Solved CAPI2 errors in Event Viewer

[Ztruker]

I'm getting hundreds of these every day showing in Event Viewer:

Log Name: Application
Source: Microsoft-Windows-CAPI2
Date: 12/24/2010 7:52:14 PM
Event ID: 4107
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Dell-P370
Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />
<EventID Qualifiers="0">4107</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2010-12-25T00:52:14.177080600Z" />
<EventRecordID>26967</EventRecordID>
<Correlation />
<Execution ProcessID="1428" ThreadID="3936" />
<Channel>Application</Channel>
<Computer>Dell-P370</Computer>
<Security />
</System>
<EventData>
<Data>http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab</Data>
<Data>A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
</Data>
</EventData>
</Event>

I've seen lots of posts about this in Vista and Win 7 but nothing I've seen fixes the problem. Is there a fix available for Win 7? It doesn't seem top be causing me any problem that I'm aware of but I hate seeing all those errors in Event Viewer (I know, don't look).

 

[Cato]

You may have seen this page before: PeteNetLive - KB0000304 - Event ID 4107, CAPI2 Error Windows 7. If followed, it will point to what program is causing that error.

I actually had the same error a week or so ago, but at the time I was getting ready to restore a backup image of my C: drive and it hasn't come back, so I didn't ever check on it too much.

Hope this will maybe help you.

 

[Ztruker]

Yes, I did see that page. After turning on logging it tells me lsass.exe is the program having the problem, which is the Windows Local Security Authentication Server so I'm pretty sure this is caused by an epxired MS certificate.

Why doesn't MS fix it?

 

[Phone Man]

MS does have a fix.

Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server

Jim

 

[Ztruker]

Thanks. Ran the FixIt, will see if that takes care of it.

Merry Christmas.

 

[Ztruker]

Looks good so far. Last CAPI2 error I had was at 7:24PM on the 24th. Thanks again Phone Man for the link.

Merry Christmas