locked
Windows 2008 Server System Writer is Missing RRS feed

  • Frage

  • We have recently installed Window 2008 and are receiving the following message:

    Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

    Details:

    AddCoreCsiFiles : BeginFileEnumeration() failed.

    System Error:

    Access is denied.

    I have followed all of the posting that are listed and have made sure the necessary rights have been assigned to the c:\windows\registration file but hte "System Writer" will not show when running vssadmin list writers. 

    Please help.

    Thank you.

    Montag, 16. März 2009 15:31

Antworten

  • We have been working on this same problem with MS Support for almost a month!  Three of our seven new Server 2008 installs are experiencing this problem.  We do not yet have a finished solution because they have not been able to determine a cause, and because installing Windows updates on one of the servers "restored" the problem.  Nevertheless, there is a temporary solution that has worked for us.

    Support was able to determine that there was a problem with permissions on the %windir%\winsxs\filemaps folder contents.  When we tried to list permissions for the files in this folder, from a command prompt run as administrator, access was denied to every file. 

    The following sequence of commands resets the permissions and restores the System Writer, at least until some update corrupts the permissions again:

       cd c:\windows\system32

       Takeown /f %windir%\winsxs\filemaps\* /a

       icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"

       icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"

       icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"

    Try listing permissions before you try this, since your situation could be different than ours.  The following command will sae the listed permissions to a file, but will fail if your permissions are also corrupt:

    cd /d c:\windows\system32
    icacls %windir%\winsxs\filemaps\* > C:\acls.txt

    Since you obviously may not get a good backup of this before proceeding, be aware that there is no guarantee this won't make things worse! 

    Dann Cox,
    Infrastructure Administrator,
    School District 68 (Nanaimo-Ladysmith)
    Nanaimo, BC, Canada


    School District Network Guy
    • Als Antwort markiert Christine Fok Dienstag, 22. September 2009 22:11
    Mittwoch, 18. März 2009 23:26
  • My last post on an other thread regarding this:

    For us it looks like the cause was lying in this two foldes and files / subfolders:
    winsxs\filempas
    winsxs\temp

    The wrong NTFS rights inside winsxs\temp seem to somehow overwrite the rights inside winsxs\filemaps. So as long as the error exists inside the temp folder it will reset the right on the filemaps folder.

    Did the following inside command shell

    Takeown /f %windir%\winsxs\filemaps /a
    icacls %windir%\winsxs\filemaps  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps  /grant "Administratoren:(RX)"
    Takeown /f %windir%\winsxs\filemaps\* /a
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "Administrators:(RX)"
    Takeown /f %windir%\winsxs\temp\PendingRenames /a
    icacls %windir%\winsxs\temp\PendingRenames  /grant "Administrators:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "BUILTIN\Users:(RX)"
    Takeown /f %windir%\winsxs\temp\PendingRenames\*.* /a
    icacls %windir%\winsxs\temp\PendingRenames\*.*  /grant "Administrators:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "BUILTIN\Users:(RX)"

    As a side note:
    I think this can also cause severe problems in case you want to upgrade a system with this error.
    winsxs\temp had no NTFS right. There was just no account inside the ntfs rights register. So no access for local system, trusted installer or anything at all.
    Tried to install SP2 on that machine.. totaly fucked it up. Now it even tells me to install SP1! on a windows server 2008.
    Not sure if this really was the cause but it's definitly not a good thing. So for me this means I check for this error before I install any updates...

    • Als Antwort markiert Christine Fok Dienstag, 22. September 2009 22:11
    Montag, 20. Juli 2009 07:41

Alle Antworten

  • We have been working on this same problem with MS Support for almost a month!  Three of our seven new Server 2008 installs are experiencing this problem.  We do not yet have a finished solution because they have not been able to determine a cause, and because installing Windows updates on one of the servers "restored" the problem.  Nevertheless, there is a temporary solution that has worked for us.

    Support was able to determine that there was a problem with permissions on the %windir%\winsxs\filemaps folder contents.  When we tried to list permissions for the files in this folder, from a command prompt run as administrator, access was denied to every file. 

