Error 800106BA when Opening FCS

Tuesday, October 13, 2009 6:35 PMDaniel_Ceola

0
Sign In to Vote
Hi,

I've recently been deploying FCS across all of the computers on my network, and have one machine that has given me errors that I have been unable to solve thus far.

The computer in question is Win Server 2003 R2 x86, with SP2

When I first installed the client on this machine, it appeared to work fine, however when i tried to upgrade it to the FCS SP1, the install gave an error saying that the FCSAM service could not be stopped, that i didn't have privileges to do so.

After that error, the FCSAM service is sitting in a "Stopping" state and I am unable to do anything with it. Due to this, I am unable to uninstall the application through add/remove programs.

After some searching, i found information that suggested using the windows installer cleanup utility to remove it, which i did. I also ran 'sc delete fcsam' to get rid of the system service.

After rebooting the system, i attempted to re-install FCS. The initial install went fine, with no errors. The system application error log showed no errors at this point. I then went to the windows update website to attempt to install the SP1 update for FCS. At this point, i received the same errors that I had before - Unable to stop FCSAM service (and its again stuck in a 'stopping' state).

The below error showed in the application error log at that time:
Event Type: Error

Event Source: MsiInstaller

Event Category: None

Event ID: 11921

Date: 10/13/2009

Time: 1:38:46 PM

User: DSITS\daniel.ceola

Computer: FAIRFIELDEX1

Description:

Product: Microsoft Forefront Client Security Antimalware Service -- Error 1921. Service 'Microsoft Forefront Client Security Antimalware Service' (FCSAM) could not be stopped. Verify that you have sufficient privileges to stop system services.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 7b 34 33 36 30 32 38 43 {436028C

0008: 44 2d 36 34 37 36 2d 34 D-6476-4

0010: 32 32 34 2d 39 32 37 34 224-9274

0018: 2d 38 46 30 33 32 30 46 -8F0320F

0020: 33 30 46 44 31 7d 30FD1}

Followed soon thereafter by this:
Event Type: Information

Event Source: MsiInstaller

Event Category: None

Event ID: 11708

Date: 10/13/2009

Time: 1:42:50 PM

User: DSITS\daniel.ceola

Computer: FAIRFIELDEX1

Description:

Product: Microsoft Forefront Client Security Antimalware Service -- Installation failed.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 7b 35 30 33 39 31 46 39 {50391F9

0008: 43 2d 38 32 46 46 2d 34 C-82FF-4

0010: 35 38 46 2d 41 37 37 42 58F-A77B

0018: 2d 44 45 46 37 32 34 45 -DEF724E

0020: 36 31 34 30 44 7d 6140D}

At this point, when i attempt to open the FCS application, i receive the message:

"Application failed to initialize: 0x800106ba. A problem caused this program's service to stop. To start the service, restart your computer or search Help and Support for how to start a service manually."

which basically indicates to me that the program wont open because the FCSAM service is still trying to stop. Attempting to do 'net start fcsam' simply says the service has already been started; attempting to do net stop fcsam says it is not valid for the service.

I have the below in the WindowsUpdate.log during the same time period that the error showed in the application event log:

