Windows Error Reporting Service error

[Archean]

Hello Gang

Okay ........ I had issue with loging in with my user account this morning, the PC would just hang up as soon as I entered user name/password.

After much consternation, I was able to track down the issue by booting into safe mode, and using admin account to review various logs etc.

I found out that for some unexplainable reasons 'Windows Error Reporting Service' was not starting, and got set to 'Manual'. As far as I remember it was set to Auto start. Hence, this meant that every subsequent service with dependency on it would hang up (i.e. DNS / DHCP / Workstation / NLA / NSI etc.).

I thought there may be have been some sort of Virus/Malware issue, but both AV scan and Malwarebytes scan came up clear (beside I couldn't find any untoward activity as well).

Anyway, my question is what may have caused the service configuration to change as such and cause this headache. Your valuable comments will be highly appreciable. Regards

 

[LookinAround]

I found out that for some unexplainable reasons 'Windows Error Reporting Service' was not starting, and got set to 'Manual'. As far as I remember it was set to Auto start. Hence, this meant that every subsequent service with dependency on it would hang up (i.e. DNS / DHCP / Workstation / NLA / NSI etc.).

Something's not right.....

I believe Error Reporting Service is set to Manual, by default. (I'm currently running XP where, in fact, where i keep it set to Disabled). Are you sure you're seeing other services dependent on it???

/* edit */
btw... Try using Serviwin to review your Windows services (IMO much better tool then the native Windows interface running services.msc
> Run it. Click View->Services
> Ctrl+F find ersvc
> Does it find ersvc listed anywhere as a dependency???

/* EDIT 2 */
Just booted my machine into Windows 7
> I see in Windows 7, the service name is slightly different WerSvc
> But, indeed, the service is set to Manual by default

 

[Archean]

@Hi LA, thanks for response.

I think I manually set it to start automatically, couple of months ago while checking something.

Anyway during this instance, while booting an critical event with ID # 7009 "A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect" was recorded.

Now even if the service is set to manual I am unsure why did it not respond to whatever was the asking it to connect/respond.

30 seconds later the same error was recorded again with same ID. All the services listed above (and some more) didn't start because they all depend on something else to start, e.g. Workstation service depends on the Network Store Interface Service, hence when it failed to start it got stuck as well. But funnily, every service start failure had one common message "A device attached to the system is not functioning" or (in case of dependency "The dependency service or group failed to start"; this doesn't bother me because it happened in certain sequence, hence if you fix the start point it will be fixed).

Now issue is, there is no 'dysfunctional' device listed in Device Manager, and in recent times, I only changed my monitor, went from 19" View Sonic to 23" (1080p) Samsung (to be noted: I am so lazy I didn't even bothered to install monitor drivers came with the box ).

Anyway, that shouldn't cause this IMHO.

WerSvc isn't listed as dependency for any service (which I believe is normal); because it is only needed under certain circumstances.

I don't know what caused it but after carefully re-examining everything again, I suspect it was the Ancillary Function Driver for Winsock service which probably started this chain of events citing "A device attached to the system is not functioning".

I do remember, in vista, there was an issue related to services like DHCP, TCP/IP NetBios etc. wouldn't start occasionally, I wonder if it is something which Win7 inherited from Vista?

 

[LookinAround]

I don't know that i can "connect the dots" for you for your specific circumstance but i'll mention the following bits of info (i don't know if some of which you may or may not already be aware of)

Service Startup Types
Services set to
> Automatic are both loaded and started at Windows startup
> Manual are only loaded at Windows startup. The service, itself, is started "On demand" which can be anytime later (or may sometimes at startup if that's when something "demands" it)
> Disabled (just fyi) these services aren't even loaded at all on startup
==> That's why disabling un-needed services can save start time as no time needed to load them
==> Also why you can only start a disabled service by first changing its startup type and rebooting (i.e. it can't be started at run time if it was never loaded at startup)

Those Service failed to start event messages
From what i can tell (this is my best guess) when Windows starts a service it also starts a timer. If timer expires before the service starts reports it's started successfully, Windows assumes that means the service is hung and writes the event log message. On occasion, if the machine is just very slow to start, those event messages get written simply because the service was slow to start (and the timer expired). I've seen cases where machine was just sooo slow (e.g. maybe i had debuggers and debug output streaming to disk) that times expire, event message gets written and THEN the service starts (chronologically)

So... that said, I'm not sure a service wouldn't start because Windows Error Reporting didn't start on your machine (since there is NO service dependency listed where any service is listed as dependant on Windows Error Reporting). Meaning (i don't think - just my guess) that any service should hang because Windows Err Report, itself, won't start. Remember, i have Werrsvc set to Disabled so it NEVER starts for my case on my machine. Services on my machine run but no Windows error reporting occurs

On the other hand, what you MAY be seeing is something has the whole system hung up so all the service startups are slow so each Windows timer for each service is expiring.

