Service or Driver failed. How to fix that?

toughstuff

Distinguished
May 16, 2007
5
0
18,510
Guys, I was playing with tweaking services on my rig and suddenly I got it screwed up. I know I should do it more accurately, but what's done is done. Now nothing helps me and when users start their computers they get the error message At least one service or driver failed during system startup.
Now that is a complete muddle here with my network. Some applications work, some are closing right when I start them, while some crashing all the time and showing zillion of error messages. Any help or suggestion will be appreciated!
 

OvalCorner

Distinguished
Apr 25, 2007
10
0
18,510
First of all, I recommend you look at your Event Viewer and check what you have listed in System log there. Here's how can you get there. Click Start > Control Panel > Administrative Tools > Event Viewer. Locate the System item in the left panel in Event Viewer snap-in window and click on it to open it. If you need an additional information on how to work with the Event Viewer snap-in, refer to this article.
Because you've got an error message when you started the system, you need to find the entry that corresponds to that event. Try sorting the log by clicking on the Source column. Find the Application Popup entry within the log. And see what it says.
If you can't find it this way, try locating your last start by finding the eventlog entry in the Source column and going up starting from this entry. Stepping up entry by entry you will soon find the Application Popup.
Now when you located it, double click on it to open it's properties. The dialog box that will be opened will contain the message that you were given when you booted the system up. Now step forward using the up/down buttons on this box and try to locate the faulty service.
 

toughstuff

Distinguished
May 16, 2007
5
0
18,510
Thanks! Yeah, I did it myself previously but there's a lot of messages and I didn't manage to find it. Currently I found a message that contains an info "The xxx service was unable to log on as xxx\xxx". I got it. It must be I was trying to tune services for our users to allow running them for one users and forbid for others. The bad thing is that I already have no clue how do I fix it because I did what I should not. I changed a lot of them in a snap and now I cannot recall what I did and where. Badluck! Is it posslible to fix it somehow. I need my client computers to be fixed as quickly as possible as users obviously can't do their work.
 

OvalCorner

Distinguished
Apr 25, 2007
10
0
18,510
You can get service account name using the StartName property from the Win32_Service class.
See here for the details. Here's how you can get it work.
You can enumerate services running on the remote computer using WMI scripting. Here's how you can list all the services and display their names and account names they are running under using VBScript WMI scripting:
[code:1:682d4a6b1d]strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Service",,48)
For Each objItem in colItems
Wscript.Echo "Service Name: " & objItem.Name & VBNewLine & "State: " & objItem.StartName
Next[/code:1:682d4a6b1d]

You can list all the services running under LocalSystem account using scripting similar to
[code:1:682d4a6b1d]strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
("Select * from Win32_Service Where StartName ='LocalSystem'")
For Each objService in colListOfServices
Wscript.Echo objService.Name
Next[/code:1:682d4a6b1d]
Then you can find those services that run under different accounts by listing all the services and substracting those that are running under LocalSystem account from there.
 

toughstuff

Distinguished
May 16, 2007
5
0
18,510
Thanks that's much better. But still very complex for me… Is it possible to list all the info and print in all at once?
 

OvalCorner

Distinguished
Apr 25, 2007
10
0
18,510
Locally you can just run the service.msc snap-in and sort the table by Log On As column. This will list all the account name info that these services are using to run under.
 

toughstuff

Distinguished
May 16, 2007
5
0
18,510
But then I will be needed to go by all computers in the net and fix it one by one… I it possible to query the info remotely?
 

OvalCorner

Distinguished
Apr 25, 2007
10
0
18,510
Yes, you can use the WMI scripting again this time using the Write method. That will look something like that:
[code:1:a67ddde089]Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = objFSO.OpenTextFile("C:\servicelst.csv", 8, True)
objLogFile.Write ("System Name,Service Name, " & "Display Name, " & "Executable Path Name," & "Start Mode, Account Name ")
objLogFile.Writeline
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery ("SELECT * FROM Win32_Service")
For Each objService in colListOfServices
objLogFile.Write(objService.SystemName) & ","
objLogFile.Write(objService.Name) & ","
objLogFile.Write(objService.DisplayName) & ","
objLogFile.Write(objService.PathName) & ","
objLogFile.Write(objService.StartMode) & ","
objLogFile.Write(objService.StartName) & ","
objLogFile.Writeline
Next
objLogFile.Close[/code:1:a67ddde089]

But as far as I remember, Scriptlogic has a tool that can do such query for all computers at once
 

EmptySpacez

Distinguished
Apr 26, 2007
5
0
18,520
We are using Security Explorer from Scriptlogic, that's what you probably are talking about. I use it for periodically observing the domain security. It has a built-in search feature that looks like a Find Users dialog in Active Directory Users & Computers snap-in. With Security Explorer I usually query the whole domain for service security by retrieving the information about the accounts that are used to run these service. Sometime it happens something breaks, some user accounts require some services for the software to run under specific account. That is one of the best things I like in Security Explorer. And it's also possible to get the ACEs set for the queried services. I agree, from my experience, it looks like it can help here
 

OvalCorner

Distinguished
Apr 25, 2007
10
0
18,510
It's possible to get the service access lists? That's interesting. I usually use just sc sdshow SERVICENAME. But obviously it's not very handy approach because service control tool returns the ACEs in a raw view. So I usually pipe the output to the file, and then sort it in Excel. If it's possible to get the info in the way we do with standard find window it makes sense to try it here, I agree.
 

toughstuff

Distinguished
May 16, 2007
5
0
18,510
Thanks tried the sc & scripts. It works but I was unlucky to collect info from all machines and get the formatted result. Thank you guys! I finally got the Security Explorer you suggested and looks like it does what you were talking about. I found the services where I changed the logon account name. What I liked there is that I was able to get the information from the clients running it from server.
Thanks once again, you are my heroes guys!