locked
Error 800106BA when Opening FCS RRS feed

  • Question

  • Hi,

    I've recently been deploying FCS across all of the computers on my network, and have one machine that has given me errors that I have been unable to solve thus far.

    The computer in question is Win Server 2003 R2 x86, with SP2

    When I first installed the client on this machine, it appeared to work fine, however when i tried to upgrade it to the FCS SP1, the install gave an error saying that the FCSAM service could not be stopped, that i didn't have privileges to do so.

    After that error, the FCSAM service is sitting in a "Stopping" state and I am unable to do anything with it. Due to this, I am unable to uninstall the application through add/remove programs.

    After some searching, i found information that suggested using the windows installer cleanup utility to remove it, which i did. I also ran 'sc delete fcsam' to get rid of the system service.

    After rebooting the system, i attempted to re-install FCS.  The initial install went fine, with no errors. The system application error log showed no errors at this point.  I then went to the windows update website to attempt to install the SP1 update for FCS. At this point, i received the same errors that I had before - Unable to stop FCSAM service (and its again stuck in a 'stopping' state).

    The below error showed in the application error log at that time:

    Event Type: Error
    Event Source: MsiInstaller
    Event Category: None
    Event ID: 11921
    Date: 10/13/2009
    Time: 1:38:46 PM
    User: DSITS\daniel.ceola
    Computer: FAIRFIELDEX1
    Description:
    Product: Microsoft Forefront Client Security Antimalware Service -- Error 1921. Service 'Microsoft Forefront Client Security Antimalware Service' (FCSAM) could not be stopped.  Verify that you have sufficient privileges to stop system services.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 7b 34 33 36 30 32 38 43   {436028C
    0008: 44 2d 36 34 37 36 2d 34   D-6476-4
    0010: 32 32 34 2d 39 32 37 34   224-9274
    0018: 2d 38 46 30 33 32 30 46   -8F0320F
    0020: 33 30 46 44 31 7d         30FD1}  


    Followed soon thereafter by this:

    Event Type: Information
    Event Source: MsiInstaller
    Event Category: None
    Event ID: 11708
    Date: 10/13/2009
    Time: 1:42:50 PM
    User: DSITS\daniel.ceola
    Computer: FAIRFIELDEX1
    Description:
    Product: Microsoft Forefront Client Security Antimalware Service -- Installation failed.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 7b 35 30 33 39 31 46 39   {50391F9
    0008: 43 2d 38 32 46 46 2d 34   C-82FF-4
    0010: 35 38 46 2d 41 37 37 42   58F-A77B
    0018: 2d 44 45 46 37 32 34 45   -DEF724E
    0020: 36 31 34 30 44 7d         6140D}  



    At this point, when i attempt to open the FCS application, i receive the message:

    "Application failed to initialize: 0x800106ba. A problem caused this program's service to stop. To start the service, restart your computer or search Help and Support for how to start a service manually."


    which basically indicates to me that the program wont open because the FCSAM service is still trying to stop. Attempting to do 'net start fcsam' simply says the service has already been started; attempting to do net stop fcsam says it is not valid for the service.




    I have the below in the WindowsUpdate.log during the same time period that the error showed in the application event log:

