none
Windows 2008 Server System Writer is Missing

    Question

  • We have recently installed Window 2008 and are receiving the following message:

    Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

    Details:

    AddCoreCsiFiles : BeginFileEnumeration() failed.

    System Error:

    Access is denied.

    I have followed all of the posting that are listed and have made sure the necessary rights have been assigned to the c:\windows\registration file but hte "System Writer" will not show when running vssadmin list writers. 

    Please help.

    Thank you.

    Monday, March 16, 2009 3:31 PM

Answers

  • We have been working on this same problem with MS Support for almost a month!  Three of our seven new Server 2008 installs are experiencing this problem.  We do not yet have a finished solution because they have not been able to determine a cause, and because installing Windows updates on one of the servers "restored" the problem.  Nevertheless, there is a temporary solution that has worked for us.

    Support was able to determine that there was a problem with permissions on the %windir%\winsxs\filemaps folder contents.  When we tried to list permissions for the files in this folder, from a command prompt run as administrator, access was denied to every file. 

    The following sequence of commands resets the permissions and restores the System Writer, at least until some update corrupts the permissions again:

       cd c:\windows\system32

       Takeown /f %windir%\winsxs\filemaps\* /a

       icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"

       icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"

       icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"

    Try listing permissions before you try this, since your situation could be different than ours.  The following command will sae the listed permissions to a file, but will fail if your permissions are also corrupt:

    cd /d c:\windows\system32
    icacls %windir%\winsxs\filemaps\* > C:\acls.txt

    Since you obviously may not get a good backup of this before proceeding, be aware that there is no guarantee this won't make things worse! 

    Dann Cox,
    Infrastructure Administrator,
    School District 68 (Nanaimo-Ladysmith)
    Nanaimo, BC, Canada


    School District Network Guy
    • Marked as answer by Christine Fok Tuesday, September 22, 2009 10:11 PM
    Wednesday, March 18, 2009 11:26 PM
  • My last post on an other thread regarding this:

    For us it looks like the cause was lying in this two foldes and files / subfolders:
    winsxs\filempas
    winsxs\temp

    The wrong NTFS rights inside winsxs\temp seem to somehow overwrite the rights inside winsxs\filemaps. So as long as the error exists inside the temp folder it will reset the right on the filemaps folder.

    Did the following inside command shell

    Takeown /f %windir%\winsxs\filemaps /a
    icacls %windir%\winsxs\filemaps  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps  /grant "Administratoren:(RX)"
    Takeown /f %windir%\winsxs\filemaps\* /a
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "Administrators:(RX)"
    Takeown /f %windir%\winsxs\temp\PendingRenames /a
    icacls %windir%\winsxs\temp\PendingRenames  /grant "Administrators:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "BUILTIN\Users:(RX)"
    Takeown /f %windir%\winsxs\temp\PendingRenames\*.* /a
    icacls %windir%\winsxs\temp\PendingRenames\*.*  /grant "Administrators:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "BUILTIN\Users:(RX)"

    As a side note:
    I think this can also cause severe problems in case you want to upgrade a system with this error.
    winsxs\temp had no NTFS right. There was just no account inside the ntfs rights register. So no access for local system, trusted installer or anything at all.
    Tried to install SP2 on that machine.. totaly fucked it up. Now it even tells me to install SP1! on a windows server 2008.
    Not sure if this really was the cause but it's definitly not a good thing. So for me this means I check for this error before I install any updates...

    • Marked as answer by Christine Fok Tuesday, September 22, 2009 10:11 PM
    Monday, July 20, 2009 7:41 AM

All replies

  • We have been working on this same problem with MS Support for almost a month!  Three of our seven new Server 2008 installs are experiencing this problem.  We do not yet have a finished solution because they have not been able to determine a cause, and because installing Windows updates on one of the servers "restored" the problem.  Nevertheless, there is a temporary solution that has worked for us.

    Support was able to determine that there was a problem with permissions on the %windir%\winsxs\filemaps folder contents.  When we tried to list permissions for the files in this folder, from a command prompt run as administrator, access was denied to every file. 

