Cryptographic Services failed while processing the OnIdentity() call

Anonymous
2013-11-09T16:45:39+00:00

Since UPGARDING to Windows 8.1 on October 17, 2013 have been getting the following error

Log Name:      Application

Source:        Microsoft-Windows-CAPI2

Date:          11/09/13 10:19:48 AM

Event ID:      513

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      Michael-HP

Description:

Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />

    <EventID Qualifiers="0">513</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2013-11-09T15:19:48.537403000Z" />

    <EventRecordID>54879</EventRecordID>

    <Correlation />

    <Execution ProcessID="1164" ThreadID="4752" />

    <Channel>Application</Channel>

    <Computer>Michael-HP</Computer>

    <Security />

  </System>

  <EventData>

    <Data>

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

</Data>

  </EventData>

</Event>

Saw a similar thread Since upgrading Windows backup fails at http://answers.microsoft.com/en-us/windows/forum/windows8_1-system/since-upgrading-windows-backup-fails-cryptographic/aee23306-09df-4182-a549-da1084e20513 and followed the advice there and didn't have issues. There was a link to EventID 513 Capi2 error at http://social.technet.microsoft.com/Forums/windows/en-US/14abbc90-cab5-4fc6-953a-96c1929f9a7b/eventid-513-capi2-error?forum=itprovistasp which goes back to 2009 slightly before Windows 8.1. In any event this article (which I only glanced at) suggest checking 1409 files for errors.

Is this problem another of the newly introduced Windows 8.1 bugs or ishere a solution that can be applied? Thanks.

Windows for home | Previous Windows versions | Devices and drivers

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2014-01-23T22:34:19+00:00

Hope I can help to someone.

I had the same issue with the fresh Windows 8.1 Pro.

Couldn't find answer so had to debug Windows to find a solution.

"Microsoft Link-Layer Discovery Protocol" binary is \Windows\system32\DRIVERS\mslldp.sys

Its config registry key is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp

During backup a VSS process running under NETWORK_SERVICE account calls cryptcatsvc!CSystemWriter::AddLegacyDriverFiles(), which enumerates all the drivers records in Service Control Manager database and tries opening each one of them. , The function fails on MSLLDP record with "Access Denied" error.

Turned out it fails because MSLLDP driver's security permissions do not allow NETWORK_SERVICE to access the driver record.

The binary security descriptor for the record is located here:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsLldp\Security

It should be modified, I used SC.EXE and Sysinternals' ACCESSCHK.EXE to fix it.

The original security descriptor looked like below:

>accesschk.exe -c mslldp

mslldp

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  RW S-1-5-32-549       <- these are server operators

  R  NT SERVICE\NlaSvc

No service account is allowed to access MSLLDP driver

The security descriptor for the drivers that were processed successfully looked this way:

>accesschk.exe -c mup

mup

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  R  NT AUTHORITY\INTERACTIVE

  R  NT AUTHORITY\SERVICE  <- this gives access to services

How to add access rights for NT AUTHORITY\SERVICE to MSLLDP service:

  1. Run: SC sdshow MSLLDP

You'll get something like below (SDDL language is documented on MSDN):

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

  1. Run: SC sdshow MUP

You'll get:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

  1. Take NT AUTHORITY\ SERVICE entry, which is (A;;CCLCSWLOCRRC;;;SU) and add it to the original MSLLDP security descriptor properly, right before the last S:(AU... group.
  2. Apply the new security descriptor to MSLLDP service :

sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

  1. Check the result:

>accesschk.exe -c mslldp

mslldp

  RW NT AUTHORITY\SYSTEM

  RW BUILTIN\Administrators

  RW S-1-5-32-549

  R  NT SERVICE\NlaSvc

  R  NT AUTHORITY\SERVICE

  1. Run you backup app, the error is gone for my Home Server backup.

!!! Do not forget to use your security descriptor for MSLLDP driver since I guess there can be some rare cases when its different for your machine. Do not copy my SDDL descriptions, just in case. And backup the old descriptor just in case !!!

I don't know what reason MS had behind all this, probably some security concerns or probably this is just a bug. Definitely not a security problem in my environment.

Good luck!

Was this answer helpful?

