Cryptographic Services failed while processing the OnIdentity() call

Anonymous

Since UPGARDING to Windows 8.1 on October 17, 2013 have been getting the following error

Log Name: Application

Source: Microsoft-Windows-CAPI2

Date: 11/09/13 10:19:48 AM

Event ID: 513

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: Michael-HP

Description:

Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Event Xml:

<Channel>Application</Channel>

<Computer>Michael-HP</Computer>

</System>

<Data>

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

</Data>

</EventData>

</Event>

Saw a similar thread Since upgrading Windows backup fails at http://answers.microsoft.com/en-us/windows/forum/windows8_1-system/since-upgrading-windows-backup-fails-cryptographic/aee23306-09df-4182-a549-da1084e20513 and followed the advice there and didn't have issues. There was a link to EventID 513 Capi2 error at http://social.technet.microsoft.com/Forums/windows/en-US/14abbc90-cab5-4fc6-953a-96c1929f9a7b/eventid-513-capi2-error?forum=itprovistasp which goes back to 2009 slightly before Windows 8.1. In any event this article (which I only glanced at) suggest checking 1409 files for errors.

Is this problem another of the newly introduced Windows 8.1 bugs or ishere a solution that can be applied? Thanks.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

Hope I can help to someone.

I had the same issue with the fresh Windows 8.1 Pro.

Couldn't find answer so had to debug Windows to find a solution.

"Microsoft Link-Layer Discovery Protocol" binary is \Windows\system32\DRIVERS\mslldp.sys

Its config registry key is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp

During backup a VSS process running under NETWORK_SERVICE account calls cryptcatsvc!CSystemWriter::AddLegacyDriverFiles(), which enumerates all the drivers records in Service Control Manager database and tries opening each one of them. , The function fails on MSLLDP record with "Access Denied" error.

Turned out it fails because MSLLDP driver's security permissions do not allow NETWORK_SERVICE to access the driver record.

The binary security descriptor for the record is located here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp\Security

It should be modified, I used SC.EXE and Sysinternals' ACCESSCHK.EXE to fix it.

The original security descriptor looked like below:

>accesschk.exe -c mslldp

mslldp

RW NT AUTHORITY\SYSTEM

RW BUILTIN\Administrators

RW S-1-5-32-549 <- these are server operators

R NT SERVICE\NlaSvc

No service account is allowed to access MSLLDP driver

The security descriptor for the drivers that were processed successfully looked this way:

>accesschk.exe -c mup

mup

RW NT AUTHORITY\SYSTEM

RW BUILTIN\Administrators

R NT AUTHORITY\INTERACTIVE

R NT AUTHORITY\SERVICE <- this gives access to services

How to add access rights for NT AUTHORITY\SERVICE to MSLLDP service:

Run: SC sdshow MSLLDP

You'll get something like below (SDDL language is documented on MSDN):

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Run: SC sdshow MUP

You'll get:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Take NT AUTHORITY\ SERVICE entry, which is (A;;CCLCSWLOCRRC;;;SU) and add it to the original MSLLDP security descriptor properly, right before the last S:(AU... group.
Apply the new security descriptor to MSLLDP service :

sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Check the result:

>accesschk.exe -c mslldp

mslldp

RW NT AUTHORITY\SYSTEM

RW BUILTIN\Administrators

RW S-1-5-32-549

R NT SERVICE\NlaSvc

R NT AUTHORITY\SERVICE

Run you backup app, the error is gone for my Home Server backup.

!!! Do not forget to use your security descriptor for MSLLDP driver since I guess there can be some rare cases when its different for your machine. Do not copy my SDDL descriptions, just in case. And backup the old descriptor just in case !!!

I don't know what reason MS had behind all this, probably some security concerns or probably this is just a bug. Definitely not a security problem in my environment.

Good luck!

0 comments

225 additional answers

Anonymous

2015-12-27T02:24:50+00:00

I re-sync'd using time.windows.com, but it made no difference - create recovery drive failed again, with the same Metadata staging failed error.

Please refer to

http://answers.microsoft.com/en-us/windows/forum/windows\_10-update/create-recovery-drive-does-not-work/608a6aa1-e809-4631-9b59-fbbe81760d6b?msgId=4fc43105-f68a-4c80-ae11-285f7b8e4ac2

where "create recovery drive failed" discussion is ongoing.
Was this answer helpful?

0 comments No comments
Anonymous

2016-02-05T14:45:21+00:00

When I run accesschk I get the following result:

R S-1-5-32-549

I'm not getting:

RW S-1-5-32-549

as in the "Answer" post.

Could that be the problem?
Was this answer helpful?

0 comments No comments
Anonymous

2016-02-05T15:38:35+00:00

Mine shows the same line for that particular item. I applied the fix in Fearless999's post and cleared up my problem.

My non-verbose output after applying the Fearless fix:

C:\WINDOWS\system32>accesschk.exe -c mslldp

Accesschk v6.0 - Reports effective permissions for securable objects

Copyright (C) 2006-2015 Mark Russinovich

Sysinternals - www.sysinternals.com

mslldp

RW NT AUTHORITY\SYSTEM

RW BUILTIN\Administrators

R S-1-5-32-549

R NT SERVICE\NlaSvc

R NT AUTHORITY\SERVICE
Was this answer helpful?

0 comments No comments
Anonymous

2016-02-17T15:32:24+00:00

OK...I have new Surface Pro 4 with Windows 10.0.10586. Both my Windows Restore Point & Macrium Image backup show this error each time they run. It does not seem to affect the backups.....I've tried them.....BUT once in awhile my system locks with the scheduled nightime Macrium imaging at this error in Event Viewer. I have to do a power button hard reset to get the system to come back. So, will to try this fix but some questions..........

Here are my command/results...........

C:>SC sdshow MSLLDP

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)

C:>SC sdshow MUP

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

.....and error...............

C:>accesschk.exe -c mslldp

'accesschk.exe' is not recognized as an internal or external command,

operable program or batch file.

I assumed accesschk was standard part of O/S ?

I found this link but fearful to install......and is needed or some mistake on my part in CMD prompt ?

https://technet.microsoft.com/en-us/sysinternals/accesschk.aspx

Lastly, with szz743's original post & subsequent Fearless96's modification can some one look at my SC readouts and provide me the EXACT string ?

Thx ! http://answers.microsoft.com/en-us/profile/e96ffef3-70f0-4149-bb68-49a5acbddc96
Was this answer helpful?

0 comments No comments