    2009-10-13	13:33:28:679	 868	1444	Report	Uploading 10 events using cached cookie, reporting URL = http://wsusserver/ReportingWebService/ReportingWebService.asmx
    2009-10-13	13:33:29:038	 868	1444	Report	Reporter successfully uploaded 10 events.
    2009-10-13	13:34:06:913	5232	16d4	COMAPI	-------------
    2009-10-13	13:34:06:913	5232	16d4	COMAPI	-- START --  COMAPI: Install [ClientId = MicrosoftUpdate]
    2009-10-13	13:34:06:913	5232	16d4	COMAPI	---------
    2009-10-13	13:34:06:913	5232	16d4	COMAPI	  - Allow source prompts: Yes; Forced: No; Force quiet: No
    2009-10-13	13:34:06:913	5232	16d4	COMAPI	  - Updates in request: 1
    2009-10-13	13:34:06:913	5232	16d4	COMAPI	  - ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D}
    2009-10-13	13:34:06:913	 868	1724	Agent	*************
    2009-10-13	13:34:06:913	 868	1724	Agent	** START **  Agent: Installing updates [CallerId = MicrosoftUpdate]
    2009-10-13	13:34:06:913	 868	1724	Agent	*********
    2009-10-13	13:34:06:913	5232	16d4	COMAPI	  - Updates to install = 1
    2009-10-13	13:34:06:913	 868	1724	Agent	  * Updates to install = 1
    2009-10-13	13:34:06:913	5232	16d4	COMAPI	<<-- SUBMITTED -- COMAPI: Install [ClientId = MicrosoftUpdate]
    2009-10-13	13:34:06:913	 868	1724	Agent	  *   Title = Update for Microsoft Forefront Client Security (KB971026)
    2009-10-13	13:34:06:913	 868	1724	Agent	  *   UpdateId = {506BB1E4-A125-4788-9F78-5151C558D32D}.107
    2009-10-13	13:34:06:913	 868	1724	Agent	  *     Bundles 1 updates:
    2009-10-13	13:34:06:913	 868	1724	Agent	  *       {A4D85E96-D965-4B3F-B513-54F161B20C37}.107
    2009-10-13	13:34:06:913	 868	1724	Agent	WARNING: LoadLibrary failed for srclient.dll with hr:8007007e
    2009-10-13	13:34:06:929	 868	1724	Handler	Attempting to create remote handler process as mydomain/myuser in session 1
    2009-10-13	13:34:07:163	 868	1724	DnldMgr	Preparing update for install, updateId = {A4D85E96-D965-4B3F-B513-54F161B20C37}.107.
    2009-10-13	13:34:07:320	1096	ab4	Misc	===========  Logging initialized (build: 7.2.6001.788, tz: -0400)  ===========
    2009-10-13	13:34:07:320	1096	ab4	Misc	  = Process: C:\WINDOWS\system32\wuauclt.exe
    2009-10-13	13:34:07:320	1096	ab4	Misc	  = Module: C:\WINDOWS\system32\wuaueng.dll
    2009-10-13	13:34:07:320	1096	ab4	Handler	:::::::::::::
    2009-10-13	13:34:07:320	1096	ab4	Handler	:: START ::  Handler: Command Line Install
    2009-10-13	13:34:07:320	1096	ab4	Handler	:::::::::
    2009-10-13	13:34:07:320	1096	ab4	Handler	  : Updates to install = 1
    2009-10-13	13:42:50:609	1096	ab4	Handler	  : WARNING: Command line install completed. Return code = 0x00000643, Result = Failed, Reboot required = false
    2009-10-13	13:42:50:609	1096	ab4	Handler	  : WARNING: Exit code = 0x8024200B
    2009-10-13	13:42:50:609	1096	ab4	Handler	:::::::::
    2009-10-13	13:42:50:609	1096	ab4	Handler	::  END  ::  Handler: Command Line Install
    2009-10-13	13:42:50:609	1096	ab4	Handler	:::::::::::::
    2009-10-13	13:42:52:000	 868	1724	Agent	*********
    2009-10-13	13:42:52:000	 868	1724	Agent	**  END  **  Agent: Installing updates [CallerId = MicrosoftUpdate]





    I looked in c:\program files\microsoft forefront\client security\client\logs and only see the mp_ambits.log file. there is a lot of data in this log for the same time period, so i'm going to not post it here at this time.



    If anyone knows something that i can do, or try, to get this app working on this server, i would be most grateful for your assistance!








    Tuesday, October 13, 2009 6:35 PM

Answers

  • Adding an answer here as well as I emailed Daniel on this..

    We've seen this issue a couple of times but have not been able to nail down why it happens.  Basically the service will not gracefully stop and hangs during stopping.  A "workaround" to this is to set the service to manual, reboot the system and apply the latest FCSAM update in this case KB971026 while the service is disabled.  Since the service is already stopped when the update calls into the service control manager to stop the service it immediately comes back with the service is stopped and the update proceeds to install and start up the service.  After this you will need to set the FCSAM service back to automatic.

    Unfortunately as mentioned this is a workaround... Does not explain why the service does not shut down properly.  If you have the issue and want to open a case with us regarding it this type of issue is usually a defect and is typically a non-charge case so depends on how important it is to you and how much time you want to spend with us working it to try to figure out whats wrong :)

    Thanks
    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
    • Marked as answer by Daniel_Ceola Tuesday, October 27, 2009 2:54 PM
    Tuesday, October 27, 2009 2:34 PM
    Moderator
  • Shortly before I heard from Kurt, I came across a blog that demonstrated how to slipstream the latest software update for FCS into the main install package, thus allowing you to get around installing FCS, then letting it download and install the latest software update (in this case KB971026). 


    After I wiped out FCS on one of my problem servers (uninstalled what I could, then used installer cleanup to kill the bits that wouldn't, and just to make sure, did 'sc delete fcsam' from the command prompt) I ran my new install package, and Miraculously FCS is now working properly on this server.

