locked
Netlogon Service start setting changed to "Disabled" RRS feed

  • Question

  • The Netlogon Service start setting is (occasionally) changed from "Automatic" to "Disabled". It doesn't happen all the time and there doesn't appear to be any rhyme or reason with respect to configuration changes, Windows Patches, software installs, etc... I'm the only Administrator on the system, so it's not being changed intentionally. This change doesn't affect the operation of the system, as the Netlogon Service is still running, but it definitely affects the system on a restart, as the system doesn't restart completely when the Netlogon Service is disabled. As a note, there are no events logged (System, Service or Application) when the Netlogon Service startup setting is changed.

    In an attempt to work around the issue, I have updated Group Policy such that the Netlogon Service is always set to "Automatic", but have recently found, on a restart, that the Netlogon Service is again set to "Disabled". (I had verified that the Netlogon Service was set to "Automatic" seconds before the restart.) It's my understanding that when Group Policies are applied, the policies (that are being set) are first "cleared" and then updated/changed, per the policies... so maybe, this behavior isn't (too) unexpected (maybe a race condition with setting the policies and the Netlogon Service is disabled). As an additional note, when the Netlogon Service is set/started via Group Policy, the W32Time Service will not start (I receive a System error 1792 and message that the W32Time Service won't start because the Netlogon Service isn't running. In fact the Netlogon Service is running. If I remove the Netlogon Service startup from Group Policy and start Netlogon by hand, W32Time starts up with no issues).

    The Group Policy issue (above) was an attempt at a work around and is not really my issue, just an fyi for anyone that might have the Netlogon Service started via Group Policy ... there may be unintended consequences.

    The issue I need help with is how/why the Netlogon Service startup setting is changed from "Automatic" to "Disabled" without user intervention.... does anyone have any ideas? 

     
    Thursday, August 18, 2016 1:23 PM

Answers

All replies

  • Hi,

    According to your description, my understanding is that startup type of Netlogon Service will be changed from "Automatic" to "Disabled".

    Try to disable an3rd party process, including anti-virus program temporarily and check the result. 

    Make sure that Netlogon Service is configured the “Log on as” – “Local System account”. Check the “Dependencies” and make sure that related service is running.

    Besides, run “Regedit” to open Registry Editor and locate the following registry key:
    HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Netlogon/

    In the right pane, double-click the DependOnService value and make sure that below strings are listed:
    LanmanServer
    LanmanWorkstation

    If the problem persists, please run “msinfo32”,provide the OS version and name.

    Best Regards,
    Eve Wang

    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, August 19, 2016 7:17 AM
  • I have verified that there are no 3rd party processes that are affecting the startup setting for the Netlogon Service.

    The Netlogon Service is configured to Log on as – “Local System account”, the “Dependencies” services are running and the "DependOnService" value (in the registry) is correctly set to "LanmanServer" & LanmanWorkstation".

    MSInfo32:

    OS Name                     Microsoft Windows Small Business Server 2011 Standard

    Version                        6.1.7601 Service Pack 1 Build 7601

    As noted previously, the startup state/value for the Netlogon Service changes from "Automatic" to "Disabled" (on what appears to be) randomly.

    Any help is greatly appreciated.

    Tuesday, August 23, 2016 1:52 PM
  • Perhaps install SYSMON and run through some reboots? see if it logs anything changing the service startup type?

    https://technet.microsoft.com/en-us/library/cc756386%28v=ws.10%29.aspx

    It should also be logged when the changes occur, in the event log.


    Robert Pearman Cloud & Datacentre MVP
    @titlerequired | LinkedIn | Google+
    Facebook | Windows Server Essentials.com


    Thursday, August 25, 2016 12:24 PM
  • Hi,

    I am checking to see how things are going there on this issue. Please let us know if you would like further assistance.

    You can click “Mark as answer” if the reply is helpful. It would make this reply to the top and easier to be found for other people who has the similar problem.

    Best Regards,
    Eve Wang


    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Saturday, September 3, 2016 5:32 AM