Cannot Start ICS Service

In attempting to start the Windows Firewall from Control Panel, I ended up with error, "Windows cannot start the Windows Firewall/Internet Connection Sharing (ICS) Service. Here's what I've done to troubleshoot the problem:

1. From Start>Run Services.msc....attempted to start the ICS service but got error, "Could not start the Windows Firewall/Internet Connection Sharing (ICS) Service on local computer. Error 1068: The dependency service or group failed to start ".

2. To figure out why...........from Start>Run Services.msc, I right clicked on ICS Service and clicked on the dependencies tab. Got, "Internal error - WBEM error features not available. Upgrade WMI to a newer build. "

3. Couldn't figure out how to upgrade WMI so checked ICS dependencies on another computer and found that ICS depends on Network Connections service and WMI (Windows Management Instrumentation).

4. From Start>Run Services.msc, discovered that Network Connections is running but WMI is not. When I tried to start it, I got, "Error 126, the specified module could not be found ".

5. I discovered that WMI depends on Event Log and Remote Procedure Call (RPC) but both of these are running.

6. I'm stumped on what to do next. Can anyone help?

 

Hi, dcfrazel.

Perhaps Windows XP's System File Checker (SFC) will help you resolve your issue.

• Have your Windows XP CD handy because you may be prompted to insert it into your CD drive during this process.
• Click Start > Run...
• Type [FONT= "Courier New"][SIZE= "3"]sfc /scannow[/SIZE][/FONT] in the "Open:" field.
• Click the OK button.

A "Windows File Protection" window will open and display its progress. If SFC runs successfully without any intervention from you, it will take approximately 15-25 minutes to complete. When SFC completes, the "Windows File Protection" window will simply disappear.

To see any changes that may have been made by SFC after it completes:

• Click Start > Run...
• Type [FONT= "Courier New"][SIZE= "3"]eventvwr.msc[/SIZE][/FONT] in the "Open:" field.
• Click the OK button.
• Click the "System" item on the left side of the "Event Viewer" window.

Any changes made by SFC will be displayed (in reverse order) as "Windows File Protection" events between Event ID 64016 (Windows File Protection started) and 64017 (Windows File Protection completed).

Double-click on an event (or right-click on the event and select "Properties ") to view details about the event. You can use the up/down arrow buttons on the right side of the event's "Properties" window to view details about adjacent events without having to close the event's "Properties" window.

If you want to copy event details to your clipboard (for pasting into Notepad or a forum message, for example), use the button immediately below the up/down arrow buttons in the event's "Properties" window.

 

Thanks, I'll give it a try.

 

OOOOOPS! SFC asks for my Windows XP Professional, Service Pack 2
CD. All I have is my XP Reinstallation DVD and an SP2 CD I ordered from Microsoft. Looks like I'll need to slipstream them............once I figure out how.

 

You might want to give the slipstream method described in this linked thread a try.

If you don't have two CD drives, I expect you could copy the contents of your SP2 CD to a folder on your hard drive and point Autostreamer to that folder.


BTW, if you want to reply to a message without quoting everything, use the "Post Reply" button in the lower left corner of the forum thread window (instead of the "Quote" button at the lower right).

 

If you decide to wait to slipstream and pursue other problem-solving methods first, Event Viewer might already contain additional details about the Error 126 and Error 1068 that might be helpful.

Instructions About How to Access and Use "Event Viewer ":

• Click Start.
• Right-click My Computer.
• Select "Manage" to open the "Computer Management" window.
  (Event Viewer will be displayed under the "System Tools" directory item.)
• Expand "Event Viewer" and then select "Application ", "Security ", and "System" to view the logs.
• Look for "error" events that occurred around the time your problem occurred. These events will be displayed as icons with either a white X on red background or a black exclamation point on yellow background. In the security section of Event Viewer, events of possible concern are ones that display a padlock icon instead of a key icon.
• Double-click on an individual event to open the "Event Properties" window which shows details about the event.
  • You can use the up/down arrow buttons in the "Event Properties" window to move your focus to other events in the list.
  • Use the button below the up/down arrows to copy the details for an event to your clipboard for pasting elsewhere.
  • Click on the "http://go.microsoft.com/fwlink/events.asp" link in the "Event Properties" window to view more information from Microsoft about the event.

Alternatively, Event Viewer may be accessed via Start > Run... > [FONT= "Courier New"][SIZE= "3"]eventvwr.msc[/SIZE][/FONT] as I described earlier.

EDIT:

Would be good to know which module was specified. I expect Event Viewer will contain that information.

 

Thanks again, I'll try event viewer first. Also, thanks for the "Post Reply" tip.

 

MVPS.org (Ramesh's site): Repairing and re-registering the WMI


EDIT: The last part of that page ( "Comprehensive rebuild method ") appears to apply to you (which also might require a slipstreamed CD).


BTW, you're very welcome. I also must compliment you on your thorough description of your problem and troubleshooting steps described in your first post above. Thank you!

 

Hello again:

After another unsuccessful attempt to start Windows Firewall, ICS, and WMI, I ran Event Viewer and looked at the three logs you mentioned. The Application and System Logs contained nothing pertinent to the problem(s), in fact there were no entries at all close to the time the problem(s) occured. The Security Log was entirely empty.

