Errors 0x80092026 and 0x800B0004

Errors 0x80092026 and 0x800B0004

System: Windows 2000 Server, 5.00.2795 SP3 - Active Directory

These errors appear when I try Windows Update.

I have: correct IE settings, cleaned temp files, re-registered dlls,
etc.

(I have read many threads regarding these problems.)

The problem is due to "Trust" and "Crypto".

Two things:

1) I do not have "Software Restriction Policies" in gpedit.msc

2) I do not have Cryptogrphic services available

Obviously these are my problem(s). (Or are directly related.)


The first:

My computer is in an Active Directory configuration. In "Group Policy"
under "Computer Configuration" the menu, in gpedit.msc, should be
(according to all threads/websites/etc.):

"Computer Configuration/ Windows Settings /Security Settings /Software
Restriction Policies/ Trusted Publishers"

But I get to "Computer Configuration/ Windows Settings /Security
Settings " and the only choices I have under Security Settings are:
"Account Policies, Local Policies, Public Key Policies and IP Security
Policies".

Nowhere in any "Policy" can I find reference to "Allow the following
users to select trusted publishers". (Which everyone says I need to set
to "End Users".)


The second:

I enter: "net start cryptsvc" and the result is: "The service name is
invalid".


So, how do I:

1) _find_ the "local security option setting" in AD
2) _install_ the cryptsvc


I THANK YOU MUCH IN ADVANCE!

> I enter: "net start cryptsvc" and the result is: "The service name is
> invalid".

Several suggestions were made for a similar symptom here.
I would start with the regsvr32 idea. If that doesn't restore the service
try the sc create command.

http://groups-beta.google.com/group/...dc9fa2aa7eae9b


Good luck

Robert Aldwinckle
---


<> wrote in message
news: oups.com...
> Errors 0x80092026 and 0x800B0004
>
> System: Windows 2000 Server, 5.00.2795 SP3 - Active Directory
>
> These errors appear when I try Windows Update.
>
> I have: correct IE settings, cleaned temp files, re-registered dlls,
> etc.
>
> (I have read many threads regarding these problems.)
>
> The problem is due to "Trust" and "Crypto".
>
> Two things:
>
> 1) I do not have "Software Restriction Policies" in gpedit.msc
>
> 2) I do not have Cryptogrphic services available
>
> Obviously these are my problem(s). (Or are directly related.)
>
>
> The first:
>
> My computer is in an Active Directory configuration. In "Group Policy"
> under "Computer Configuration" the menu, in gpedit.msc, should be
> (according to all threads/websites/etc.):
>
> "Computer Configuration/ Windows Settings /Security Settings /Software
> Restriction Policies/ Trusted Publishers"
>
> But I get to "Computer Configuration/ Windows Settings /Security
> Settings " and the only choices I have under Security Settings are:
> "Account Policies, Local Policies, Public Key Policies and IP Security
> Policies".
>
> Nowhere in any "Policy" can I find reference to "Allow the following
> users to select trusted publishers". (Which everyone says I need to set
> to "End Users".)
>
>
> The second:
>
> I enter: "net start cryptsvc" and the result is: "The service name is
> invalid".
>
>
> So, how do I:
>
> 1) _find_ the "local security option setting" in AD
> 2) _install_ the cryptsvc
>
>
> I THANK YOU MUCH IN ADVANCE!
>

Finally getting to this....

The command:

regsvr32 [/u] cryptsvc.dll

results in: "cryptsvc.dll was loaded but the Dll[Un]RegisterServer
entry point was not found ..."

The command:

sc create crptsvc binpath=c:\winnt\system32\cryptsvc.dll

results in a help dump only (as if "sc /?").

cryptsvc.dll is version 5.0.2195.6868 and 76,048 bytes.



Robert Aldwinckle wrote:
> > I enter: "net start cryptsvc" and the result is: "The service name
is
> > invalid".
>
> Several suggestions were made for a similar symptom here.
> I would start with the regsvr32 idea. If that doesn't restore the
service
> try the sc create command.
>
>
>

"c5" <> wrote in message
news: ups.com...
> Finally getting to this....
>
> The command:
>
> regsvr32 [/u] cryptsvc.dll
>
> results in: "cryptsvc.dll was loaded but the Dll[Un]RegisterServer
> entry point was not found ..."

Yes. Sorry, I was just trusting Alex Nichol's suggestion without
analysing it. I just checked with depends.exe: cryptsvc.dll has
no entrypoints for COM functions at all.


>
> The command:
>
> sc create crptsvc binpath=c:\winnt\system32\cryptsvc.dll
>
> results in a help dump only (as if "sc /?").
>
> cryptsvc.dll is version 5.0.2195.6868 and 76,048 bytes.

Did you type it always with that typo? <eg>
Did the command as Kelly gave it not work either? (Copy&Paste?)