    The following sequence of commands resets the permissions and restores the System Writer, at least until some update corrupts the permissions again:

       cd c:\windows\system32

       Takeown /f %windir%\winsxs\filemaps\* /a

       icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"

       icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"

       icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"

    Try listing permissions before you try this, since your situation could be different than ours.  The following command will sae the listed permissions to a file, but will fail if your permissions are also corrupt:

    cd /d c:\windows\system32
    icacls %windir%\winsxs\filemaps\* > C:\acls.txt

    Since you obviously may not get a good backup of this before proceeding, be aware that there is no guarantee this won't make things worse! 

    Dann Cox,
    Infrastructure Administrator,
    School District 68 (Nanaimo-Ladysmith)
    Nanaimo, BC, Canada


    School District Network Guy
    • Als Antwort markiert Christine Fok Dienstag, 22. September 2009 22:11
    Mittwoch, 18. März 2009 23:26
  • can you please pass the support case number for reference?
    ------- this information is provided as-is without any warranties, implicit or explicit.
    Samstag, 21. März 2009 10:56
  • Hey Dann

    Thanks a tonne - this fixed the issue for me as well.  One of our client's fresh-installed 2008 DC's refused to do a system state backup, with error "System writer is not found in the backup".  I tested to see if we also had the permissions issue on the filemaps folder, and found that it was the case.

    Not sure if this is necessary (perhaps taking ownership does this already) but I also noticed BUILTIN\Administrators in the permissions for the other files, so I added one line to yours... so this is what I ran from c:\windows\system32:-

    Takeown /f %windir%\winsxs\filemaps\* /a
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Administrators:(RX)"

    thanks
    Ray

    RayDiack
    Sonntag, 22. März 2009 09:13
  • Hi,

    I just experienced the same problem - and after resetting the permissions, I could perform a system state backup.

    Has MS released a KB article on this yet?

    Regards,
    Tom
    • Als Antwort vorgeschlagen Andrew M Scott Dienstag, 8. Januar 2013 14:18
    Mittwoch, 15. Juli 2009 10:00
  • My last post on an other thread regarding this:

    For us it looks like the cause was lying in this two foldes and files / subfolders:
    winsxs\filempas
    winsxs\temp

    The wrong NTFS rights inside winsxs\temp seem to somehow overwrite the rights inside winsxs\filemaps. So as long as the error exists inside the temp folder it will reset the right on the filemaps folder.

    Did the following inside command shell

    Takeown /f %windir%\winsxs\filemaps /a
    icacls %windir%\winsxs\filemaps  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps  /grant "Administratoren:(RX)"
    Takeown /f %windir%\winsxs\filemaps\* /a
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "Administrators:(RX)"
    Takeown /f %windir%\winsxs\temp\PendingRenames /a
    icacls %windir%\winsxs\temp\PendingRenames  /grant "Administrators:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "BUILTIN\Users:(RX)"
    Takeown /f %windir%\winsxs\temp\PendingRenames\*.* /a
    icacls %windir%\winsxs\temp\PendingRenames\*.*  /grant "Administrators:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "BUILTIN\Users:(RX)"

    As a side note:
    I think this can also cause severe problems in case you want to upgrade a system with this error.
    winsxs\temp had no NTFS right. There was just no account inside the ntfs rights register. So no access for local system, trusted installer or anything at all.
    Tried to install SP2 on that machine.. totaly fucked it up. Now it even tells me to install SP1! on a windows server 2008.
    Not sure if this really was the cause but it's definitly not a good thing. So for me this means I check for this error before I install any updates...

    • Als Antwort markiert Christine Fok Dienstag, 22. September 2009 22:11
    Montag, 20. Juli 2009 07:41
  • Hi,

    Just a side-note: I was able to perform a GUI based complete server backup; but not the command line System State only backup.

    Then after resetting the permissions, I was able to do both.

    Regards,
    Tom
    Montag, 20. Juli 2009 07:45
  • Yeah that's normal cause the GUI backup doesn't perform a system state backup.
    EDIT: I assume you are talking about the backup program that's integrated into windows server 2008.
    Montag, 20. Juli 2009 08:32
  • Ah I see. yes that's the one I am referring to.

    thanks.
    Montag, 20. Juli 2009 09:47
  • <br>
    Samstag, 29. Januar 2011 16:13
  • Hello Guys,

    I have been  looking for an answer and found the following hotfix created by Microsoft spacially for this issue:

     

    http://support.microsoft.com/kb/2182466

     

    I didnt test it by myself - I have no non-production x64 server with such issue. Could you please check and let us know?