2009-10-13 13:33:28:679 868 1444 Report Uploading 10 events using cached cookie, reporting URL = http://wsusserver/ReportingWebService/ReportingWebService.asmx 2009-10-13 13:33:29:038 868 1444 Report Reporter successfully uploaded 10 events. 2009-10-13 13:34:06:913 5232 16d4 COMAPI ------------- 2009-10-13 13:34:06:913 5232 16d4 COMAPI -- START -- COMAPI: Install [ClientId = MicrosoftUpdate] 2009-10-13 13:34:06:913 5232 16d4 COMAPI --------- 2009-10-13 13:34:06:913 5232 16d4 COMAPI - Allow source prompts: Yes; Forced: No; Force quiet: No 2009-10-13 13:34:06:913 5232 16d4 COMAPI - Updates in request: 1 2009-10-13 13:34:06:913 5232 16d4 COMAPI - ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D} 2009-10-13 13:34:06:913 868 1724 Agent ************* 2009-10-13 13:34:06:913 868 1724 Agent ** START ** Agent: Installing updates [CallerId = MicrosoftUpdate] 2009-10-13 13:34:06:913 868 1724 Agent ********* 2009-10-13 13:34:06:913 5232 16d4 COMAPI - Updates to install = 1 2009-10-13 13:34:06:913 868 1724 Agent * Updates to install = 1 2009-10-13 13:34:06:913 5232 16d4 COMAPI <<-- SUBMITTED -- COMAPI: Install [ClientId = MicrosoftUpdate] 2009-10-13 13:34:06:913 868 1724 Agent * Title = Update for Microsoft Forefront Client Security (KB971026) 2009-10-13 13:34:06:913 868 1724 Agent * UpdateId = {506BB1E4-A125-4788-9F78-5151C558D32D}.107 2009-10-13 13:34:06:913 868 1724 Agent * Bundles 1 updates: 2009-10-13 13:34:06:913 868 1724 Agent * {A4D85E96-D965-4B3F-B513-54F161B20C37}.107 2009-10-13 13:34:06:913 868 1724 Agent WARNING: LoadLibrary failed for srclient.dll with hr:8007007e 2009-10-13 13:34:06:929 868 1724 Handler Attempting to create remote handler process as mydomain/myuser in session 1 2009-10-13 13:34:07:163 868 1724 DnldMgr Preparing update for install, updateId = {A4D85E96-D965-4B3F-B513-54F161B20C37}.107. 2009-10-13 13:34:07:320 1096 ab4 Misc =========== Logging initialized (build: 7.2.6001.788, tz: -0400) =========== 2009-10-13 13:34:07:320 1096 ab4 Misc = Process: C:\WINDOWS\system32\wuauclt.exe 2009-10-13 13:34:07:320 1096 ab4 Misc = Module: C:\WINDOWS\system32\wuaueng.dll 2009-10-13 13:34:07:320 1096 ab4 Handler ::::::::::::: 2009-10-13 13:34:07:320 1096 ab4 Handler :: START :: Handler: Command Line Install 2009-10-13 13:34:07:320 1096 ab4 Handler ::::::::: 2009-10-13 13:34:07:320 1096 ab4 Handler : Updates to install = 1 2009-10-13 13:42:50:609 1096 ab4 Handler : WARNING: Command line install completed. Return code = 0x00000643, Result = Failed, Reboot required = false 2009-10-13 13:42:50:609 1096 ab4 Handler : WARNING: Exit code = 0x8024200B 2009-10-13 13:42:50:609 1096 ab4 Handler ::::::::: 2009-10-13 13:42:50:609 1096 ab4 Handler :: END :: Handler: Command Line Install 2009-10-13 13:42:50:609 1096 ab4 Handler ::::::::::::: 2009-10-13 13:42:52:000 868 1724 Agent ********* 2009-10-13 13:42:52:000 868 1724 Agent ** END ** Agent: Installing updates [CallerId = MicrosoftUpdate]

I looked in c:\program files\microsoft forefront\client security\client\logs and only see the mp_ambits.log file. there is a lot of data in this log for the same time period, so i'm going to not post it here at this time.

If anyone knows something that i can do, or try, to get this app working on this server, i would be most grateful for your assistance!
- Reply
- Quote

Answers

Tuesday, October 27, 2009 2:34 PMKurt FaldeMSFT, Moderator

1
Sign In to Vote
Adding an answer here as well as I emailed Daniel on this..

We've seen this issue a couple of times but have not been able to nail down why it happens. Basically the service will not gracefully stop and hangs during stopping. A "workaround" to this is to set the service to manual, reboot the system and apply the latest FCSAM update in this case KB971026 while the service is disabled. Since the service is already stopped when the update calls into the service control manager to stop the service it immediately comes back with the service is stopped and the update proceeds to install and start up the service. After this you will need to set the FCSAM service back to automatic.

Unfortunately as mentioned this is a workaround... Does not explain why the service does not shut down properly. If you have the issue and want to open a case with us regarding it this type of issue is usually a defect and is typically a non-charge case so depends on how important it is to you and how much time you want to spend with us working it to try to figure out whats wrong :)

Thanks
CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
- Marked As Answer byDaniel_Ceola Tuesday, October 27, 2009 2:54 PM
- Reply
- Quote
Tuesday, October 27, 2009 2:54 PMDaniel_Ceola

0
Sign In to Vote
Shortly before I heard from Kurt, I came across a blog that demonstrated how to slipstream the latest software update for FCS into the main install package, thus allowing you to get around installing FCS, then letting it download and install the latest software update (in this case KB971026).

http://blogs.technet.com/fcsnerds/archive/2009/04/01/slipstreaming-a-client-security-client-installation.aspx

After I wiped out FCS on one of my problem servers (uninstalled what I could, then used installer cleanup to kill the bits that wouldn't, and just to make sure, did 'sc delete fcsam' from the command prompt) I ran my new install package, and Miraculously FCS is now working properly on this server.

As I still have the issue on a second server, I may go ahead and call MS to work on this & try to find the problem. If/when I do that, I will post results here.
- Marked As Answer byDaniel_Ceola Tuesday, October 27, 2009 2:54 PM
- Reply
- Quote

All Replies

Wednesday, October 14, 2009 9:57 AMNick Gu - MSFTMSFT, Moderator

0
Sign In to Vote
Hi,

Thank you for your post.

