Try our new Certificate Revocation List Check Tool
CRLcheck.exe is a tool developed to verify digital signatures of executable files. It collects files from known paths on your client, checks their signature, and checks Certificate Revocation Lists (CRL) and OCSP download. This helps avoid delays in launching files.
Category published:  Server 2008 R2   Click on the Category button to get more articles regarding that product.

Server 2008 stuck, applying computer settings, most Services down (IIS, certificates)

Posted by admin on 15.10.2015

Our Education/Migration Lab is the place where we consider every Crash as Bonus and source for learning and finally reproduce crashes before they happen at customers.

Last massive we Seen was with Server 2008 RTM and Exchange Server on it. We are unsure if it was disabling IPV6 by Registry, Handling, or Manipulation Certificate Stores (wrong Trusted Root Certificates). Mainly this bug happens with Exchange or SharePoint and thus IIS Webserver where you handle San/Wildcard or self-signed Certificates.

However > that happens:

ERROR:

  • Server 2008 stuck at “applying computer settings”
  • All Services are Down
  • Your main services like Exchange / SharePoint and VMWARE Tools are not working
  • You can PING the Server. You can PING from within the Server.
  • You can’t access \c$ from External
  • You can’t access a SHARE from within the Server

     
     

    If this already happened

     

  1. Reboot in Safe Mode
  2. Open mmc
  3. Add Services
  4. Disabled all Services which you Don’t need like (sample > backup/Vmware/VSS/Agents just leave the main Services from Windows)
  5. Reboot The Server normal
  6. Check the HOTFIX from Microsoft
  7. Re-install VMware Tools

     
     

https://support.microsoft.com/en-us/kb/2379016 (Hotfix Server 2008)

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2005330

 How to find a Service that LOCKS others because it’s stuck

This issue can be caused by a service deadlock in Windows. To confirm, run this command from a command prompt window:

sc querylock

 You can find more info very well done here:

 http://ss64.com/nt/sc.html

 If the output contains IsLocked: TRUE, then the service control manager is in a locked state due to a failed service start.

 
 

When you start a computer that is running Windows Vista Service Pack 2 (SP2) or Windows Server 2008 Service Pack (SP2), the computer stops responding and appears to hang at the “Applying User Settings” or “Applying Computer Settings” stage of the logon process.

You may experience that the “network connections” folder is empty. Additionally, the following services may not start at startup.

Note these services are set to the “Automatic” start up type.

  1. Print Spooler
  2. Terminal Services
  3. Server service
  4. Remote Registry
  5. Windows Management Instrumentation (WMI)
  6. Distributed Transaction Coordinator
  7. Any services that are related to applications
  8.  

 Note: This issue typically occurs after you install a server certificate and then configure Secure Sockets Layer (SSL) on the computer. For example, you install a SSL server certificate in Internet Information Services (IIS) 7.0 and then enable HTTPS on your website to use the certificate.

 CAUSE

 This issue occurs because of a deadlock in the Service Control Manager database.

The Service Control Manager tries to start the HTTP.sys service and then puts a lock in place in the Service Control Manager database. Then, HTTP.sys makes a call that requires Cryptographic Services during startup. Then, a request is sent to start Cryptographic Services. However, a lock is already in place in the Service Control Manager database. Therefore, a deadlock occurs.

  

Note The following method can be used in Windows Safe Mode when you are not able to log on successfully to install the hotfix or fixit.

To work around the issue without installing the hotfix, create a DependOnService registry key to modify the behavior of HTTP.sys. This makes HTTP.sys depend on crytosvc service to be started first. To do this, follow these steps:

  1. Click Start, type regedit in the Start Search box, and then press ENTER.

If you are prompted for an administrator password or for confirmation, type the password, or provide confirmation.

  1. Locate and then click the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP

  1. On the Edit menu, point to New, and then click Multi-string Value.
  2. Type DependOnService, and then press ENTER.
  3. Right-click DependOnService, and then click Modify.
  4. In the Value data box, type CRYPTSVC, and then click OK.
  5. Exit Registry Editor.
  6. Restart the computer.

 Category published:  Server 2008 R2   Click on the Category button to get more articles regarding that product.