    The following sequence of commands resets the permissions and restores the System Writer, at least until some update corrupts the permissions again:

       cd c:\windows\system32

       Takeown /f %windir%\winsxs\filemaps\* /a

       icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"

       icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"

       icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"

    Try listing permissions before you try this, since your situation could be different than ours.  The following command will sae the listed permissions to a file, but will fail if your permissions are also corrupt:

    cd /d c:\windows\system32
    icacls %windir%\winsxs\filemaps\* > C:\acls.txt

    Since you obviously may not get a good backup of this before proceeding, be aware that there is no guarantee this won't make things worse! 

    Dann Cox,
    Infrastructure Administrator,
    School District 68 (Nanaimo-Ladysmith)
    Nanaimo, BC, Canada


    School District Network Guy
    • Marked as answer by Christine Fok Tuesday, September 22, 2009 10:11 PM
    Wednesday, March 18, 2009 11:26 PM
  • can you please pass the support case number for reference?
    ------- this information is provided as-is without any warranties, implicit or explicit.
    Saturday, March 21, 2009 10:56 AM
  • Hey Dann

    Thanks a tonne - this fixed the issue for me as well.  One of our client's fresh-installed 2008 DC's refused to do a system state backup, with error "System writer is not found in the backup".  I tested to see if we also had the permissions issue on the filemaps folder, and found that it was the case.

    Not sure if this is necessary (perhaps taking ownership does this already) but I also noticed BUILTIN\Administrators in the permissions for the other files, so I added one line to yours... so this is what I ran from c:\windows\system32:-

    Takeown /f %windir%\winsxs\filemaps\* /a
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Administrators:(RX)"

    thanks
    Ray

    RayDiack
    Sunday, March 22, 2009 9:13 AM
  • Hi,

    I just experienced the same problem - and after resetting the permissions, I could perform a system state backup.

    Has MS released a KB article on this yet?

    Regards,
    Tom
    • Proposed as answer by Andrew M Scott Tuesday, January 8, 2013 2:18 PM
    Wednesday, July 15, 2009 10:00 AM
  • My last post on an other thread regarding this:

    For us it looks like the cause was lying in this two foldes and files / subfolders:
    winsxs\filempas
    winsxs\temp

    The wrong NTFS rights inside winsxs\temp seem to somehow overwrite the rights inside winsxs\filemaps. So as long as the error exists inside the temp folder it will reset the right on the filemaps folder.

    Did the following inside command shell

    Takeown /f %windir%\winsxs\filemaps /a
    icacls %windir%\winsxs\filemaps  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps  /grant "Administratoren:(RX)"
    Takeown /f %windir%\winsxs\filemaps\* /a
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "BUILTIN\Users:(RX)"
    icacls %windir%\winsxs\filemaps\*.*  /grant "Administrators:(RX)"
    Takeown /f %windir%\winsxs\temp\PendingRenames /a
    icacls %windir%\winsxs\temp\PendingRenames  /grant "Administrators:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\temp\PendingRenames /grant "BUILTIN\Users:(RX)"
    Takeown /f %windir%\winsxs\temp\PendingRenames\*.* /a
    icacls %windir%\winsxs\temp\PendingRenames\*.*  /grant "Administrators:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "NT AUTHORITY\SYSTEM:(RX)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "NT Service\trustedinstaller:(F)"
    icacls %windir%\winsxs\temp\PendingRenames\*.* /grant "BUILTIN\Users:(RX)"

    As a side note:
    I think this can also cause severe problems in case you want to upgrade a system with this error.
    winsxs\temp had no NTFS right. There was just no account inside the ntfs rights register. So no access for local system, trusted installer or anything at all.
    Tried to install SP2 on that machine.. totaly fucked it up. Now it even tells me to install SP1! on a windows server 2008.
    Not sure if this really was the cause but it's definitly not a good thing. So for me this means I check for this error before I install any updates...

    • Marked as answer by Christine Fok Tuesday, September 22, 2009 10:11 PM
    Monday, July 20, 2009 7:41 AM
  • Hi,

    Just a side-note: I was able to perform a GUI based complete server backup; but not the command line System State only backup.

    Then after resetting the permissions, I was able to do both.