According to your description, I understand the problem you are experiencing is the FCSAM service could not be stopped, and thus caused the update installation failure.

To resolve this issue, please perform the following steps and see if it works.

1.      Removed FCSAM service with command line “Sc delete FCSAM”

2.      Uninstalled “Microsoft Forefront Client Security Antimalware Service” from Add/Remove Programs;

3.      Reinstalled FCSAM service and upgrade it to the FCS SP1.

Regards,
Nick Gu - MSFT
- Reply
- Quote
Wednesday, October 14, 2009 3:11 PMDaniel_Ceola

0
Sign In to Vote
Nick,

Thanks for the response. I have tried something very similar to that, however i did sc delete fcsam & then used the installer cleanup utility to remove FCSAS. I will try the steps this way and see what happens.

Edit:

I attempted the above steps, however i am unable to complete them at this time as it appears that i need to reboot the server to finish the 'sc delete fcsam' step. I performed that action, then attempted to uninstall FCSAS from add/remove programs and it still gave me the unable to stop the service error that its been giving me for some time. I believe when i am able to reboot the server, the service will be gone and i can hopefully run the uninstaller. I may be able to do this in an hour or so, if not then, i will have to do it after business hours tonight.
- Edited byDaniel_Ceola Wednesday, October 14, 2009 3:19 PMmore info
- Reply
- Quote
Wednesday, October 14, 2009 5:34 PMDaniel_Ceola

0
Sign In to Vote
Ok, i did sc delete fcsam, then rebooted the server. After the reboot i uninstalled FCSAS from add/remove programs. I then re-installed the forefront client, and attempted to update to SP1.

The SP1 upgrade failed with the same errors as before and the service appears in a "stopping" state again.
- Reply
- Quote
Friday, October 16, 2009 1:36 PMDaniel_Ceola

0
Sign In to Vote
I am now experiencing the exact same problem & error messages on a second server. Same errors in the windows update log as well as the event log.
- Reply
- Quote
Monday, October 19, 2009 8:43 AMNick Gu - MSFTMSFT, Moderator

0
Sign In to Vote
Hi,

Thank you for your update.

I’d like to confirm what do you mean about “SP1”. As far as I know, there is no SP1 for client computers. And you may try to disable the fcsam service and restart the system then apply the updates.

Regards,
Nick Gu - MSFT
- Reply
- Quote
Tuesday, October 20, 2009 1:02 PMDaniel_Ceola

0
Sign In to Vote
sorry, i guess its not actually called sp1. It would be the update labeled "Update for Microsoft Forefront Client Security KB971026)" on the server in question.
- Reply
- Quote
Tuesday, October 27, 2009 1:35 PMDaniel_Ceola

0
Sign In to Vote
I'm still having issues with this on two of my servers. Is there any assistance someone can provide?
- Reply
- Quote
Tuesday, October 27, 2009 2:34 PMKurt FaldeMSFT, Moderator

1
Sign In to Vote
Adding an answer here as well as I emailed Daniel on this..

We've seen this issue a couple of times but have not been able to nail down why it happens. Basically the service will not gracefully stop and hangs during stopping. A "workaround" to this is to set the service to manual, reboot the system and apply the latest FCSAM update in this case KB971026 while the service is disabled. Since the service is already stopped when the update calls into the service control manager to stop the service it immediately comes back with the service is stopped and the update proceeds to install and start up the service. After this you will need to set the FCSAM service back to automatic.

Unfortunately as mentioned this is a workaround... Does not explain why the service does not shut down properly. If you have the issue and want to open a case with us regarding it this type of issue is usually a defect and is typically a non-charge case so depends on how important it is to you and how much time you want to spend with us working it to try to figure out whats wrong :)

Thanks
CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
- Marked As Answer byDaniel_Ceola Tuesday, October 27, 2009 2:54 PM
- Reply
- Quote
Tuesday, October 27, 2009 2:54 PMDaniel_Ceola

0
Sign In to Vote
Shortly before I heard from Kurt, I came across a blog that demonstrated how to slipstream the latest software update for FCS into the main install package, thus allowing you to get around installing FCS, then letting it download and install the latest software update (in this case KB971026).

http://blogs.technet.com/fcsnerds/archive/2009/04/01/slipstreaming-a-client-security-client-installation.aspx

After I wiped out FCS on one of my problem servers (uninstalled what I could, then used installer cleanup to kill the bits that wouldn't, and just to make sure, did 'sc delete fcsam' from the command prompt) I ran my new install package, and Miraculously FCS is now working properly on this server.

As I still have the issue on a second server, I may go ahead and call MS to work on this & try to find the problem. If/when I do that, I will post results here.
- Marked As Answer byDaniel_Ceola Tuesday, October 27, 2009 2:54 PM
- Reply
- Quote