SOLVED Number of isues (registry corruption related?)

[Andy_78]

Hi folks,

I have a number of issues with my latest PC. Brand new factory build windows 10, with Norton installed by me after delivery. (I flag this as I suspect a conflict between Norton and windows updates may be the culprit here)

Symptoms:

1. The tired old "couldn't connect to the Group Policy Server" error
2. Google takes something close to 15 minutes to start up

Upon looking in the event log, I see a number of services that are failing to start up properly/cleanly - namely:

The Group Policy Client service failed to start due to the following error:
The Problem Reports and Solutions Control Panel Support service failed to start due to the following error:
The Microsoft Account Sign-in Assistant service failed to start due to the following error:
The Windows Update service failed to start due to the following error:
The Network Setup Service service failed to start due to the following error:
The Device Setup Manager service failed to start due to the following error:

all with the same error: The service did not respond to the start or control request in a timely fashion.

I had a brief google myself and attempted to fix up the registry, have also tried the netsock reset to no apparent success.

Here's the dump of my reg query for net services, sorry for the ugly formatting:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
netsvcs REG_MULTI_SZ CertPropSvc\0SCPolicySvc\0lanmanserver\0gpsvc\0IKEEXT\0iphlpsvc\0seclogon\0AppInfo\0msiscsi\0EapHost\0schedule\0winmgmt\0browser\0ProfSvc\0SessionEnv\0wercplsupport\0dosvc\0DcpSvc\0wlidsvc\0NcaSvc\0NetSetupSvc\0Themes\0RetailDemo\0lfsvc\0FastUserSwitchingCompatibility\0Ias\0Irmon\0Nla\0Ntmssvc\0NWCWorkstation\0Nwsapagent\0Rasauto\0Rasman\0Remoteaccess\0SENS\0Sharedaccess\0SRService\0Tapisrv\0Wmi\0WmdmPmSp\0wuauserv\0BITS\0ShellHWDetection\0LogonHours\0PCAudit\0helpsvc\0uploadmgr\0dmwappushservice\0BDESVC\0XboxNetApiSvc\0UsoSvc\0XblGameSave\0DmEnrollmentSvc\0DsmSvc\0UserManager\0XblAuthManager

Any and all suggestions would be gratefully welcomed.. as it's a new machine, I was wanting to try and fix it up before mashing the 'reset' button...

Best Regards,

Andy

 

[Regedit32]

Hi Andy,

Welcome to the forum.

The issue you are experiencing appears to be becoming a rather common one unfortunately. I've walked a few guests through this issue over the last couple of months.

The dump file you posted answers one question for me. Your netsvcs does list the gpsvc as a component to call on during operation. This is normal and needs to be there, so we can assume then this particular Service is correctly set up in your Registry.

As the netsvcs Service is calling on the gpsvs (Group Policy Service) we need to take a look there to see what settings are there for its ImagePath. To do that we can query the Registry via a Command Prompt like so:

• Right-click on Start
• Left-click on Command Prompt
• At the Command Prompt type or copy & paste the following command:
  
  

  reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc" /v ImagePath

  
  Press Enter key to execute the above command.
  
  Sample image of what to do and what you may see as a result:
  
  
  

Can you let me know what your result displays please. In particular, you will see the Data Value for ImagePath in the above sample image is %systemroot%\system32\svchost.exe -k netsvcs

Do you see the same result, or are you seeing this alternate result:

%systemroot%\system32\svchost.exe -k GPSvcGroup


Regards,

Regedit32

 

[Andy_78]

Hi Reg,

I had already checked that too and forgot to post.. mea culpa.. Do you think that the group policy glitch is in turn causing all of those other services to not respond properly too?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc
ImagePath REG_EXPAND_SZ %systemroot%\system32\svchost.exe -k netsvcs


Best Regards,

Andy

 

[Regedit32]

It's a possibility yes, but there may be something else going on too.

One thing that is not causing this is your Norton security software. I've been using this for years and it works perfectly well on Windows 10 although currently there is no way to protect Microsoft Edge Browser with Norton given the add-on policies for this browser. That may change later depending on Microsoft of course.

OK, so the Group Service is being called from SvcHost's Service: netsvcs, so the next thing to do is take a look at the netsvcs sub-key to check the settings there.

• Right-click on Start
• Left-click on ommand Prompt
• At the prompt type or copy & paste the following command:
  
  

  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs"

  
  Press Enter key to execute the command above.
  
  Sample image of what you ought to see as a result of this:
  
  
  

What results do you get?

 

[Andy_78]

Next set of goodies! (I'll flag it as just dumb luck that this happened after I installed Norton then )

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs
AuthenticationCapabilities REG_DWORD 0x3020
CoInitializeSecurityAllowInteractiveUsers REG_DWORD 0x1
CoInitializeSecurityAllowLowBox REG_DWORD 0x1
CoInitializeSecurityParam REG_DWORD 0x1

 

[Regedit32]

Well based on your responses your Registry settings directly associated with Group Policy Client seem perfectly normal.

You could if you wish modify a few things via the Registry Editor.

