Solved Windows 7 Update error 800706BA

[ptrthgr8]

I just did some quick Bing work on error code 80070426. I found this link:

Windows Update Error 80070426 - Microsoft Community

It's an older post, but it states that "This problem occurs if the Software Licensing service (Slsvc.exe) is not running while updating windows" and then provides instructions for confirming if Slsvc.exe is running. When I look at my services, I don't see that one listed anywhere. Does that have anything to do with it?

 

[ptrthgr8]

Saw on another thread here on these forums that error code 80070426 could also be related to the cryptographic service not starting. I went to services, found that one, saw it was stopped (set to automatic), and tried to manually start it. I got the attached error message.

Not sure if any of that helps narrow it down.

Thanks again, Noel.

 

[NoelDP]

The 426 error is a generic one and applies to any service, not just the SPPSVC (in Win7) or SlSvc (in Vista) - although it is a common one, especially if the system is showing as being non-genuine.
In this case the problem service is the Cryptsvc, which is one of Windows' root services, and affects almost everything.

Let's have a closer look at it
Open an Elevated Command prompt, and run the following commands..


net start cryptsvc
sc qc cryptsvc
sc queryex cryptsvc
sc qprivs cryptsvc
sc qsidtype cryptsvc
sc sdshow cryptsvc


Post the results...


Here are some instructions to make lifeeasier

1) To open anElevated Command Prompt Window (the ECP window), click on Start, All Programs,Accessories – then right-click on Command Prompt, and select Run asAdministrator. Accept the UAC prompt.

2) To run thecommands easier, highlight the block of commands, and right-click on thehighlight – select Copy. In the CP Window, click on the black/white icon at topleft – select Paste. The commands will run but may not complete the lastcommand, so hit the Enter Key once.

3) To copy theresults... click on the Black/White icon in the top left, and select Edit...'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to pasteit into your response.

 

[ptrthgr8]

Here's the output from those commands as requested.


Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>net start cryptsvc
The Cryptographic Services service is starting.
The Cryptographic Services service could not be started.

A system error has occurred.

System error 1067 has occurred.

The process terminated unexpectedly.


C:\Windows\system32>sc qc cryptsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: cryptsvc
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k NetworkService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Cryptographic Services
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT Authority\NetworkService

C:\Windows\system32>sc queryex cryptsvc

SERVICE_NAME: cryptsvc
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 1067 (0x42b)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>sc qprivs cryptsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: cryptsvc
PRIVILEGES : SeChangeNotifyPrivilege
: SeCreateGlobalPrivilege
: SeImpersonatePrivilege

C:\Windows\system32>sc qsidtype cryptsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: cryptsvc
SERVICE_SID_TYPE: UNRESTRICTED

C:\Windows\system32>sc sdshow cryptsvc

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\system32>

 

[NoelDP]

The 1067 error tells me almost nothing
Let's have a look at the event logs...

Open Event Viewer

click on theWindows logs entry in the left pane to expand it.

Now click on theApplication entry - wait while it loads.

Click on 'File'in the menu bar and select Save...

Save the file asAppevt.evtx

Repeat for theSystem log

then zip both,and upload them.

 

[ptrthgr8]

There were 14650 events in the App section and 43771 events in the system section, but I was only able to save 256 events from each at a time. Is there a more convenient way to save all of those, rather than doing 256 events at a time?

I've uploaded the 256 most recent events from each.

~ Greg ~

 

[NoelDP]

Here's one of the critical errors...

Windows cannot access the file C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_for_KB2836943~31bf3856ad364e35~amd64~~6.1.2.0.cat for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program Host Process for Windows Services because of this error.

... and another...

Faulting application name: svchost.exe_CryptSvc, version: 6.1.7600.16385, time stamp: 0x4a5bc3c
Faulting module name: bcryptprimitives.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c4f0
Exception code: 0xc0000006
Fault offset: 0x00000000000080bf
Faulting process id: 0x2efc
Faulting application start time: 0x01cfff6b91015234
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\system32\bcryptprimitives.dll
Report Id: ced74748-6b5e-11e4-9526-0030914000f

From the SYstem log it looks as if your hard drive is failing.

Back up your data NOW - to external media.
Once you've done that, run a CHKDSK , then post the new Application event log, and we'll see how bad it is.


Click on Start > All Programs > Accessories

Right-click onthe Command Prompt entry

Select Run as Administrator and accept the UAC prompt- the Elevated Command Prompt window should pop up.

At the Commandprompt, type

CHKDSK C: /R

and hit the Enter key.

You will be toldthat the drive is locked, and the CHKDSK will run at the next boot - hit the Ykey, and then reboot.

The CHKDSK willtake a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should bootnormally (possibly after a secondauto-reboot) - then run the SFC.

