Cryptographic Services failed while processing the OnIdentity() call

Anonymous
2013-11-09T16:45:39+00:00

Since UPGARDING to Windows 8.1 on October 17, 2013 have been getting the following error

Log Name:      Application

Source:        Microsoft-Windows-CAPI2

Date:          11/09/13 10:19:48 AM

Event ID:      513

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      Michael-HP

Description:

Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />

    <EventID Qualifiers="0">513</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2013-11-09T15:19:48.537403000Z" />

    <EventRecordID>54879</EventRecordID>

    <Correlation />

    <Execution ProcessID="1164" ThreadID="4752" />

    <Channel>Application</Channel>

    <Computer>Michael-HP</Computer>

    <Security />

  </System>

  <EventData>

    <Data>

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

</Data>

  </EventData>

</Event>

Saw a similar thread Since upgrading Windows backup fails at http://answers.microsoft.com/en-us/windows/forum/windows8_1-system/since-upgrading-windows-backup-fails-cryptographic/aee23306-09df-4182-a549-da1084e20513 and followed the advice there and didn't have issues. There was a link to EventID 513 Capi2 error at http://social.technet.microsoft.com/Forums/windows/en-US/14abbc90-cab5-4fc6-953a-96c1929f9a7b/eventid-513-capi2-error?forum=itprovistasp which goes back to 2009 slightly before Windows 8.1. In any event this article (which I only glanced at) suggest checking 1409 files for errors.

Is this problem another of the newly introduced Windows 8.1 bugs or ishere a solution that can be applied? Thanks.

Windows for home | Previous Windows versions | Devices and drivers

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2014-01-23T22:34:19+00:00

Hope I can help to someone.

I had the same issue with the fresh Windows 8.1 Pro.

Couldn't find answer so had to debug Windows to find a solution.

"Microsoft Link-Layer Discovery Protocol" binary is \Windows\system32\DRIVERS\mslldp.sys

Its config registry key is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp

During backup a VSS process running under NETWORK_SERVICE account calls cryptcatsvc!CSystemWriter::AddLegacyDriverFiles(), which enumerates all the drivers records in Service Control Manager database and tries opening each one of them. , The function fails on MSLLDP record with "Access Denied" error.

Turned out it fails because MSLLDP driver's security permissions do not allow NETWORK_SERVICE to access the driver record.

The binary security descriptor for the record is located here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp\Security

It should be modified, I used SC.EXE and Sysinternals' ACCESSCHK.EXE to fix it.

The original security descriptor looked like below:

>accesschk.exe -c mslldp

mslldp

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  RW S-1-5-32-549       <- these are server operators

  R  NT SERVICE\NlaSvc

No service account is allowed to access MSLLDP driver

The security descriptor for the drivers that were processed successfully looked this way:

>accesschk.exe -c mup

mup

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  R  NT AUTHORITY\INTERACTIVE

  R  NT AUTHORITY\SERVICE  <- this gives access to services

How to add access rights for NT AUTHORITY\SERVICE to MSLLDP service:

  1. Run: SC sdshow MSLLDP

You'll get something like below (SDDL language is documented on MSDN):

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

  1. Run: SC sdshow MUP

You'll get:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

  1. Take NT AUTHORITY\ SERVICE entry, which is (A;;CCLCSWLOCRRC;;;SU) and add it to the original MSLLDP security descriptor properly, right before the last S:(AU... group.
  2. Apply the new security descriptor to MSLLDP service :

sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

  1. Check the result:

>accesschk.exe -c mslldp

mslldp

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  RW S-1-5-32-549

  R  NT SERVICE\NlaSvc

  R  NT AUTHORITY\SERVICE

  1. Run you backup app, the error is gone for my Home Server backup.

!!! Do not forget to use your security descriptor for MSLLDP driver since I guess there can be some rare cases when its different for your machine. Do not copy my SDDL descriptions, just in case. And backup the old descriptor just in case !!!

I don't know what reason MS had behind all this, probably some security concerns or probably this is just a bug. Definitely not a security problem in my environment.

Good luck!

Was this answer helpful?

200+ people found this answer helpful.
0 comments

225 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2016-02-18T02:53:56+00:00

    Been following this thread for awhile:   

    (again surprised Microsoft hasn't posted a fixit)

    Here is what I understand (credit goes to everyone in this thread!)

    This was applied on Windows 64 Bit 1511 10586.104

    You can check this by using the command "Winver" on any command prompt

    cmd.exe window   ->   1511 Build 10586.104

    Note: Run a full backup - just in case so you have a something to restore from

    Note: If you read up on SDDL - make sure you review that there are differences for services in

              access compared to users - Microsoft has some good references.

    Note: you can run the accesschk before and after to compare as well (downloaded from TechNet)

    using:  accesschk.exe -v -c mslldp

    Here are the instructions to getting and setting up accesschk  (credit to thekochs_580)

    You can get Accesschk from Microsoft TechNet.

    https://technet.microsoft.com/en-us/sysinternals/accesschk.aspx

    It comes in small ZIP file.   Once you download there is no "install".

    Just copy the EXE within ZIP file and you must put it in your >Windows>System32 directory

    Do a "search" on CMD and right click and "Run As Administrator".

    This is what is referred to as "elevated" command prompt.

    Note: you can run the accesschk before and after to compare as well (downloaded from TechNet)

    using:  accesschk.exe -v -c mslldp

    When completed with Step 3 below and running accesschk, you should see the Updated

    block output containing the CryptSvc addition (shown below).

