Sign in
 
HomeWindows Server 2012Windows Server 2008 R2Windows Server 2003LibraryForums
Windows Server TechCenter >
> 
> 
The Software Protection service stops and starts every 5 minutes

Answered The Software Protection service stops and starts every 5 minutes

  • Thursday, June 21, 2012 11:36 AM
     
     
    Sign In to Vote
    0

    The log shows the following events almost exactly every 5 minutes on a WS 2008 R2:

    1. The Software Protection service has stopped.
    2. The Software Protection service is starting.
    3. Initialization status for service objects....
    4. The Software Protection service has completed licensing status check....
    5. The Software Protection service has started.

    These five events are within 2 seconds.

    Could anyone shed some light on what is going on?

    Thanks in advance.

    Hong

     

All Replies

  • Thursday, June 21, 2012 5:18 PM
     
     
    Sign In to Vote
    0
    I too am experiencing the service stopping and starting repeatedly.  I've also noticed that the server has periodically become unresponsive for a few seconds at a time.  The server is running VMware VirtualCenter and is under a very low load as far as CPU, Memory and Network.
     
  • Friday, June 22, 2012 1:33 AM
     
     
    Sign In to Vote
    1

    Hi,

    It shouldn't be running every five minutes unless something is wrong with the licencing status or you have a monitoring/management tool checking the licencing status of the server, which will require the service to start.

    You can double-check the frequency of the scheduled task that usually handles the starting of the service within the Scheduled Tasks MMC here:

    Task Scheduler Library\Microsoft\Windows\SoftwareProtectionPlatform

    If the value for "Last Run Time" isn't correlating with the timestamps you're seeing on the event log entries, then you've got a monitoring/management process tripping the service.

    Cheers,
    Lain

     
  • Friday, June 22, 2012 3:07 AM
     
     
    Sign In to Vote
    0

    Thanks a lot for the elucidation.

    The "Last Run Time" is "Never". The status is "Disabled".

    It stopped this morning after it lasted for about 27 hours.

    Hong

     
  • Friday, June 22, 2012 3:21 AM
     
      Has Code
    Sign In to Vote
    0

    I'm not sure what to make of the service resheculding task being disabled, but it sounds like some part of the initial licensing routine hasn't completed successfully.

    Are you actually using KMS infrastructure, or are you simply MAK-activating your servers?

    What is the output from running the following command on the server in question?

    cscript c:\windows\system32\slmgr.vbs /dli

    Cheers,
    Lain

     
  • Friday, June 22, 2012 3:31 AM
     
      Has Code
    Sign In to Vote
    0

    Hi Lain,

    The output is:

    C:\Users\Administrator>cscript c:\windows\system32\slmgr.vbs /dli
    Microsoft (R) Windows Script Host Version 5.8
    Copyright (C) Microsoft Corporation. All rights reserved.


    Name: Windows Server(R), ServerEnterprise edition
    Description: Windows Operating System - Windows Server(R), VOLUME_MAK_B channel
    Partial Product Key: BBMBM
    License Status: Licensed

    Hong

     
  • Friday, June 22, 2012 3:45 AM
     
     
    Sign In to Vote
    1

    Okay, that probably explains why the scheduled task is disabled then, as there's no recurrent checks once a MAK key has been initially activated. That still leaves your original problem, of course.

    What are the actual event IDs that are being generated? (They should still be from the Security-SPP source)

    I'll have to go away with those event IDs and see how they bear relevance to MAK activations, as we only use a KMS infrastructure here, and I'd expect to see some differences in the generated events given the 12288 and 12289 that we get only relate to KMS (as far as I understand it).

    Cheers,
    Lain

     
  • Friday, June 22, 2012 2:03 PM
     
     
    Sign In to Vote
    0

    It seems the reply I posted yesterday did not go through.  At least, I am not seeing it.

    Anyways, let me repost events with their ID's:

    1. The Software Protection service has stopped.  903
    2. The Software Protection service is starting.   900  
    3. Initialization status for service objects....  1066
    4. The Software Protection service has completed licensing status check....   1003
    5. The Software Protection service has started.   902

    Hong

     
  • Monday, June 25, 2012 3:01 AM
     
     
    Sign In to Vote
    1

    Hi,

    So, I've done a little reading but I don't have anything definitive. What are I do have are two links and some speculation. First, the links:

    For the first post, I took the easy path and run Server Manager locally thinking it'd use the same behaviour and trigger the events, but it didn't. I made sure I had the Refresh option (down the bottom of Server Manager) enabled, but it made no difference.

    Running it remotely did yield quite a different result. Not only does it generate the events, and does so according to the refresh interval, it handles the licence checks differently.

    Whereas the "normal" on-host process seems to handle the licence checks in bulk, logging a single 1003 event as a result, Server Manager - when run remotely, actually handles each licence check "individually" (I don't know the actual SPP API well enough to be detailed about it) which results in a 1003 event for each and every licence type check.

    Anyhow, once I closed Server Manager on the remote host the events also stopped.

    I wouldn't class any of this as absolute proof of cause, but it at least fits into my expectation that it was something outside of the service's normal operation from my original post, which also corresponds to the second article referenced above, so I'm happy enough to accept that.

    Of course, this doesn't mean it's Server Manager in your case, but it does seem to point to something that is in fact talking to the Software Protection service on that machine.

    Cheers,
    Lain

    • Edited by Lain Robertson Monday, June 25, 2012 3:03 AM Updated formatting so there's some space between paragraphs.
    • Edited by Lain Robertson Monday, June 25, 2012 3:15 AM Updated formatting so there's some space between paragraphs.
    •  
     
  • Monday, June 25, 2012 4:03 AM
     
     
    Sign In to Vote
    0

    Thanks a lot for the investigation.

    After reading your post, I checked my server and found it is happening again with the same interval - 5 minutes. The server runs SQL server and websites.  No application is open.

    The server is managed remotely via RDP.

    According to the first post, it seems to be fairly common.  Should we take it as a bug of WS?

    Puzzling!

    Hong

     
  • Monday, June 25, 2012 4:14 AM
     
     Answered
    Sign In to Vote
    0

    You couldn't really describe it as a bug since the SPP service is only doing what it should, which is logging requests that are being made to it.

    The real task you have is to identify what the calling task is and then determine if there's a reason it's checking the licencing status so often and potentially lessening those checks. Going back to the previous post as an example, if it's Server Manager, then you can actually configure the refresh interval or turn it off entirely (you'd have to tell the people running it to do this as there's no central way of doing so as far as I know).

    One thing you can do purely as a testing mechanic is to disable the firewall rules for "Windows Remote Management" (there's two of them: port 5985 and port 80).

    If you do this, then keep an eye on the event log and see if that stops the licensing events from generating. Just don't forget to re-enable the firewall rule once you're done.

    Cheers,
    Lain
     
  • Monday, July 09, 2012 12:03 PM
     
     
    Sign In to Vote
    0

    Thanks a lot, Lain.

    I thought I would try your suggestions when it occurred again, but it has not happened since last time.  I will report back should it takes place again.

    Hong