 

[ptrthgr8]

It took about 20 mins or so for chkdsk to run. Not sure if that's good or bad. New app log is attached.

~ Greg ~

 

[NoelDP]

You have massive problems with the hard drive

CHKDSK is verifying files (stage 1 of 5)...

Cleaning up instance tags for file 0x19aac.

  265472 file records processed.                                          File verification completed.

  691 large file records processed.                                      0 bad file records processed.                                        4 EA records processed.                                              85 reparse records processed.                                       CHKDSK is verifying indexes (stage 2 of 5)...

  326302 index entries processed.                                         Index verification completed.

  0 unindexed files scanned.                                           0 unindexed files recovered.                                       CHKDSK is verifying security descriptors (stage 3 of 5)...

  265472 file SDs/SIDs processed.                                         Cleaning up 2135 unused index entries from index $SII of file 0x9.

Cleaning up 2135 unused index entries from index $SDH of file 0x9.

Cleaning up 2135 unused security descriptors.

Security descriptor verification completed.

  30416 data files processed.                                            CHKDSK is verifying Usn Journal...

  36525264 USN bytes processed.                                             Usn Journal verification completed.

CHKDSK is verifying file data (stage 4 of 5)...

The Event entry ran out of buffer space part-way through Stage 4

The first error after the reboot was with the Cryptsvc....
so let's try fixing it. ;:
Repair the catalog database by using Esentutl

To repair the catalog database by using Esentutl:

1. Click Start, point to All Programs, and then click Accessories.
2. Right-click Command Prompt, and then click Run as administrator.
3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
4. In the command prompt window, type net stop cryptsvc to stop Cryptographic Services, and then press ENTER.
5. Type esentutl /p %systemroot%\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb, and then press ENTER. By default, %systemroot% is located at C:\Windows.
6. Click OK to confirm that you should run this tool only on databases that are corrupt. If the tool reports that the database is corrupt, then you will need to empty the catroot2 folder, so that its contents can be rebuilt (as described below).
7. Type net start cryptsvc to start Cryptographic Services, and then press ENTER.

post the results, don't reboot if you can avoid it.

If it says the database is corrupt...


Please run thefollowing commands in an Elevated Command Prompt



NET STOP CRYPTSVC
REN C:\WINDOWS\SYSTEM32\CATROOT2 CATROOT2OLD
NET START CRYPTSVC



once complete,leave the system alone for at least an hour to rebuild the database, thenreboot,

Note that thismay delete your Update History - but all updates will remain installed, and canbe viewed in the Installed Updates listing.

Then post a new AppEvent log

 

[ptrthgr8]

I ran the esentutl and no mention of anything being corrupted. Cryptsvc was restarted, confirmed in Services.

~ Greg ~

 

[NoelDP]

Good - so something's working now, at least!
How does Windows Update behave now?

 

[ptrthgr8]

Holy cow! All 17 updates installed without any issue. When I restarted the machine to finish the updates it was unable to find any new updates (so everything seems current) and I also noticed that the cryptsvc is running on its own now (still auto). I was even able to install a new nvidia driver and a GeForce Experience update that kept erroring out before.

So this all seems most excellent. But do I need to do anything else to confirm if it's actually fixed and/or to find whatever was keeping the cryptsvc from running before?

Thanks, Noel!

 

[NoelDP]

It should be OK - BUT let's have another look with CHKDSK.

please follow the instructions in post 27 again, and post the new Appevent log

 

[ptrthgr8]

There were 302 events listed, so I broke them down into two groups and attached.

 

[ptrthgr8]

Just checking in again to see if you noticed anything amiss with those event logs. Everything's been running fine since my last update, so hopefully we're good to go.

Thanks!

 

[NoelDP]

Thanks for the prod! - I's been a very busy time and I missed the earlier notification

Unfortunately, it looks like your hard drive is on the way out - back up your data to external media NOW, and plan for a new hard drive.

 

[ptrthgr8]

Is there any way to know if the problem I was having with the cryptsvc was related to the failing SSD? Or are they most likely two separate issues? Would it be best to do a complete fresh install of Windows on the new SSD? I.e. would cloning the old SSD not be advisable?

Thanks again!

 

[NoelDP]

The most likely scenario is that the drive failed and created problems - from what I could see in the latest logs the CHKDSK shows a major number of problems (enough to overflow the eventlog buffers so there's no summary output available - you could run another, and then post the new Applications log, and we'll take another look)

 

[ptrthgr8]

Okay. I won't be able to do that today, but will run through that process on Saturday and will post the results.

Thanks again!

 

[ptrthgr8]

Ran through chkdsk again. Attached are all of the new system and application events logs.