BTW where did you get the idea to use the binpath= operand?
If you have to use the binpath= operand my *guess* would be
that you would have to give it something like this (from the field
"Path to executable:" on the General tab of my Cryptographic Services
Properties): D:\WINDOWS\system32\svchost.exe -k netsvcs

Notice then that the -k and netsvcs parameters would substitute
for <Option1> and <Option2> in that subcommand's syntax description.


Good luck

Robert
---

>Did the command as Kelly gave it not work either? (Copy&Paste?)
>
>BTW where did you get the idea to use the binpath= operand?

I read the MS help for sc and I (obviously now) misundstood what
'binpath=' meant.

Kelly wrote:

<quote>
Delete the content of the folder Windows\System32\catroot2.

To add a service:

Go to Start/Run/CMD and type in: sc create CryptSvc
Reboot.

Or go to Start/Run/Regedit and navigate to this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
</endquote>

Since W2k does not have catroot2, the sc command does not work, and the
last part about the key seems truncated (and that I am *clueless*) I am
only groping around in the dark here.

(Microsoft's online help is a maze of little passages all different to
me.)

thanks for trying

Another question (and some more information).

Looks like my only problem is getting Cryptographic Services installed
again. I have Windows 2000 and Microsoft states that "Note Windows 2000
does not list Cryptographic Services in the SERVICES Administrative
Utility." (cf.
http://support.microsoft.com/default...b;en-us;822798)

So, how would the sc create command be formed for cryptsvc? (I am being
more rhetorical here than asking who I am replying to.)

I have read the help for sc and it tells how to use it but not the
specifics for CryptSvc (alas, I think that 'sc create CryptSvc' is an
XP only thing).

Svchost.exe starts many services. I wonder if there is a list of
Svchost.exe service names (names and '-k ID'). I have not yet seen a
list. 'Svchost.exe -k netsvcs' starts the 'netman' service according to
one reference; but would it be 'Svchost.exe -k cryptsvc' ? Somehow I
doubt it. But will have to try.

One of the hurdles that most bothers me is the subtle differences
between Windows versions. (XP, 2000, 2003, etc.; all just a little bit
different. For example, many MS docs mention 'tasklist /svc', but for
W2K it 'tlist -s'.)

*sigh*

P.S.

This all started after the computer was hit by a variant of the CWS
trojan.

Yet more info.... I just feel like documenting my research. ;-)

Indeed, CryptSvc starts via 'D:\WINDOWS\system32\svchost.exe -k
netsvcs' as Robert pointed out.

My problem is that my Registry entries for CryptSvc are
missing/corrupt; therefore crypto services are not being started.

So now I just have to get the complete command line for SC to re-create
the service figured out...

"c5" <> wrote in message news: oups.com...
> >Did the command as Kelly gave it not work either? (Copy&Paste?)

> Kelly wrote:
>
> <quote>
> Delete the content of the folder Windows\System32\catroot2.
>
> To add a service:
>
> Go to Start/Run/CMD and type in: sc create CryptSvc
> Reboot.
>
> Or go to Start/Run/Regedit and navigate to this key:
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es
> </endquote>
>
> Since W2k does not have catroot2,


You reported that your OS was

>>>>> System: Windows 2000 Server, 5.00.2795 SP3 - Active Directory

That OS seems to be covered by these articles which implies that it can
have that subdirectory:
<title>KB822798 - You cannot install some updates or programs</title>

<title>KB316524 - "Administrators only" error message when you attempt to use the Windows Update site</title>

(TechNet search for
cryptsvc catroot2
)

BTW at one point it was thought that that subdirectory might only exist
to reflect errors; so I would treat its existence conditionally.
BTW have you checked to see if it is hidden?
E.g. in a command window enter attrib \catroot2 /s /d
(assuming the current drive is %SystemDrive% of course)


> the sc command does not work, and the
> last part about the key seems truncated

I agree. I was uncritically accepting Kelly's suggestion too... ;]
Perhaps she was thinking that you should do a find in that branch?
One thing you could do in that regard is export the whole branch
and then do a find in the exported .reg file. Then if you have access
to another (working) version of your OS you could do the same thing
on it and do a windiff or fc of the two files (e.g.). If there then
appear to be no significant differences I would guess that we are
misinterpreting your symptoms. BTW provided you have enough
spare space on your disk to install your OS in an alterate partition
*that* could be sufficient for "another (working) version of your OS".

I just realized that we have seen no *proof* that the cryptsvc service
doesn't exist on your system. E.g. another interpretation of the error
indicators you are seeing is that your account is not *allowed* to do
anything with that service. Therefore the suggestion to create the service
could be failing because it already exists but is hidden from you.
Have you tried using the real Administrator account instead to do
these checks? Used services.msc to check on it? Etc.

For another tack I suppose you should check if its dependencies
are there first. Again, it would be better to compare against a
healthy version of your OS but FWIW here is how you could check
assuming the same dependencies exist in W2KS as exist in XP:

net start | findstr /i "RPC DCOM"

E.g. enter that command in a command window to verify both
the RPC and DCOM services are operational.


Good luck

Robert
---

Thank you for your help (and patience ;-).