     

    Theoretically, there should be no problem: the hostfix updates only the following files:

    For all supported x64-based versions of Windows 7 and of Windows Server 2008 R2
    File name File version File size Date Time Platform
    Wbengine.exe 6.1.7600.20754 1,504,768 14-Jul-2010 07:45 x64
    Blbsrv.dll 6.1.7600.20754 706,048 14-Jul-2010 07:45

    x64

    Samstag, 29. Januar 2011 16:14
  • Thanks ... that resolved my problem!! 

    Cheers

    Mittwoch, 15. Februar 2012 14:22
  • Hi Guys, I've encountered this issue today also, have corrected the permission rights and reestablished the system writer. Now must wait till the backup job spits the output log
    Donnerstag, 20. Dezember 2012 10:20
  • Hi, I am getting this error as well on a couple servers.  Using EMC networker for backups.

    I reapplied the permissions shown to use in the batch file and regsitered the capicom.dll file and restarted the cyrptographic service a couple times and getting the same error message.

    Montag, 24. Juni 2013 12:58
  • Hi,

    I managed to solve this issue by this way : none of the present solutions worked for me excepted this one :

    1 - Copy the C:\windows\winsxs\Filemaps\*.* in a backup folder

    2 - Boot on Windows DVD and go to the CMD (repair computer option) to remove manually all the C:\windows\winsxs\Filemaps\*.* files.

    3 - Reboot your server and logon as administrator.

    4 - Set the "Full Control" for administrator on the C:\windows\winsxs\Filemaps folder after having set the owner of this folder to administrator.

    5 - Copy in this folder the Filemaps files backuped.

    6 - Set again the normal rights for the C:\windows\winsxs\Filemaps folder (admin on readonly) and make the files inherit the new rights just set.

    7 - Reboot your serveur

    8 - Validate that the "vssadmin list writers" command lists the "system writer" on Stable.

    Note that i don't think this procedure is aprouved by Microsoft but it worked for me.

    Hope that it will help.

    Best Regards.


    • Bearbeitet FredMori Samstag, 14. Dezember 2013 21:00
    • Als Antwort vorgeschlagen Pankaj Madaan Sonntag, 23. März 2014 04:30
    • Nicht als Antwort vorgeschlagen Pankaj Madaan Sonntag, 23. März 2014 04:30
    Samstag, 14. Dezember 2013 20:56
  • In my case, this resolved the issue :

    http://www.peerwisdom.org/2013/05/09/disappearing-vss-system-writer-and-asp-net/

    Sonntag, 23. März 2014 04:31
  • Stop the "Cryptographic Services"

     

    Copy the following files in 'inf' folder from other working same OS version server and same service pack.

     

    "setupapi.ev1"

    "setupapi.ev2"

    "setupapi.ev3"

     

    Start the "Cryptographic Services"

     

    Restart the computer if needed.

    Open the command prompt and run "vssadmin list writers" and system writers will appear now.

    • Als Antwort vorgeschlagen Wimlem Freitag, 1. Juni 2018 08:48
    Montag, 7. Mai 2018 19:53
  • Jack-Jaga's solution worked for me on my 2008 RTM server.  Thanks!

    Update:  I had two Windows 2008 servers with the same problem.  Both are AD Domain controllers.

    We recently applied patches.  This is June 2018 and we hadn't updated since February. 

    I replaced

    "setupapi.ev1"

    "setupapi.ev2"

    "setupapi.ev3"

    from a working Windows 2008 domain controller.  After restarting the Cryptographic Service, the System Writer appeared when running VSSAdmin List Writers.

    Thank you so much for your help everyone!

    JoJo


    Donnerstag, 21. Juni 2018 14:15
  • It worked, Thanks
    Donnerstag, 27. September 2018 11:52
  • This step worked for me...Many thanks :) (y)

    • Bearbeitet sanjeevgp Dienstag, 9. Juli 2019 02:15
    Dienstag, 9. Juli 2019 02:11