2

I have some strange errors on multiple Server 2012 R2 Virtual Machines (Hyper-V hosts).

  • Missing VSS writers on startup: System Writer and Exchange Writer.

I have scoured the net for possible solutions, including the hotfixes, but they are not applicable to my case. If I restart the services responsible for those two writers, the writers are there. However, they dissapear after a while.

  • few very specific services are crashing very regulary (and are being recovered)

The COM+ Event System service terminated unexpectedly.

The Windows Font Cache Service service terminated unexpectedly

The Network List Service service terminated unexpectedly

The Network Store Interface Service service terminated unexpectedly

On average they have done this '50 times'

My guess is that they make the 2 other writers dissapear. These services are all hosted in the same svchost.exe I think. Because at the same time, this error can be seen in the application log:

Faulting application name: svchost.exe, version: 6.3.9600.17415, time stamp: 0x54504177
Faulting module name: regsvc.dll_unloaded, version: 6.3.9600.17415, time stamp: 0x54504293
Exception code: 0xc0000005
Fault offset: 0x000000000000318b
Faulting process id: 0xa818
Faulting application start time: 0x01d12c0f3318f052
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: regsvc.dll

There are no other events of note in the application log.

I have checked: regkey permissions on vss key and I have already done the takeown fix on the winsxs folder.
Visual Studio is not installed on this server.

Only happens on VM hosts (generation 2) - Server 2012 R2 servers.

Anyone has a clue? I'm baffled and I've already wasted hours on possible solutions.

Improve this question
2
  • regsvc.dll = remote registry service. stop/disable that service and try again.
    – magicandre1981
    Dec 1, 2015 at 18:34
  • I will certainly try this after my current fix. I have given every service it's own SVChost process to run in using "sc config 'servicename' type= own" and as it stands my writers are now remaining stable and visible. I have even managed a proper exchange backup which has been a few weeks at least. If my writers still crash, i will happily disable remote registry. So thanks for the suggestion!
    – Remko H.
    Dec 2, 2015 at 15:37

3 Answers 3

Reset to default
2

I can confirm now that the problem was with one of the services that was hosted inside the svchost.

After giving every service a seperate process to run in, only the Windows Time Service kept crashing. The VSS writers are back and I have successfully backed-up the affected server for 4 days in a row. This is an absolute first.

Now all that remains is finding out why the time service keeps crashing, but this is low priority.

The VSS writers were affected because Exchange Store service is dependent on the Network Store Interface Service. It crashes and restarts, the store service keeps running properly but the crash is enough to disrupt the VSS service.

Improve this answer
2 
sc config EventSystem type= own
sc config FontCache type= own
sc config netprofm type= own
sc config RemoteRegistry type= own
sc config W32Time type= own
sc config WinHttpAutoProxySvc type= own
sc config nsi type= own

fixed it for me

Improve this answer
1

I came across this issue on multiple servers and saw the resolution in this thread which was helpful, however I still wanted to know the cause and if there was a more specific fix.

I used a small utility called 'FullEventLogView' which lets you search by Event Level and date/time, but searches and displays logs from ALL event logs (not just the main ones like Application and System). I was then able to see that a few seconds before the multiple services failed there were tons of warnings and errors which referenced a vulnerability scanner we use.

Upon getting with the scanner vendor they knew of the issue and replied back:

This is a known Microsoft issue and the following information below provides a workaround. Service interruptions were experienced on Windows 2012 Servers as follows: Narrowed the root cause to a suspected defect in the Microsoft Windows 2012R2 operating system (specifically, the Remote Registry Service <regsvc.dll>). We recommend engaging with Microsoft to obtain further guidance. Further investigation by Microsoft , confirmed a defect in regsvc.dll that was already in their documented defects database – listed as affecting a small number of customers. There are no plans to fix the defect in Windows 2012; but Microsoft has recommended a workaround that prevents the error condition. Issue Technical Detail The Windows Remote Registry Service (regsvc.dll) is configured in Windows 2012 Server to start when its functionality is necessary; and to stop after it has been idle for 10 minutes. Remote Registry is executed within a shared SvcHost process along with the following services – (EventSystem, FontCache, netprofm, nsi,W32Time). On the limited number of servers in question, rather than stopping elegantly near the end of a vulnerabilty scan; regsvc.dll crashes – causing all other services within the same SvcHost to stop as well. Within five minutes of the Remote Registry crash; EventSystem, FontCache, netprofm, nsi, and W32Time are all restarted automatically by the operating system. The Microsoft recommended workaround for the issue is to move Remote Registry from a shared SvcHost to its own SvcHost. (This is apparently the design used in Windows 2016 Server and Windows 10). Commands to complete the change are as follows:
sc config remoteregistry type=own

I tried the above on multiple servers, and it did fix the issue.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .