none
Security-SPP Event 16385 Error 0x80070005

    General discussion

  • I am getting these error messages twice a minute in the Application Log on my Server 2012 RC:

    Log Name:      Application
    Source:        Microsoft-Windows-Security-SPP
    Date:          7/18/12 6:27:46 PM
    Event ID:      16385
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      E35M1m-Server.Borg.local
    Description:
    Failed to schedule Software Protection service for re-start at 2013-01-01T23:58:46Z. Error Code: 0x80070005.

    From what I can tell, this is an access is denied message.  I checked the policy RSOP and the SPPsvc is run by Network Service which has all the required privileges SeAuditPrivilege, SeChangeNotifyPrivilege, SeCreateGlobalPrivilege, and SeImpersonatePrivilege.

    Has anyone else seen this?  Does anyone have any ideas what is causing this?

    Thanks, Brian

    • Changed type Brian Borg Wednesday, July 18, 2012 11:41 PM
    • Edited by Brian Borg Wednesday, July 18, 2012 11:43 PM
    • Changed type Brian Borg Tuesday, July 24, 2012 6:40 AM
    Wednesday, July 18, 2012 11:39 PM

All replies

  • Hi,

    Please make sure that the Task Scheduler service is started.

    If it does not work, please also backup, export the following registry from another working Windows Server 2012 RC server and import to the problematic one to check the result.

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Schedule

    Regards,


    Arthur Li

    TechNet Community Support

    Friday, July 20, 2012 4:06 AM
    Moderator
  • Thank you, Arthur

    I had been looking at the Schedule Service and the RequiredPrivileges versus RSOP. They seem to all be either the default, explicitly permitted, or inherent for Local Service:

    SeIncreaseQuotaPrivilege       Adjust memory quotas for a process
    SeChangeNotifyPrivilege        Bypass traverse checking
    SeAuditPrivilege               Generate security audits
    SeImpersonatePrivilege         Impersonate a client after authentication
    SeAssignPrimaryTokenPrivilege  Replace a process-level token
    SeTcbPrivilege                 Act as part of the operating system
    SeRestorePrivilege             Restore files and directories

    Some of them are "Not Defined".  I assume they would take their defaults but I could be wrong.  Do you think I should make sure all of them are defined?

    When I tried to import an exported .reg file for the Scheduler Service I got an instant blue screen with SYSTEM_SERVICE_EXCEPTION.  I tried to stop the service but I cannot, not even by using sc in an elevated command prompt.  I guess I will have to do it offline.

    Friday, July 20, 2012 10:14 PM
  • Importing it offline did not work either.

    This error message is like the pink bunny that keeps on going, and going.

    Friday, July 20, 2012 11:48 PM
  • I tried sfc, sfc offline, and inplace upgrade.  Sfc reports no problems but upgrade fails.  I might have to start over.
    Saturday, July 21, 2012 3:38 AM
  • Hi,

    If so, I agree with you to backup all the important data and reinstall the system.

    Regards,


    Arthur Li

    TechNet Community Support

    Tuesday, July 24, 2012 5:15 AM
    Moderator
  • Hello.

    Please check Volume Shadow Copy service if it is started. If it is not started, go and start the process.

    Regards,

    Vladimir

    Friday, October 05, 2012 7:53 AM
  • Managed to fix this, I added full rights for network service user to C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform.
    Sunday, December 09, 2012 12:00 PM
  • I'm seeing similar situation where such errors are logged every few seconds, 2-3 per min on 2012 std server. I checked the access right for C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform and they are same on the server where I'm seeing problem and on one where there is no problem. Network service doesn't have full right on either server.
    Friday, December 14, 2012 7:45 PM
  • Bom dia pessoal,

    Estou passando pelo mesmo problema aqui.

    Nosso servidor é licenciado com Win. Server 2008 Enterprise Edition R2 e não usamos DOMINIO.

    Essa mensagem pode me gerar algum problema relacionado a software pirata? 

    Estou preocupado com isso, uma vez que minha rede é licenciada.

    Att,


    Att, A. Angeli

    Friday, June 14, 2013 12:03 PM
  • I got lots of the same errors on Windows 8 Pro:

    "Failed to schedule Software Protection service for re-start at 2113-08-13T01:01:44Z. Error Code: 0x80070005."

    I also got the same events with Error Code: 0x80070002 and a few others.

    I was seeing error dialogs when I tried to view Task Scheduler.
    The SvcRestartTask xml file (among others) in C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform folder was corrupted and broke the scheduled task.

    The fix, in my case, was to delete the SvcRestartTask task in Task Scheduler.

    Next, I made sure the SvcRestartTask file was removed from C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform folder.

    Then, since I had no spare Win 8 machine to obtain a clean copy of SvcRestartTask xml file, I found one on PasteBin via a Google search:  http://pastebin.com/p06ErcTN

    I copied the text from PasteBin and created a new text file and pasted the xml text in and saved it as SvcRestartTask. 