    Regards,
    Tom
    Monday, July 20, 2009 7:45 AM
  • Yeah that's normal cause the GUI backup doesn't perform a system state backup.
    EDIT: I assume you are talking about the backup program that's integrated into windows server 2008.
    Monday, July 20, 2009 8:32 AM
  • Ah I see. yes that's the one I am referring to.

    thanks.
    Monday, July 20, 2009 9:47 AM
  • <br>
    Saturday, January 29, 2011 4:13 PM
  • Hello Guys,

    I have been  looking for an answer and found the following hotfix created by Microsoft spacially for this issue:

     

    http://support.microsoft.com/kb/2182466

     

    I didnt test it by myself - I have no non-production x64 server with such issue. Could you please check and let us know?

     

    Theoretically, there should be no problem: the hostfix updates only the following files:

    For all supported x64-based versions of Windows 7 and of Windows Server 2008 R2
    File name File version File size Date Time Platform
    Wbengine.exe 6.1.7600.20754 1,504,768 14-Jul-2010 07:45 x64
    Blbsrv.dll 6.1.7600.20754 706,048 14-Jul-2010 07:45

    x64

    Saturday, January 29, 2011 4:14 PM
  • Thanks ... that resolved my problem!! 

    Cheers

    Wednesday, February 15, 2012 2:22 PM
  • Hi Guys, I've encountered this issue today also, have corrected the permission rights and reestablished the system writer. Now must wait till the backup job spits the output log
    Thursday, December 20, 2012 10:20 AM
  • Hi, I am getting this error as well on a couple servers.  Using EMC networker for backups.

    I reapplied the permissions shown to use in the batch file and regsitered the capicom.dll file and restarted the cyrptographic service a couple times and getting the same error message.

    Monday, June 24, 2013 12:58 PM
  • Hi,

    I managed to solve this issue by this way : none of the present solutions worked for me excepted this one :

    1 - Copy the C:\windows\winsxs\Filemaps\*.* in a backup folder

    2 - Boot on Windows DVD and go to the CMD (repair computer option) to remove manually all the C:\windows\winsxs\Filemaps\*.* files.

    3 - Reboot your server and logon as administrator.

    4 - Set the "Full Control" for administrator on the C:\windows\winsxs\Filemaps folder after having set the owner of this folder to administrator.

    5 - Copy in this folder the Filemaps files backuped.

    6 - Set again the normal rights for the C:\windows\winsxs\Filemaps folder (admin on readonly) and make the files inherit the new rights just set.

    7 - Reboot your serveur

    8 - Validate that the "vssadmin list writers" command lists the "system writer" on Stable.

    Note that i don't think this procedure is aprouved by Microsoft but it worked for me.

    Hope that it will help.

    Best Regards.


    • Edited by FredMori Saturday, December 14, 2013 9:00 PM
    • Proposed as answer by Pankaj Madaan Sunday, March 23, 2014 4:30 AM
    • Unproposed as answer by Pankaj Madaan Sunday, March 23, 2014 4:30 AM
    Saturday, December 14, 2013 8:56 PM
  • In my case, this resolved the issue :

    http://www.peerwisdom.org/2013/05/09/disappearing-vss-system-writer-and-asp-net/

    Sunday, March 23, 2014 4:31 AM
  • Stop the "Cryptographic Services"

     

    Copy the following files in 'inf' folder from other working same OS version server and same service pack.

     

    "setupapi.ev1"

    "setupapi.ev2"

    "setupapi.ev3"

     

    Start the "Cryptographic Services"

     

    Restart the computer if needed.

    Open the command prompt and run "vssadmin list writers" and system writers will appear now.

    • Proposed as answer by Wimlem Friday, June 1, 2018 8:48 AM
    Monday, May 7, 2018 7:53 PM
  • Jack-Jaga's solution worked for me on my 2008 RTM server.  Thanks!

    Update:  I had two Windows 2008 servers with the same problem.  Both are AD Domain controllers.

    We recently applied patches.  This is June 2018 and we hadn't updated since February. 

    I replaced

    "setupapi.ev1"

    "setupapi.ev2"

    "setupapi.ev3"

    from a working Windows 2008 domain controller.  After restarting the Cryptographic Service, the System Writer appeared when running VSSAdmin List Writers.

    Thank you so much for your help everyone!

    JoJo


    Thursday, June 21, 2018 2:15 PM
  • It worked, Thanks
    Thursday, September 27, 2018 11:52 AM