CAPI2 Errors

[Mcd73165]

Hi. Since July 8th I've been getting CAPI2 errors with Event ID 4107 in the Application Log. It is related to the lsass.exe process. It always happens after a reboot and sometimes at other (what appears to be) random times. I searched and tried everything I could find to fix this but no joy. It doesn't appear to be causing any problems but I was wondering if anyone else is encountering this problem lately. I'm running a Windows 7 Home Premium 64 Bit system. Thanks in advance for any replies. Mark

 

[pbcopter]

See the following.
Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server

 

[Mcd73165]

See the following.
Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server

pbcopter: I've already tried the fix in the link that you suggested but it didn't work. I don't know what's going on with this annoyance. Thanks for your response.

 

[pbcopter]

I had this occur on two machines about six months ago and after completing the steps in the link I gave you, no more problems. I did them manually and did not use Fixit, however.

 

[Mcd73165]

I had this occur on two machines about six months ago and after completing the steps in the link I gave you, no more problems. I did them manually and did not use Fixit, however.

I did it manually twice already but still no joy. I'll try it one last time then I'll give up. Thanks for your reply. I've tried the fix (manually) again but to no avail. I even did a deletion of the Certificates registry entries (backed them up) but still no luck. Can this be a Microsoft issue? The process that the error relates to is Isass.exe rather than to some program or other. Thanks in advance for any additional replies.

 

[Mcd73165]

No ideas, anyone? I can't find any faults with my pc. Time and date and timezone are all correct. Whatever I've tried, problem persists.

 

[cluberti]

The only reasons you'd get a 4107 is if the CRL on your machine is expired (requiring the manual intervention in the KB), or if the date was off (which you've validated is not). Unfortunately, you can't update the certificiate list if your current one is expired (which is normal for certificates, so it's not specifically a Microsoft issue), hence why there's a fixit to manually replace it.

However, if that doesn't work, you probably have an underlying CAPI issue on the machine itself, hence why it got out of date in the first place. What we need at this point are CAPI logs:

1. Open Event Viewer
2. Expand Application and Services Logs
3. Expand Microsoft, expand Windows, and expand CAPI2
4. Right-click "Operational" and click "Enable Log"
5. Allow the log to collect events until the next 4107 is logged, and then use the same steps above to disable the log
6. Save All the events in that log as an .evtx file, and then zip and upload the compressed log file (if it's too big for the boards, you may have to share from a file hosting site)

 

[Mark Phelps]

cluberti:

I'd like to know if this is (1) really a problem or (2) just an annoyance. A friend has a Win7 Pro 64-bit HP PC that recently started getting these. I only know because I was looking through the logs and saw the errors. It seems to work OK, though, it's just logging these errors over and over and over. I gave the machine back to them a couple of days ago.

If this is a real problem, then I need to figure out how to clean this up. If it's just an annoyance, I'll let it go.

Thanks.

 

[cluberti]

It's a real problem, yes - anything that uses CAPI can fail (doesn't mean it will, but can). If you're seeing it, it is indeed a problem that should be dealt with.

 

[Mcd73165]

Cluberti: Thanks for your reply. I'll try what you suggested. Mark: To me it is more of an annoyance than a problem as it does not seem to be causing any problems with functionality or anything else for that matter. I wish I could get to the bottom of it though! Cluberti: I've enabled the log as you suggested and am waiting for events to occur. One thing however is that none of the errors in the CAPI2 Operational Log are 4107 errors. (found this by scrolling down until I found previous errors) I'll wait awhile and see what gets logged in over the next few hours then I'll upload the log info.

 

[Mcd73165]

After almost a full day of monitoring the CAPI2 Operational Log, the only CAPI2 errors I get in this log are Event ID 11 (Build Chain) and Event ID 41 (Verify Revocation). Also when this log is enabled I never get an Event ID 4107 error in the Application Log which is the problem I'm trying to resolve. However, when I disable the CAPI2 Operational Log and reboot I once again get the CAPI2 4107 errors again in the Application Log. This problem is beyond me. Cluberti, if you can lead me in the right direction in solving this problem it will be much appreciated!