Note: Before doing this create a system restore point, so if this also does not help you can use the restore point to restore your System and the Registry back to the original settings you currently have now.

• Right-click on Start then left-click on Run
• Type regedit then click OKB
• In the left pane expand the keys to:

HKEY_LOCAL_MACHINE

— SYSTEM

— CurrentControlSet

— Services

gpsvc​

• Left-click on gpsvc to view its content in right pane
• In right pane you can double-left-click on ImagePath to modify the value data to point to that alternate I mentioned earlier: %systemroot%\system32\svchost.exe -k GPSvcGroup
  
  
• If you did that though you'd then need to modify the SvcHost key and also its Services in the right pane too
  
  In Registry Editor';s left pane you'd navigate to:

HKEY_LOCAL_MACHINE

— SOFTWARE

— Microsoft

— Windows NT
— CurrentVersion

SvcHost​

• Then right-click on SvcHost and select New > Key
• A new sub-key will appear in that left pane. Name it GPSvcGroup
• Next left-click on GPSvcGroup to view its content in right pane
• Put mouse cursor In the right pane and right-click and choose New > DWORD (32-bit) Value
  • Name the new value AuthenticationCapabilities
  • Double-left-click on this new value and for the Data value enter 3020 then click OK
• Put mouse cursor back In the right pane and right-click and choose New > DWORD (32-bit) Value
  • Name the next new value CoInitializeSecuirtyParam
  • Double-left-click this new value and the the Data value enter 1 then click OK
• Now back in left pane you need to left-click on SvcHost key to view its content in right pane
• In the right pane with mouse right-click on blank area and choose New > Multi-String value
• Name this new multi-string value GPSvcGroup
• Double-left-click on this new variable and for its Data value enter GPSvc then click OK
  
• Press F5 key to refresh Registry
• Close Registry Editor and any other open applications, then shut down computer completely.
• Restart computer and see whether your new settings improve the situation.
  
  At the very least this modification ought to allow you to log on as Administrator Built-in and have access to the Group Policy Client services. If not one must assume there are some significant corruptions of the core Services built into Windows 10.

If this does not help then use that Restore point now to return Registry to its default settings you all ready have.

Reboot computer, then if you can open an elevated command prompt by Right-clicking on Start and selected Command Prompt (Admin), then when prompted by UAC clicking Yes.

In the command prompt (elevated) type SFC /SCANNOW then press Enter key to run a full System File Check.

You have not mentioned whether any of your errors pointed you to take a look at your Windows Event Viewer. You can access that by right-clicking on Start then left-clicking on Event Viewer. All events are contained here and a specific error code and information pertaining to this may be present there in regards to your failing Services.

Another cause for failed Start-ups of Services can be a pending Windows Update that has not completed correctly, or is only partially downloaded. Manually running Windows update and fully shutting down computer and restarting a couple of times can occasionally cause a pending update to restart which may then allow the core Services to start in a timely fashion and prevent that long list of errors you have been getting.

Regards,

Regedit32

 

[Andy_78]

Hi again,

Interestingly, after a Norton update demanded I restart the machine again, this morning the PC booted with none of the 7000 errors in the event viewer that I posted above. No 'could not connect' error, no slow-starting Chrome.

I'm now strongly leaning, despite your assurances to the contrary, of some strange conflict between a Norton update and a Windows update. Maybe if there was a Windows update happening in the background while a Norton update fired, that caused a race condition or some such, and it was simply a matter of waiting til the two processes finally sorted themselves out - maybe a priority thread was running for the Norton update, and that blocked the service threads from spawning successfully.. I really don't know..

I had already tried the SFC path, and DISM, to no avail, so I think I'll just have to mark this one down as "one of those things"..

If you don't have any further suggestions, I'll mark this off as solved this evening - but many, many thanks for your support here - I spoke with local tech experts at a Microsoft store and they were nowhere near as knowledgeable as you've been..

Best Regards,

Andy

 

[Regedit32]

Hi Andy,

Thanks for the update. It appears from what you are saying a pending update simply stalled and now has righted itself. The more significant updates will also make changes in your Registry, so if there were incomplete updates the registry may have had a runonce key affected that indirectly took out you SvcHost core service and this affected everything else.

It may have been that Norton update but this in itself does not mean Norton is at fault per se. There are numerous reasons for updates failing to properly install.

Anyway, glad its working now for you.

Norton doing a complete update may also have detected a Powershell.Policy registry key which seems to be one of the more recent attempts by rogue software to target the Windows OS. With this variable present, Windows can rapidly become a snail at working. Norton creates a restore point and repairs the sub-key for you in the event this change has occurred on your System. If it has done that for you it will appear in its logs.

One thing that is certain is that your results from tests showed your Registry entries for the Group Policy Client service are perfectly normal and this you can rule that out as a cause for the errors you got.

The alternate settings I offered up are the typical settings for Built-in Administrator which has greater reach into the System in terms of ownership and permissions. You should not need to go down that path now.

Regards,

Regedit32

 

[Andy_78]

Aah. We spoke too soon. The problems have all re-manifested today, starting with a new one.