    As I still have the issue on a second server, I may go ahead and call MS to work on this & try to find the problem.  If/when I do that, I will post results here.


    • Marked as answer by Daniel_Ceola Tuesday, October 27, 2009 2:54 PM
    Tuesday, October 27, 2009 2:54 PM

All replies

  • Hi,

     

    Thank you for your post.

     

    According to your description, I understand the problem you are experiencing is the FCSAM service could not be stopped, and thus caused the update installation failure.

     

    To resolve this issue, please perform the following steps and see if it works.

    1.      Removed FCSAM service with command line “Sc delete FCSAM”

    2.      Uninstalled “Microsoft Forefront Client Security Antimalware Service” from Add/Remove Programs;

    3.      Reinstalled FCSAM service and upgrade it to the FCS SP1.

     

    Regards,


    Nick Gu - MSFT
    Wednesday, October 14, 2009 9:57 AM
    Moderator
  • Nick,

    Thanks for the response.  I have tried something very similar to that, however i did sc delete fcsam & then used the installer cleanup utility to remove FCSAS. I will try the steps this way and see what happens.


    Edit:

    I attempted the above steps, however i am unable to complete them at this time as it appears that i need to reboot the server to finish the 'sc delete fcsam' step. I performed that action, then attempted to uninstall FCSAS from add/remove programs and it still gave me the unable to stop the service error that its been giving me for some time. I believe when i am able to reboot the server, the service will be gone and i can hopefully run the uninstaller. I may be able to do this in an hour or so, if not then, i will have to do it after business hours tonight.
    • Edited by Daniel_Ceola Wednesday, October 14, 2009 3:19 PM more info
    Wednesday, October 14, 2009 3:11 PM
  • Ok, i did sc delete fcsam, then rebooted the server. After the reboot i uninstalled FCSAS from add/remove programs. I then re-installed the forefront client, and attempted to update to SP1.

    The SP1 upgrade failed with the same errors as before and the service appears in a "stopping" state again.
    Wednesday, October 14, 2009 5:34 PM
  • I am now experiencing the exact same problem & error messages on a second server. Same errors in the windows update log as well as the event log.
    Friday, October 16, 2009 1:36 PM
  • Hi,

     

    Thank you for your update.

     

    I’d like to confirm what do you mean about “SP1”. As far as I know, there is no SP1 for client computers.  And you may try to disable the fcsam service and restart  the system then apply the updates.

     

    Regards,


    Nick Gu - MSFT
    Monday, October 19, 2009 8:43 AM
    Moderator
  • sorry, i guess its not actually called sp1. It would be the update labeled "Update for Microsoft Forefront Client Security KB971026)" on the server in question.
    Tuesday, October 20, 2009 1:02 PM
  • I'm still having issues with this on two of my servers. Is there any assistance someone can provide?
    Tuesday, October 27, 2009 1:35 PM
  • Adding an answer here as well as I emailed Daniel on this..

    We've seen this issue a couple of times but have not been able to nail down why it happens.  Basically the service will not gracefully stop and hangs during stopping.  A "workaround" to this is to set the service to manual, reboot the system and apply the latest FCSAM update in this case KB971026 while the service is disabled.  Since the service is already stopped when the update calls into the service control manager to stop the service it immediately comes back with the service is stopped and the update proceeds to install and start up the service.  After this you will need to set the FCSAM service back to automatic.

    Unfortunately as mentioned this is a workaround... Does not explain why the service does not shut down properly.  If you have the issue and want to open a case with us regarding it this type of issue is usually a defect and is typically a non-charge case so depends on how important it is to you and how much time you want to spend with us working it to try to figure out whats wrong :)

    Thanks
    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
    • Marked as answer by Daniel_Ceola Tuesday, October 27, 2009 2:54 PM
    Tuesday, October 27, 2009 2:34 PM
    Moderator
  • Shortly before I heard from Kurt, I came across a blog that demonstrated how to slipstream the latest software update for FCS into the main install package, thus allowing you to get around installing FCS, then letting it download and install the latest software update (in this case KB971026). 


    After I wiped out FCS on one of my problem servers (uninstalled what I could, then used installer cleanup to kill the bits that wouldn't, and just to make sure, did 'sc delete fcsam' from the command prompt) I ran my new install package, and Miraculously FCS is now working properly on this server.

    As I still have the issue on a second server, I may go ahead and call MS to work on this & try to find the problem.  If/when I do that, I will post results here.


    • Marked as answer by Daniel_Ceola Tuesday, October 27, 2009 2:54 PM
    Tuesday, October 27, 2009 2:54 PM