Cryptographic Services failed while processing the OnIdentity() call

I used Fearless96's version from page 3, and it eliminated the event viewer errors quite nicely.  I would recommend using it rather than the original version, as it adds a much more restricted permission which is entirely sufficient to the purpose.

Thanks to szz743 and Fearless96 both for their hard work and sharing it with us.

THANK YOU!! This, plus a second modification resolved backup problems after upgrading to Windows 10 from Windows 7 and Windows 8.1.  I run Windows via bootcamp on a Mac. I backup to another Windows PC on the network using the built in MS backup utility. First, after upgrading the Mac from Win 7 to Win 10, I was getting the following:

A shadow copy could not be created. Please check the 'VSS' and 'SPP' application event logs for more information. Error 0x81000019. Also got event 513 errors.

I got a similar error ( shadow copy cannot be created) using a different USB connected disk, AND in Macrium Reflect.

Fix: The above modification first (which I didn't change from above), then second, disabling AppleHFS on startup:

http://www.edandersen.com/category/apple/

Later, after upgrading the "NAS" as I call it, an HP microserver, which is my backup machine, I got:

The validation information class requested was invalid. Error code 0x80070544

This is telling us the credentials are bad as far as I can tell.

I reconfigured the credentials by using "change settings" in Backup and Restore (Windows 7).  This fixed the inability to get to the backup volume but part of the above shadow copy issue returned!

I checked Autoruns, Apple HFS was still disabled.

Fix: Re-run the above method, even though  R  NT AUTHORITY\SERVICE shows at >accesschk.exe -c mslldp

I'm guessing that the upgrades overwrite previous credentials somewhere? After the Windows 10 upgrade, I had to log in with a password to my Mac installation, where previously I had removed that annoyance. I also noticed that the upgrade overwrote my theme.

Hope that helps someone!

Sorry people, it is nonsense to use a Windows 7 program in Windows 8 or 10.

Now there is a new backup program!!!

Hope I can help to someone.

I had the same issue with the fresh Windows 8.1 Pro.

Couldn't find answer so had to debug Windows to find a solution.

"Microsoft Link-Layer Discovery Protocol" binary is \Windows\system32\DRIVERS\mslldp.sys

Its config registry key is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp

During backup a VSS process running under NETWORK_SERVICE account calls cryptcatsvc!CSystemWriter::AddLegacyDriverFiles(), which enumerates all the drivers records in Service Control Manager database and tries opening each one of them. , The function fails on MSLLDP record with "Access Denied" error.

Turned out it fails because MSLLDP driver's security permissions do not allow NETWORK_SERVICE to access the driver record.

The binary security descriptor for the record is located here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp\Security

It should be modified, I used SC.EXE and Sysinternals' ACCESSCHK.EXE to fix it.

The original security descriptor looked like below:

>accesschk.exe -c mslldp

mslldp

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  RW S-1-5-32-549       <- these are server operators

  R  NT SERVICE\NlaSvc

No service account is allowed to access MSLLDP driver

The security descriptor for the drivers that were processed successfully looked this way:

>accesschk.exe -c mup

mup

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  R  NT AUTHORITY\INTERACTIVE

  R  NT AUTHORITY\SERVICE  <- this gives access to services

How to add access rights for NT AUTHORITY\SERVICE to MSLLDP service:

1. Run: SC sdshow MSLLDP

You'll get something like below (SDDL language is documented on MSDN):

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

2. Run: SC sdshow MUP

You'll get:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

3. Take NT AUTHORITY\ SERVICE entry, which is (A;;CCLCSWLOCRRC;;;SU) and add it to the original MSLLDP security descriptor properly, right before the last S:(AU... group.
4. Apply the new security descriptor to MSLLDP service :

sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

5. Check the result:

>accesschk.exe -c mslldp

mslldp

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  RW S-1-5-32-549

  R  NT SERVICE\NlaSvc

  R  NT AUTHORITY\SERVICE

6. Run you backup app, the error is gone for my Home Server backup.

!!! Do not forget to use your security descriptor for MSLLDP driver since I guess there can be some rare cases when its different for your machine. Do not copy my SDDL descriptions, just in case. And backup the old descriptor just in case !!!

I don't know what reason MS had behind all this, probably some security concerns or probably this is just a bug. Definitely not a security problem in my environment.

Good luck!

 

szz743,

When I run SC sdshow MSLLDP, the result is

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)

There is no " last S:(AU... group" as in your example. 

Please advise where I should insert "(A;;CCLCSWLOCRRC;;;SU)" to construct the correct sc sdset MSLLDP command.

Best regards,

D. Smith