Catroot2 does not exist for Windows 2000.
http://support.microsoft.com/?kbid=822798

"Rename the Catroot2 folder (Windows XP and Windows Server 2003 only),
...."

Running 'tlist -s' (Tasklist /svc) confirms CryptSvc not running:

252 SERVICES.EXE Svcs: Alerter,AppMgmt,Browser,Dhcp,dmserver,
Dnscache,Eventlog,lanmanserver,lanmanworkstation,L mHosts,Messenger,
PlugPlay,ProtectedStorage,seclogon,TrkSvr,TrkWks,W 32Time,Wmi

And running 'net start cryptsvc' states that there is "The service name
is invalid".

And, as I mentioned, for Windows 2000 "Cryptographic services" does not
show up in "Services".

Here is how the Registry fits in:

>From http://support.microsoft.com/kb/314056/EN-US/

<quote>
Svchost.exe groups are identified in the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\Cu rrentVersion\Svchost

Each value under this key represents a separate Svchost group and
appears as a separate instance when you are viewing active processes.
Each value is a REG_MULTI_SZ value and contains the services that run
under that Svchost group. Each Svchost group can contain one or more
service names that are extracted from the following registry key,
whose Parameters key contains a ServiceDLL value:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Service
</quote>

In the first key there exists "netsvcs" which contains all the services

that start with the command %SystemRoot%\\system32\svchost.exe -k
netsvcs

And the keys (note plural):

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\<service>

exist for each service.

On my system, CryptSvc does not exist in the Svchost key and there is
no servce key for CryptSvc.

Somehow, I have to re-create those registry entries.

"c5" <> wrote in message
news: oups.com...
> Thank you for your help (and patience ;-).
>
> Catroot2 does not exist for Windows 2000.
> http://support.microsoft.com/?kbid=822798
>
> "Rename the Catroot2 folder (Windows XP and Windows Server 2003 only),
> ..."

Ok. Sorry, about that. That's new this month. I was going by last
month's TechNet.


>
> Running 'tlist -s' (Tasklist /svc) confirms CryptSvc not running:
>
> 252 SERVICES.EXE Svcs: Alerter,AppMgmt,Browser,Dhcp,dmserver,
> Dnscache,Eventlog,lanmanserver,lanmanworkstation,L mHosts,Messenger,
> PlugPlay,ProtectedStorage,seclogon,TrkSvr,TrkWks,W 32Time,Wmi
>
> And running 'net start cryptsvc' states that there is "The service name
> is invalid".
>
> And, as I mentioned, for Windows 2000 "Cryptographic services" does not
> show up in "Services".

According to KB822798 it's not supposed to.
That's the sort of thing that is giving me the idea that it may be hidden
in other ways too.

Also since you pointed out KB314056 I just checked and found
that in XPsp2 ProtectedStorage is now run out of lsass.exe.
So who knows where cryptsvc should really be run out of on your OS? <eg>
(FYI Protected Storage System Provider is an example of a branch
of registry keys which we know exists but we can't see. RegMon can detect
them when they are used, e.g. for loading and saving AutoComplete values.)


....
> HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\<service>
>
> exist for each service.
>
> On my system, CryptSvc does not exist in the Svchost key and there is
> no servce key for CryptSvc.


What about in any of the other ControlSets?

Hmm... on mine it is there but empty under Safeboot\Minimal
and Safeboot\Network. There is something then called
LEGACY_CRYPTSVC under enum\root. Then the non-empty
one under Services. And finally a leaf node for it under
Services\Eventlog\System. That same structure appears in
three places: ControlSet001, ControlSet002, and CurrentControlSet.



>
> Somehow, I have to re-create those registry entries.
>

Yeah. We've come full circle. That's what Alex and Kelly's
suggestions were supposed to do.

FWIW I tried searching *.inf for \cryptsvc and came up blank.
I don't know where a separate installation for this component
would be documented if it is possible.

Hmm... how far did you get into the KB822798 procedures?
I just noticed that there is a regsvr32 cryptdlg.dll specified
in there. Notepad shows that that module at least knows
about the service. Perhaps it knows how to repair it too?
Maybe this was what Alex meant instead of what he typed?


Did you check out those dependencies I mentioned?
Now I'm wondering if I am misinterpreting what that meant.
E.g. read this:

>sc qDescription cryptsvc 1000
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: cryptsvc
DESCRIPTION : Provides three management services: Catalog Database Service,
which confirms the signatures of Windows files; Protected Root Service, which adds and removes
Trusted Root Certification Authority certificates from this computer; and Key Service, which helps
enroll this computer for certificates. If this service is stopped, these management services will not
function properly. If this service is disabled, any services that explicitly depend on it will fail to start.


It's the last sentence which is making me reconsider my interpretation
of "dependencies". E.g. now one might think that RPC and DCOM
should not be running. Are they? If they are running I would be even
more suspicious that the cryptsvc service is running *somehow*
but you just can't see it.


HTH

Robert
---