I guess my next step will be to build a slipstreamed CD and run SFC.....or
go directly to repairing and re-registering WMI as you suggested

I've looked at Ramesh's "Comprehensive Rebuild Method ". In it, he says
if I don't have a slipstreamed CD, I may "Point to the %Windir%\ServicePackFiles\i386 folder for a recent version of the system files required during WMI repair ". I've searched the problem computer for %Windir%\ServicePackFiles\i386 and recieved the error message, "C:\Windows\ServicePackFiles refers to a location that is not available ". I've found it on a computer that's running correctly but it doesn't seem to be present on the problem computer.

 

I expect the folder does indeed exist.

In Windows Explorer:

• Click Tools > Folder Options > View tab.
• Enable "Show hidden files and folders ".
• UNcheck "Hide protected operating system files (Recommended) ".
• Click the "Apply" button.
• Click the "Apply to All Folders" button.
• OK your way out and re-open Windows Explorer.

Now you should be able to navigate to the C:\Windows\ServicePackFiles\i386 folder and view its contents.

 

It might be helpful to look at the WMI registry key values on both the affected machine and a working machine. The location is;

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winmgmt

The ImagePath value, and the ServiceDll value under the Parameters key, being the ones of particular interest. Check that the named ServiceDll exists as well.

 

Hi Mailman:

The missing folder mystery is solved ..........terminal stupidity on my part.
The problem machine already has SP2 features integrated with WIN XP
(i.e. slipstreaming not necessary) so it don't have separate ServicePackFiles.

I ran System File Checker and here's what I got:

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64016
Date: 8/5/2007
Time: 10:23:34 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection file scan was started.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------------------
Event Type: Information
Event Source: SRService
Event Category: None
Event ID: 107
Date: 8/5/2007
Time: 10:33:51 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The System Restore service has been suspended because there is not enough disk space available on the drive \\?\Volume{75fde64d-fd32-11d9-8802-806d6172696f}\. System Restore will automatically resume service once at least 200 MB of free disk space is available on the system drive.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-----------------------------------------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/5/2007
Time: 10:52:40 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehcircl.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
------------------------------------------------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/5/2007
Time: 10:52:46 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehiepg.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/5/2007
Time: 10:52:47 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehituner.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 8/5/2007
Time: 10:52:49 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection scan found that the system file c:\windows\microsoft.net\framework\v1.0.3705\gacutil.exe has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 1.0.3705.0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-----------------------------------------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 8/5/2007
Time: 10:52:49 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The protected system file c:\windows\microsoft.net\framework\v1.0.3705\gacutil.exe could not be restored to its original, valid version. The file version of the bad file is 1.0.3705.0 The specific error code is 0x00000000 [The operation completed successfully.
].

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/5/2007
Time: 10:52:49 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\snchk.exe could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------------------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64017
Date: 8/5/2007
Time: 10:52:50 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection file scan completed successfully.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
---------------------------------------------
When I tried to get more information on most of these, I got the
following non-information:

We're sorry
There is no additional information about this issue in the Error and Event Log Messages or Knowledge Base databases at this time. You can use the links in the Support area to determine whether any additional information might be available elsewhere.


Thank you for searching on this message; your search helps us identify those areas for which we need to provide more information.


Currently there are no Microsoft Knowledge Base articles available for this specific error or event message. For information about other support options you can use to find answers online, see http://support.microsoft.com/default.aspx.
----------------------------------------------------

I guess my next step is the comprehensive WMI rebuild but I won't be able to get to it for a week or so. More later.

 

Hi noahdfear:

Thanks for the idea. I did as you suggested and found:

Image Path:
REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs

ServiceDll value under the Parameters key:
REG_EXPAND_SZ %SystemRoot%\system32\wbem\WMIsvc.dll

The values are the same on both machines.

 

I found a Microsoft KB article that contains examples very similar to your Windows File Protection events (but discusses Windows Media Center Edition 2005).

• Microsoft KB909059

Unfortunately, they do not clearly describe a solution (only a "workaround" which is unclear to me at present).

I'll do some more looking around later when I have a bit more time and see if I can come up with anything helpful.


Your SRService event, although apparently unrelated to Windows File Protection, seems to indicate your hard drive is very full. I don't know if this is an issue that should be addressed.

 

Hi again Mailman:

Thanks again for bearing with me. I'm beginning to believe we may run the OS gremlins to ground after all.

I don't understand the service event. According to mycomputer, my hard drive has a capacity of 232GB, of which only 15GB is used and 217GB is free.

 

Once more to Mailman:

My OS is indeed Windows XP Media Center Edition 2005 but the workaround is unclear to me too.

 

The workaround simply means that the sfc operation will be canceled if the installation files are not available and you cancel from both windows as described. You won't get the errors, but you won't get a completed sfc either. Canceling each prompt will actually skip said installation file and the error won't be logged. Clicking Yes to skipping the installation file logs the error. In short, the workaround doesn't help to get a successful file copy operation, it just works around the error being logged in the event the file can't be found.

 

Give this MS utility a shot.

WMI Diagnosis Utility

 

Hi noahdfear:

Thanks for clarifying the workaround and pointing me to the utility.
I'll give it a try.

 

Well Hallelujah............ran the comprehensive WMI repair procedure described on Ramesh's site, rebooted, and as if by magic, all's well again
(WMI runs, ICS runs, Windows Firewall is OK, etc.).

I'd like to keep the thread open for another few days though, just in case.

Many thanks to Mailman and Noahdfear.