200+ people found this answer helpful.
0 comments

225 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2016-07-13T00:25:05+00:00

    GiannaZK it is nice to know we are fellow travelers on the same road.  I finally managed to get resolution to my Windows Update problem but had completely forgotten about this backup problem.  Resolving the Windows Update issue temporarily obviated my need to use the backup mechanism to save all my settings.  Now back to the larger battle.   I do agree with you about the quality of the Windows 10 product. It certainly might seem that they throw a bunch of stuff in the coding hopper and hope is sticks to the wall. Unfortunately we get stuck with the results of such benevolence.   I have comments on two different forums related to the installation of the KB articles for the failing Windows updates that has a reasonably workable fix for the problems encountered there. I am a firm believer in understanding a problem before you dare to destroy the evidence. Most of my problems stemmed from the installation of an unsigned driver while under Windows 7 which were not allowed to install when doing the "upgrade" from Windows 7 to Windows 10.  The text of my update is repeated here for your convenience. I suspect that the problem with the backup also links back to a similar problem tied to an update that didn't get installed properly due to the failed security fixes in the Update packages from April/May/June.

    See below:

    I am really proud of myself. Back in late April I started having problems with Windows 10 Cumulative Updates not installing. The only message that would come out was "We are unable to install the update. Please wait while we back out the update and restore your computer" on a solid blue screen. I was really miffed. The solution recommended by the dunderheads at Microsoft was to install Windows 10 from scratch.I finally looked at the logs and backtracked the problem to o...ne driver that was being updated and it could not find the file to be updated because it belonged to a Smart Card Reader that I no longer have. The driver still had residual files on the computer and so the update of that driver was included in my update package. Going to Supporot.microsoft.com got me a lot of comments and useless or even dangerous suggestions from people on how to get around it. I even reported a couple people for trying to send us to fake sites that would upload malware to my computer. Anyway, last night I found a simple solution that resolved all those weeks of chasing the problem and looking for a programmatic way of resolving it. Finally I found a discussion of how to coax outdated (unsigned old generation) device drivers and force them to install so the files can be updated with the rest of the update package. It amounts to forcine your system into recovery mode and you go to the advanced tab which gets you to a list of settings during the recovery boot and one of them (#7) says "Allow installation of unsigned Third Party Drivers". When you do that you get a popup message advising you that it may be dangerous from a security viewpoint. I knew I didn't have to worry about that with this issue so i allowed it. Half an hour later and all the updates installed on my computer and I am back on track.  There is a procedure that involves using the Recovery Options of the Settings menu to do a troubleshoot/Advanced Options/Startup Settings  to select Option 7 which is "Disable Driver Signature Enforcement at the link below. 

    http://answers.microsoft.com/en-us/insider/forum/insider\_wintp-insider\_devices/how-do-i-disable-driver-signature-enforcement-win/a53ec7ca-bdd3-4f39-a3af-3bd92336d248

    WA

    Wade_M replied on January 17, 2013See post history 

    ReplyIn reply to AlamdarShah's post on January 9, 2013 

    Turn off the check.

    Hold the shift key while clicking on Restart

    Select Troubleshoot > Advanced Options > Startup Settings > Restart

    After Restart select option 7.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2016-07-12T23:57:42+00:00

    Got it.  Thank you to Bleeping Computer suggesting the answer might be there. 

      One step, one second.

    Success. 

    If my post doesn't translate well, and it looks like it might not, here is the page.

    http://justworks.ca/blog/fix-event-513-capi2-errors-during-windows-backup?rq=AddLegacyDriverFiles%3A%20Unable%20to%20back%20up%20image%20of%20binary%20Microsoft%20Link-Layer%20Discovery%20Protocol.

    During backup a VSS process running under NETWORK_SERVICE account calls cryptcatsvc!CSystemWriter::AddLegacyDriverFiles(), which enumerates all the drivers records in Service Control Manager database and tries opening each one of them. , The function fails on MSLLDP record with "Access Denied" error.

    Turned out it fails because MSLLDP driver's security permissions do not allow NETWORK_SERVICE to access the driver record.

    What causes this to have incorrect permissions in the first place is unclear, but a fairly simple fix exists.  We've tested this on several systems without issue, but your mileage may vary.

    It can be fixed by correcting the Security Description on the MSLLDP service, using the built-in command line utility SC.exe

    Open an Administrative Command Prompt (NOT PowerShell) and execute the following.  This must all be one long command without carriage returns

    sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

    You should receive a successful result of

    [SC] SetServiceObjectSecurity SUCCESS

    If so, the problem is resolved, and there's no reboot required.  The next backup should complete successfully.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2016-07-12T22:40:18+00:00

    Michelle2006,

    Sorry to be asking a question instead of providing an answer, but my errors are in line with Stancey's below you.