    R  NT SERVICE\CryptSvc

    SERVICE_QUERY_CONFIG

    Your original accesschk mslldp block may look like this

    mslldp

    Medium Mandatory Level (Default) [No-Write-Up]

    RW NT AUTHORITY\SYSTEM

    SERVICE_ALL_ACCESS

    RW BUILTIN\Administrators

    SERVICE_QUERY_STATUS

    SERVICE_QUERY_CONFIG

    SERVICE_CHANGE_CONFIG

    SERVICE_INTERROGATE

    SERVICE_ENUMERATE_DEPENDENTS

    SERVICE_PAUSE_CONTINUE

    SERVICE_START

    SERVICE_USER_DEFINED_CONTROL

    DELETE

    READ_CONTROL

    WRITE_DAC

    WRITE_OWNER

    R  S-1-5-32-549

    SERVICE_QUERY_STATUS

    SERVICE_QUERY_CONFIG

    SERVICE_INTERROGATE

    SERVICE_ENUMERATE_DEPENDENTS

    SERVICE_PAUSE_CONTINUE

    SERVICE_START

    SERVICE_STOP

    SERVICE_USER_DEFINED_CONTROL

    READ_CONTROL

    R  NT SERVICE\NlaSvc

    SERVICE_QUERY_STATUS

    SERVICE_START

    SERVICE_STOP

    Steps:

    NOTE: When you run the commands there are no line breaks!    It must be all 1 line!!

    1. Run: SC sdshow MSLLDP

    NOTE: When you run the commands there are no line breaks!    It must be all 1 line!!

    * If you get an error like - device not ready - check to make sure you have no line breaks

    **one method to do this isPut the command in Notepad first. Click the "Format" menu and uncheck "Word Wrap".

    You'll receive SDDL like this:

    D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)

    2. Apply the extra permission from the string (shown below)

    (A;;CC;;;S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459)

    3. Use the following to set the string to the original plus the added permission

    NOTE: When you run the commands there are no line breaks!    It must be all 1 line!!

    * If you get an error like - device not ready - check to make sure you have no line breaks

    **one method to do this isPut the command in Notepad first. Click the "Format" menu and uncheck "Word Wrap".

    sc sdset MSLLDP

    D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CC;;;S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459)

    4.  When you run you'll see the result (from my own output running this successfully)

    [SC] SetServiceObjectSecurity SUCCESS

    5.  Now you can run:   accesschk.exe -v -c mslldp

         Check the result (CryptSvc is at the bottom):

    Enjoy the new update!

    Accesschk v6.0 - Reports effective permissions for securable objects

    Copyright (C) 2006-2015 Mark Russinovich

    Sysinternals - www.sysinternals.com

    mslldp

      Medium Mandatory Level (Default) [No-Write-Up]

      RW NT AUTHORITY\SYSTEM

            SERVICE_ALL_ACCESS

      RW BUILTIN\Administrators

            SERVICE_QUERY_STATUS

            SERVICE_QUERY_CONFIG

            SERVICE_CHANGE_CONFIG

            SERVICE_INTERROGATE

            SERVICE_ENUMERATE_DEPENDENTS

            SERVICE_PAUSE_CONTINUE

            SERVICE_START

            SERVICE_USER_DEFINED_CONTROL

            DELETE

            READ_CONTROL

            WRITE_DAC

            WRITE_OWNER

      R  S-1-5-32-549

            SERVICE_QUERY_STATUS

            SERVICE_QUERY_CONFIG

            SERVICE_INTERROGATE

            SERVICE_ENUMERATE_DEPENDENTS

            SERVICE_PAUSE_CONTINUE

            SERVICE_START

            SERVICE_STOP

            SERVICE_USER_DEFINED_CONTROL

            READ_CONTROL

      R  NT SERVICE\NlaSvc

            SERVICE_QUERY_STATUS

            SERVICE_START

            SERVICE_STOP

    R  NT SERVICE\CryptSvc

    SERVICE_QUERY_CONFIG

    C:\WINDOWS\system32>

    6.   NOTE:  It has been reported that after a subsequent new build release this fix may become reverted / Overlaid back again

    ---   Advised to confirm the access after a new release build is applied

    to confirm the build didn't overlay it.

    Use the accesschk.exe method to check this and re-run the fix

    <--  End of Steps -->

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-02-18T02:35:38+00:00

    I think if you read the post from Fearless96, he found that, in order to avoid the CAPI2 error, you only needed to allow the CryptSvc.  That longer string is the SDDL for that service.  The shorter string gives permissions for a bunch of other services.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-02-18T02:30:43+00:00

    See my edited answer.  I did not realize that you were adding just the crypt service as per Fearless post.  That should work.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-02-18T02:23:45+00:00

    I added the "D:" back in....that was typo....thanks for the catch.

    Re-reading the entire thread my "sc sdset" seems to be same as post by...........

    *MarkWaukesha* replied on

    I've been carefully following the thread and it seems the Windows 10 64 bit fix is the following:

    sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CC;;;S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459)

    So far as your addition, you are adding a lot more to your MSLLDP than I did

    Also, I don't follow your comment from your post.....I listed above.

    What am I adding extra ?

    I thought I'm basically taking the output listing of my C:&gt;sc sdshow MSLLD & adding the **(A;;CC;;;S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459)**string to the end of that string.

    Was this answer helpful?

    0 comments