/* EDIT */
i should say (meant)
.. the service startups are slow (and/or not completing startup) so each Windows timer for each service is expiring.

 

[brucethetech]

Also why you can only start a disabled service by first changing its startup type and rebooting (i.e. it can't be started at run time if it was never loaded at startup)......

Sometimes....whether or not this is the case depends on the service. several services can be enabled and started "on the fly" (no reboot required) once they have been changed from disabled.

Most of the time you can find detailed information in the Event viewer when you get an error like that. click start run and type "eventvwr.msc" (without quotes)

 

[LookinAround]

Sometimes....whether or not this is the case depends on the service. several services can be enabled and started "on the fly" (no reboot required) once they have been changed from disabled. <snip>

Not from what i've seen...

And i just double checked MS Technet about Starting Services (which is dated April, 2010)

You can start only the services that have a start type of "Manual" or "Automatic". You cannot start the services with a start type of "Disabled". If a Start-Service command fails with the message "Cannot start service <service-name> on computer," use a Get-WmiObject command to find the start type of the service and, if necessary, use a Set-Service command to change the start type of the service.

/* EDIT */
Altho, just occured to me, it doesn't explicily state to reboot after changing start type.... Do you recall / can indicate a servcie where this is true? Might be able to double check /test it.. at least curious now

 

[brucethetech]

it says this but in laymans terms (6 words) it means.... "you can't start a disabled service" . they always make things sound more complicated with the way they word stuff.

Some of the services that i use regularly that are disable on startup are.....dhcp server, windows audio, event viewer, print spooler, pxe ......this list could go on forever, just about all of them

Services where this is not the case are the odd balls they are usually driven by or have dependencies on programs or processes that need to be running and these are the one that require reboots. Some database (sql) stuff works like this

 

[LookinAround]

OK. Thanks. Will check it out..

 

[brucethetech]

it says this but in laymans terms (6 words) it means.... "you can't start a disabled service" . they always make things sound more complicated with the way they word stuff.

Some of the services that i use regularly that are disable on startup are.....dhcp server, windows audio, event viewer, print spooler, pxe ......this list could go on forever, just about all of them

Services where this is not the case are the odd balls they are usually driven by or have dependencies on programs or processes that need to be running and these are the one that require reboots. Some database (sql) stuff works like this

fyi i have disabled these myself.

 

[LookinAround]

<snip>Some of the services that i use regularly that are disable on startup are.....dhcp server, windows audio, event viewer, print spooler, pxe ......this list could go on forever, just about all of them

Son-of-a-gun.

I just tested it. And you're right! :grinthumb


I thought i recalled (at least once upon a time, sometime back) a reboot was needed. But who knows at this point if my memory is right LOL

Most importantly, you're right. No reboot required now. Thanks. Learned something new myself

 

[Archean]

Ref: Post # 4, @LA

Thanks, as I said in my previous post, that the first service which seemed to fail was AFD for Winsock Service, with the error "A device attached to the system is not functioning"; and the service actually timed out, hence starting a chain of events where all the above mentioned services failed one by one.

Anyway, since then system seems to be working alright, no issues at all, although I am still concerned that 'which system device' was not functioning and why, and there are absolutely no clues whatsoever in event viewer. The only things which are usually attached with the system are:

i. USB KB
ii. USB Optical Mouse
iii. USB (Powered) Hub
iv. USB wireless Broadband Device

And all of them works perfectly.

In addition I do have few services set as Manual start but I don't believe it has anything to do with this. Anyway I guess unless it happens again (and I can get a hang of which device may be causing it) .... we'll have to wait. Thankyou for your valuable input guys. Best Regards