This time, on log in, I got a new, improved error message (!). Even logging in as an admin, I saw something like "The group policy service failed - the UUID is not supported", and I was unceremoniously kicked back to the login screen again. Second time around, it at least logged in, but I have 22 type-7000 errors in my event log showing that even MORE services didn't start up properly this time.

Argh. Update Orchestrator Service and Computer Browser Service are also reporting that same 'did not respond in a timely manner' issue.

Also four 10005 DCOM errors, if that is anything worth digging into..

In a nutshell, it seems that a restart after the PC has been running for a little while seems to sort things, but then leaving it OFF for a while un-sorts them again. I've never had an issue like this before..

 

[Regedit32]

The DCOM errors will need addressing in time certainly.

In the meanwhile you could make use of the built in DCOM Component Services executable built into Windows.

This when run will detect your systems DCOM Components, and if while detecting these it finds any not registered it will prompt you asking would you like it to be registered. Click Yes. This may occur once or several times depending on the level of corruption going on. That may resolve that part of the issue; but its not a guarantee.

• To do that click your Search box and type in it Administrative Tools then press Enter key
• When the Administrative Tools window opens double-left-click on Component Services
• When the Component Services window opens in the middle pane you need to double-left-click on Computers
• Next in the middle pane you need to double-left-click on My Computer
• Next in the middle pane you need to double-left-click on DCOM Config
  
  At this point the middle pane will populate with all your DCOM Components and if any require registering you will be prompted to agree to allow this.
  
  Once done, shut down computer then restart.

 

[Regedit32]

The other error of note right now is "The group policy service failed - the UUID is not supported"

This occurs when the GPSVC becomes isolated from winlogon and when this occurs you may not even be able to logon as a particular user.

To fix that you need to get into your Registry Editor and take ownership of the gpsvc key itself.

• Right-click on Start
• Left-click on Run
• In the Run dialog type regedit then click OK, then when prompted click Yes
• In the left pane of Registry Editor expand the keys to the following location:

HKEY_LOCAL_MACHINE

— SYSTEM

— CurrentControlSet

— Services

gpsvc
​

• Right-click on gpsvc then select Permissions
• Click on the Advanced button
• In the window that pops up click Change
• In the Select User or Group window that opens click the Advanced button
• Click the Find Now button
• In the list of options that appear select your User Name then click Ok
• Click OK again
• You'll now be back at the Advanced Security Settings for gpsvc and you will be the Owner. Just beneath your name is a check box (currently not checked) next to Replace owner on subcontainers and objects. Check that box!
• Now click Apply button
• Now click OK button
  
  If an alert pops up when checking box, or clicking Apply or clicking OK then click YES

At this point you can close everything, shut down computer, then restart computer. All going well that particular error will be resolved too now.

 

[Regedit32]

Given both those errors its quite probable your User Profile is corrupted.

It may be worth trying to create a new User Account to see whether these errors occur for that. If not then it would seem the logical step is to ditch the corrupt User Account.

 

[Andy_78]

OK, tried to create a new account. First time I logged in, no 7000 errors but a pile of application level ones. Second time I logged on, seems to have started up just fine.. so I then logged back to the original one and .. the plot thickens!

No service issues in the error log now, but a smorgasboard of other issues:

One kernel event error - Session "ReadyBoot" stopped due to the following error: 0xC0000188

one 65 Appmodel - Failed with 0x2 retrieving AppModel Runtime status for package windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy.

Two 69 appmodel issues, both similar to: Failed with 0x490 modifying AppModel Runtime status for package windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy for user DESKTOP-M0KACSL\Andy2 (current status = 0x0, desired status = 0x20).

One 214 appreadiness: 'windows.devicesflow_cw5n1h2txyewy' install failed for Andy2. Error: 'Operation aborted' (3.4378628 seconds)

and so on and so on.. I'm really thinking that a 'reset' might be the only way to clean this mess up, what do you think? Keep methodically working through these for a few more days and blitz it at the weekend if it doesn't sort itself out?

 

[Regedit32]

I have to admit it does appear your Windows installation is seriously messed up and reinstalling Windows may be the simplest way to resolve all this.

The 214 appreadiness error to me implies a Windows Store app has failed to install. I'm not sure whether you have attempted to download something from the Store, or whether an automatic update took place which failed. You could google for Windows Store Troubleshooter app for Windows 10 as this may resolve that issue.

The Session ReadyBoot error has been around a long time in the Windows OS. The simplest way to resolve this is to do the following:

• Click Search
• In the Search box type Performance Monitor then press Enter key to open
• On the left pane click Data Collector Sets to expand it
• Again in left pane click Startup Event Trace Sessions
• Now in main window (right pane) double-left-click on ReadyBoot
• Click on the Stop Condition tab
• The Maximum size default is 20 MB. Increase to 128 MB and apply change.

 

[Andy_78]

oh goodness, and then shock of shocks, the thing goes and boots/starts completely cleanly this time.. no errors or warnings in the original primary user..

Thank you for all of your suggestions and support Regedit! I'm going to invite fate and mark this one solved now... You've been incredibly helpful..

Best Regards,

Andy