    Next I selected the SoftwareProtectionPlatform branch of Task Scheduler (Task Scheduler > Task Scheduler Library > Microsoft > Windows > SoftwareProtectionPlatform).  I right clicked on it and selected Import Task...

    I browsed to the folder where I created the new SvcRestartTask file, selected it and clicked Open.

    When I checked the Event viewer all was good.  The sppsvc service had started/stoppped properly and it automatically did all its validation.   I saw no more Event 16385 errors.  

    Here is the complete, clean SvcRestartTask xml file:

    <?xml version="1.0" encoding="UTF-16"?>
    <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
      <RegistrationInfo>
        <Source>$(@%systemroot%\system32\sppc.dll,-200)</Source>
        <Author>$(@%systemroot%\system32\sppc.dll,-200)</Author>
        <Version>1.0</Version>
        <Description>$(@%systemroot%\system32\sppc.dll,-201)</Description>
        <URI>\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</URI>
        <SecurityDescriptor>D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)(A;;FR;;;S-1-5-87-2912274048-3994893941-1669128114-1310430903-1263774323)</SecurityDescriptor>
      </RegistrationInfo>
      <Triggers>
        <CalendarTrigger>
          <StartBoundary>2012-11-02T07:00:10Z</StartBoundary>
          <Enabled>true</Enabled>
          <ScheduleByDay>
            <DaysInterval>1</DaysInterval>
          </ScheduleByDay>
        </CalendarTrigger>
      </Triggers>
      <Principals>
        <Principal id="NetworkService">
          <UserId>S-1-5-20</UserId>
          <RunLevel>LeastPrivilege</RunLevel>
        </Principal>
      </Principals>
      <Settings>
        <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
        <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
        <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
        <AllowHardTerminate>false</AllowHardTerminate>
        <StartWhenAvailable>true</StartWhenAvailable>
        <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
        <IdleSettings>
          <StopOnIdleEnd>true</StopOnIdleEnd>
          <RestartOnIdle>false</RestartOnIdle>
        </IdleSettings>
        <AllowStartOnDemand>true</AllowStartOnDemand>
        <Enabled>true</Enabled>
        <Hidden>true</Hidden>
        <RunOnlyIfIdle>false</RunOnlyIfIdle>
        <DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
        <UseUnifiedSchedulingEngine>true</UseUnifiedSchedulingEngine>
        <WakeToRun>false</WakeToRun>
        <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>
        <Priority>7</Priority>
        <RestartOnFailure>
          <Interval>PT1M</Interval>
          <Count>3</Count>
        </RestartOnFailure>
      </Settings>
      <Actions Context="NetworkService">
        <ComHandler>
          <ClassId>{B1AEBB5D-EAD9-4476-B375-9C3ED9F32AFC}</ClassId>
          <Data><![CDATA[timer]]></Data>
        </ComHandler>
      </Actions>
    </Task>


    Importing the task xml is the way to go. 

    I don't think copying the file to C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform folder will fix the problem.


    I hope this helps someone.


    Friday, September 06, 2013 3:10 AM
  • It seems to have worked! Thanks.


    Thanks, Mark

    Monday, September 16, 2013 12:18 AM
  • This worked for me as well.  Item of note the folders under c:\windows\tasks did not even exist for me and after creating the folder structure, ensuring the security settings for Network service and local service was in place, and recreating the task by deleting it and creating the new xml file and pasting what you have here then stopping the sppsvc and starting the sppsvc cleared up the issue.  Thanks for the time and effort you put into this and the solution.
    Wednesday, February 05, 2014 1:35 PM
  • Hi, one of my Windows Servers 2012 started to report exactly same error ("Failed to schedule Software Protection service")- would you recommend trying same fix?

    How much difference (in design) there is between Windows 8 and Windows Server 2012?

    Wednesday, June 24, 2015 2:48 PM
  • I had the same problem with my Windows 8.1 the "failed to schedule..." and the date that it was trying to reschedule was about 14 days in the past.  As the date changed so did the time and date of the error but always in the past.

    I did three things, not all were good.  This got rid of the error message.

    #2 I removed the folder Windows\system32\tasks\softwareprotectionplatform ( bad move ).  I did this as I couldn't find help on the original problem in that I could not get Window Defender virus definition updates.

    #3, in order to get the defender virus definitions to download I had to install a missing update.  MS has been messing around with this at recently, but I was missing both the latest and a prior update for unknown reasons, kb3135449 I believe.

    Saturday, May 28, 2016 3:27 PM
  • I had a similar problem, and I  solved following this link

    http://www.edugeek.net/forums/windows-server-2012/175145-software-protection-service.html

    Tuesday, June 13, 2017 10:06 PM
  • This works on a Windows 10 Build 1607 [10.0.14393] Machine, thanks
    Tuesday, June 20, 2017 12:44 PM