 

[Mcd73165]

I have determined that the CAPI2 4107 errors that I'm getting are a Microsoft Certificate Trust List problem. If you manually download the cab file from here http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab and open it you will see the following: This certificate trust list is not valid. The certificate that signed the list is not valid. This is what is causing the errors. I'm surprised that nobody else has mentioned this problem. There were lots of people complaining about this same issue that occurred in 2010 as I found while researching this issue. My problem started on July 8, 2011 and is ongoing. Hopefully a fix will happen in the next patch Tuesday. Here is a thread that supports my theory: There are tons of CAPI2- 4107 message in the event log - Operating Systems If my theory is incorrect, I'd be happy to hear from anyone that might know more about this than me.

 

[cluberti]

If that's the case, then the servers in your area (everything is globally cached) aren't getting updated with proper certificate .cabs. At that point, unfortunately, you have to talk to Microsoft so they can lean on whomever their content provider is in that region to fix the update.

 

[OldMX]

I have determined that the CAPI2 4107 errors that I'm getting are a Microsoft Certificate Trust List problem. If you manually download the cab file from here http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab and open it you will see the following: This certificate trust list is not valid. The certificate that signed the list is not valid. This is what is causing the errors. I'm surprised that nobody else has mentioned this problem. There were lots of people complaining about this same issue that occurred in 2010 as I found while researching this issue. My problem started on July 8, 2011 and is ongoing. Hopefully a fix will happen in the next patch Tuesday. Here is a thread that supports my theory: There are tons of CAPI2- 4107 message in the event log - Operating Systems If my theory is incorrect, I'd be happy to hear from anyone that might know more about this than me.

I had the problem, Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server

Download that fixit, it should clear the problem.

 

[kado897]

See the following.
Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server

Thank's pbcopter. It worked for me.

 

[Mcd73165]

If that's the case, then the servers in your area (everything is globally cached) aren't getting updated with proper certificate .cabs. At that point, unfortunately, you have to talk to Microsoft so they can lean on whomever their content provider is in that region to fix the update.

Cluberti, thanks for your input. I'll try to contact Microsoft. OldMX, as I mentioned in my thread, I tried the "fix" from Microsoft but it doesn't work because the Root Certificate List from the Update Site is invalid which is what is causing the problem in my case.

 

[Phone Man]

After almost a full day of monitoring the CAPI2 Operational Log, the only CAPI2 errors I get in this log are Event ID 11 (Build Chain) and Event ID 41 (Verify Revocation). Also when this log is enabled I never get an Event ID 4107 error in the Application Log which is the problem I'm trying to resolve. However, when I disable the CAPI2 Operational Log and reboot I once again get the CAPI2 4107 errors again in the Application Log. This problem is beyond me. Cluberti, if you can lead me in the right direction in solving this problem it will be much appreciated!

I also have been getting these errors about the same time frame. I had this problem last year and the MS fix took care of it but not this time. By using the Operational Log you will no longer get the 4107 errors and that was one "fix" before MS came out with theirs. I have no problems with my system so will just wait to see if MS gets their updates corrected.

Jim

 

[Mcd73165]

After almost a full day of monitoring the CAPI2 Operational Log, the only CAPI2 errors I get in this log are Event ID 11 (Build Chain) and Event ID 41 (Verify Revocation). Also when this log is enabled I never get an Event ID 4107 error in the Application Log which is the problem I'm trying to resolve. However, when I disable the CAPI2 Operational Log and reboot I once again get the CAPI2 4107 errors again in the Application Log. This problem is beyond me. Cluberti, if you can lead me in the right direction in solving this problem it will be much appreciated!

I also have been getting these errors about the same time frame. I had this problem last year and the MS fix took care of it but not this time. By using the Operational Log you will no longer get the 4107 errors and that was one "fix" before MS came out with theirs. I have no problems with my system so will just wait to see if MS gets their updates corrected.

Jim

PhoneMan, I have just sent Microsoft my information and also uploaded a faulty authrootstl.cab file to them. One person that replied to my thread thinks that it could be a local server problem but I'm in Philadelphia, PA and it looks like you're in Louisiana. If you manually download and open the authrootstl file does it say that it is not valid? When I hear from Microsoft I will post any new information about this issue as I receive it.

 

[cluberti]

Fantastic work so far .

 

[Mcd73165]

Fantastic work so far .

Thank you very much!