Local Service account, if the startup account of the Alert Service is mistakenly changed to another account, for example, if the Local System account is used, an error is returned.
3. Solution
First, find the service group to which the service belongs Based on the executable file path attribute of the service. For example, the Alert service belongs to the LocalService group, and then determine the startup accounts of other services in the same group, change it to the same startup account.



From: Xu Lei's Personal Space