    I don't know what the OneDrive error is - I disabled all apps, including OD, with PowerShell.

    What error do you get with the recovery drive?  I had to download/install Win10 around four times (+/-), because each one was corrupted in different ways.  After that, I had other issues.  Many. Other.  Issues.

    Please ask your question in the body so we don't have to look at prior posts to figure out what you are experiencing.

    It seems that not all forums are open - searchable - online.  I spent time at Bleeping... and I've gotten some very attentive and fast answers (as well as long delayed ones) at Ten F. 

    Check out TenForums - Ten Forums along with some suggestions from an excellent tech at Firefox:  

    A few observations from this ordeal: 

    MS offers "Go Back to an Earlier Build" as a restore option.  It is not, though - you cannot complete the steps.  Even though they don't explicitly say it, it's much quicker/easier to do Recovery/Restore functions in Safe Mode.  I was on the phone w/Microsoft for monumental marathon troubleshooting sessions a couple of times - one was in my fourth reinstall, which became a second upgrade.

    There are some good people and some terrible techs.  I went to the MS store.  The person was more interested in selling me the service package than fixing my computer.  I left the store in the same position in which I arrived.

    I wasted tremendous time and I learned a great deal on my own - hoping that I won't ever go through this **** again.  Maybe I can help some people. 

    Many answers online didn't work - too many.  I repeated steps two and three times.   The results didn't change. 

    Online responses are both contrary to and in direct contradiction to MS' instructions, if they even offer them.

      It's a **** SHOOT.  People make concrete suggestions without factoring in variables.   

    There are more questions than answers, and issues persist for YEARS without anybody caring to solve it.  My HP online program (Solution Center) stopped working after a November 2015 update - Win7.   The clean installation took care of it.  HP and MS are very similar in this way - hundreds of people have the same issues and ask questions a hundred different ways.  MS in writes back without ever saying anything of value.  Often, people ask questions that are impossible to decipher, but other people are clear.  Either way, instead of asking what computer you are using (and if you cleaned out your cache) I think it's better to offer something useful.

      Leave them with more than they came in with.

    If you want a fix, persist, persevere, demand.  Or go to Open Source.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2016-07-12T22:07:45+00:00

    This thread goes back to 2013.

    Stancey and I are in the same position - down to clicking on the link. 

    The May 14 (when it hits my computer) Cumulative Updates left me with twenty straight days of BSODs.

    The overlord of CUs, who hosts a forum for "Tragic Tuesdays"  listening to consumers offer their myriad stories of what broke as a result of the CUs - and his team - requested CBS logs and DMP files and I ran every kind of scan, test, and command imaginable, in addition to my own half a million troubleshooting steps/programs/scans. 

    They couldn't determine what was causing it specifically.  After twenty days.

    After 45 or so shut downs, and no other option,  I decided to reinstall Win10.  That was June 19.

    I had minor error messages from January to June on every usage of Backup & Restore, but always managed to create backups.  (I thought I was.) Five days a week plus a weekly image.

    I'm still trying to restore my computer / and struggling unbelievably with my Outlook files.

    Is THIS the reason?  Did anybody/everybody else run into major problems with corrupted data files & images?

    All that devotion to a daily routine of keeping my computer healthy, so that  when I really needed my backup files,  it would take moments to restore - for NOTHING?

    Reading Event Viewer can be quite disturbing with the amount of RED in the logs.

    Win10 is hands down, the worst OS to ever come out of company.

    I am appalled.  More than that, I cannot believe how much time I've devoted to climbing out of a hole so deep that I can't see over the side, yet.

    Downloaded AOMEI (over Macrium and Acronis) but I've been struggling with all sorts of errors each time I try to save a folder/file or create an image.  I can't believe errors are ongoing.  Something new EVERY day. 

    If I wasn't running a business, or trying to, I would have drowned the computer a couple of weeks ago.

    This is no way to service millions of people around the world using these low-grade, poorly written and executed

    programs on an OS that is far from ready for any regional, let alone broader launch.

    I could spit.

      I recommend some of the excellent people at TenForums - http://www.tenforums.com/

      People - please check your privacy settings to make sure they don't revert.

                                 Mine have.  Several times.  (More than a couple - D.)

    Stancey - I am curious also - was this before or after the "fix?"  You are I are on parallel tracks.

    Good luck to us all!

    Was this answer helpful?

    0 comments