After installing the run of the mill patches today on a Windows Server 2008 (Running as an AD controller and Exchange 2007 Server) the machine came back up with "configuring updates stage 3 of 3 0% complete".

The machine had been kept reasonably up to date so this likely was caused by a very recent patch. At the leaste the following patches were installed:


Restarting the server into safe mode and then subsequently rebooting (with no changes made) allowed the computer to restart and I can now log in normally.

However none of the critical services start; including but not limited to Exchange, DNS and Terminal Services (Obviously if DNS doesn't start other things will break). I am unable to run Internet Explorer but Chrome will work.

There are no meaningful errors in the event logs as to why services won't start.

Under KDC I have

The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart     card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.

This is going to be an evil one to debug and I'm kinda hoping someone has encountered it and knows the answer off hand.

Thanks all.


This issue has now been resolved with the help of Microsoft tech support. It involved some registry changes on the part of them to svchost. It apparently is a known issue with vista/2k8 and solved in 2k8r2/win7.

More info to come, they promised to let me know more next week.


I had the same issue and just got off the phone with Microsoft - The svchost.reg file didn't fix my issue. However, this fixed my issue maybe it'll fix yours.

Set Cryptsvc as DependOnService on HTTP driver.

HKLM\CurrentControlSet\Serivces\HTTP and create following value.

Name: DependOnService Value: reg_multi_sz (this is a multi string)

Click DependOnService Set CryptSvc on the value.

Reboot the server


I have a server with serious problems with services. A large number of them will not start, and do not raise any issues in the Event Viewer. I just tried the "Set Cryptsvc as DependOnService on HTTP driver" fix above, and it worked like a charm. The above instructions do miss something in registry path. Here is the correct version:

HKLM\System\CurrentControlSet\Serivces\HTTP and create following value.

Name: DependOnService Value: reg_multi_sz (this is a multi string)

Click DependOnService Set CryptSvc on the value.

Reboot the server


Are you able to tell us what the recent updates were (Look in the Windows Event Log / System for "WindowsUpdateClient" events) ?

I've noticed that a patch that breaks on one server will work just fine on lots of other servers, so I suspect you will need to do some further investigation in the the nature of your problem.

The first place to start is your Event Logs - in particular look in the System and Application event logs for "Stop" events relating the the services that won't start, but also look for any other red "Stop" events that appear after power-up, they might give a clue as to why the other services won't start. I have seen problems in the past where RPC, COM, and DCOM services failed to start and a lot of other services depended on them

Once you have an idea what the update was, then google the KB # for that update, there will be an MSDN Technet page that lists exactly what files are updated. Then using the service start errors, you can work out a plan to repair the damage.

The more info you can post on this site the more help people may be able to offer.

  • i've just got the server down for a backup at the moment; but thats the thing; where normally there would be those logs regarding service start fails; there is literally nothing. With the exception of Group Policy (likely failing due to prerequisites) and KDC all service starts fail silently. I'll be searching the patches as soon as I can find the logs for them. – Antitribu Nov 11 '09 at 23:23
  • updated the question with some more info and patches that were run – Antitribu Nov 12 '09 at 13:48
  • Although I have not had any issues similar to this on Windows 2008, I wonder if it might be possible to try and Uninstall patch # KB969947 as it seems to have caused problems for others. Regarding the KDC issue, have you seen: technet.microsoft.com/en-us/library/cc734096%28WS.10%29.aspx – ChrisNZ Nov 13 '09 at 9:12
  • I've uninstalled the patches; first KB969947 then the other two; after both reboots I experienced the exact same issues with configuring patches and the underlying problem still exists. – Antitribu Nov 13 '09 at 12:26
  • It looks like one of the patches knocked DCOM from out underneath the server; dcomcnfg has no objects in the computers folder; thats probably not good... – Antitribu Nov 13 '09 at 13:53

Wow. We run a web hosting company with about 60 shared windows server 2008 servers. This is the second time I've had to come back to this article. The first time, we had 6 hours of downtime until I found this article. We were about to do a full system restore which would have cost us hours in restoring individual user files.

Thanks to the user who posted this solution.


If the update is stuck at Step 3 of 3 (0% done), it is possible this is the underlying issue. We waited for an hour until I went ahead and put it into safe mode. Safe mode goes through the update quickly but then the underlying issue (this, where the network and critical services wont start) pops up. The registry key edit then resolves this issue.

Thanks again.


This same issue happened again last night after all these years. Server 2008, not a DC, running SPS. At first I thought the issue was a group policy problem (and maybe I had 2 separate issues here, because I got a security error when I tried to start them manually)), but the services did not start back up again until I made this registry change. Wasted an entire day.


Not the answer you're looking for? Browse other questions tagged or ask your own question.