System Event Notification Service, App-V and logon failure

Located a very nice KB-article and wanted to be able to locate it again – hopefully it becomes more searchable using key words involved! Thanks to Justin Zarb for the find – personally, this was missed in a spreadsheet of articles that should have been on top of my head.

You may experience the following issues after you log on to a computer that is running Windows 7 or Windows Server 2008 R2:

  • Your desktop does not load. You only see a blue or black background image.
  • Windows Explorer does not run, and you cannot access your data.
  • You receive the following message in a notification balloon:

Failed to connect to a windows service. Windows could not connect to the System Event Notification Service (SENS). This problem prevents limited users from logging on to the system. As an administrative user, you can review the System Event Log for details about why the service didn’t respond.

When the issue occurs, a service host that contains the following services crashes on system startup:

  • Certificate Propagation
  • Extensible Authentication Protocol
  • Group Policy Client
  • IKE and AuthIP IPsec Keying Modules
  • IP Helper
  • Server
  • Multimedia Class Scheduler
  • User Profile Service
  • Task Scheduler
  • System Event Notification Service
  • Shell Hardware Detection
  • Themes
  • Windows Management Instrumentation

You may experience this issue after you install certain applications, for example Microsoft Application Virtualization Client ( App-V ), on the computer.
Note You have to restart the computer one or more times to recover from this issue.

See this article; http://support.microsoft.com/kb/2590550

Sequence Windows Live Messenger 5.1

When you sequence Windows Live Messenger 5.1 and run the application on a Windows 7 system – the below error message can present itself in the Application log;

Activation context generation failed for “Q:\Windows Live Messenger\VFS\CSIDL_PROGRAM_FILES\Messenger\Msmsgs.exe”. Dependent Assembly Microsoft.Windows.Networking.RtcDll,language=”*”,
processorArchitecture=”X86“,
publicKeyToken=”6595b64144ccf1df“,type=”win32“,version=”5.2.1004.3” could not be found. Please use sxstrace.exe for detailed diagnosis.

The user only receives the below error message;

The client could not launch C:\Program Files (x86)\Messenger\Msmsgs.exe (rc 1F701939-000036B1

Reviewing whats captured – the below can be found under CSIDL_WINDOWS\WinSXS. If you compare the contents of the folder – you can spot a similar naming for one of the folders and the missing assembly.

image

Copy the DLL from the folder named RtcDLL to the working directory of Messenger (VFS\CSIDL_PROGRAM_FILES\Messenger)

Create a file named msmgs.exe.manifest in the working directory with the below content;

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
<dependency>
<dependentAssembly>
<assemblyIdentity type="<strong>win32</strong>" name="<strong>Microsoft.Windows.Networking.RtcDll</strong>" version="<strong>5.2.1004.3</strong>" processorArchitecture="<strong>x86</strong>"></assemblyIdentity>
</dependentAssembly>
</dependency>
</assembly>

Create a second manifest named Microsoft.Windows.Networking.RtcDll.manifest (placed in the msmgs.exe working directory)

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<noInheritable />
<assemblyIdentity type="<strong>win32</strong>" name="<strong>Microsoft.Windows.Networking.RtcDll</strong>" publicKeyToken="<strong>6595b64144ccf1df</strong>" version="<strong>5.2.1004.3</strong>" processorArchitecture="<strong>x86</strong>" />
<file name="<strong>rtcdll.dll</strong>" />
</assembly>

Anything marked in bold is things that needs to correspond to the original error message or a file we want to reference.

Automatically generate name using ConfigMgr / MDT

Using ConfigMgr with the MDT integration to deploy computers is quite common these days. It provides a certain level of automation that is quite easy to follow, however a topic that quite often comes up is how to automatically name computers during the deployment of a new client.

There are several ways – prompt the user for a name;
http://henkhoogendoorn.blogspot.com/2011/10/how-to-assign-computername-before-os.html

Use the serial number of the client to automatically generate a name;
http://www.2way.net.au/blog/post/2011/01/21/OSD-Task-Sequence-Set-Computer-Name-to-Serial-Number.aspx

Use a database to have a sequence number and prefix generate a name;
http://www.deployvista.com/Blog/JohanArwidmark/tabid/78/EntryID/120/language/sv-SE/Default.aspx

This was quite heavily developed using several other metrics (type, location etc etc)http://runebelune.blogspot.com/2011/03/generate-computer-names-in-mdt-2010sccm_30.html

SQL Management Studio 2008 R2 Express – 1603

If you are attempting to install the SQL Management Studio 2008 R2 Express for x64 on a Windows 7 system you might have quite a few installation errors. One that was consistently bugging me was a generic 1603 from the trin_aide_cpu32_1.log. This indicated a failure for the VSTA modules. The failure from the above log looked like this;

11/09/11 13:50:08 DDSet_Error: The Commandline ‘”C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe” -PipelineRoot:”C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline\.” -Rebuild -Silent’ returned non-zero value: -1073741819.

Running the command from an elevated command-prompt revealed this;

C:\Windows\system32>”C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe” -Pip
elineRoot:”C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline\.”
-Rebuild -Silent
Finished updating cache

For some reason – the above was considered a failure (due to its exit code) and stopped the installation from progressing. Reading a thread in the forums regarding a similar error (but not identical) one possibility that presented itself was to remove the custom action all together. 

Reviewing the folder x64\setup – you can see the below content;

image

Trin_aide.msi is the installation-file in question and running it manually does not resolve the issue. Use InstEd to open the file and verify the actions in the table InstallExecuteSequence – normally it’s a good idea to sort that specific table after the sequence column – as it gives you an overview in what order the actions take place.

The following steps relate to our problem;

image

image

You can see the sequence number to the right. The yellow color indicates that the row was removed within an applied MST-file. InstEd (as opposed to Orca) allows you to create a new MST and will show the differences between additions and removals.

Installing the trin_aide.msi with the newly created MST-file resolves the problem – once the file has been installed the Management Studio setup will only verify that all resources are in place and simply bypass the installation altogether.

Include patches in a single run

PATCH property of the Windows Installer engine which arrived with the Windows Installer 4.0 release. Its quite useful during an initial deployment incase you maintain all files in their original state, include patches in a single installation run and avoid several reboots. Several patches can be listed in the property PATCH and they are installed from left to right. Use the semicolon ( ; ) as a separator. The file path for the patch, regardless of current working directory and location of the patch,  has to be an absolute path.

set MSIARG=/i
set MSIARG=%MSIARG% "%~dp0\setup.msi"
set MSIARG=%MSIARG% PATCH="%~dp0\AppV4.6SP1-WD-KB2586968-x86.msp"
set MSIARG=%MSIARG% /qb
msiexec %MSIARG% 

Source; http://msdn.microsoft.com/en-us/library/windows/desktop/aa370576(v=vs.85).aspx

SolidWorks Explorer 2012–Sequence

Preparation

Install SolidWorks Explorer 2012 natively – once installed, export the following registry; HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FLEXnet Licensing Service

Sequence

Installation

Install SolidWorks Explorer according to App-V sequencing best practice and import the above mentioned registry key.

Configuration

Run the applications and configure them according to your needs. Its recommended that you register the product and configure them to not check for updates.
The below screenshot is an example configuration of SolidWorks eDrawing 2012 Tools –> Options could look like;

image

Starting both eDrawing (which is included) and Explorer to pre-configure settings is recommended.

Save your package

Deploy

Just deploy – it should work fairly well.

This recipe should resolve the two below problems;

Issues with Solidworks 2011 sp02
http://www.appdeploy.com/messageboards/tm.asp?m=81157
Sequencing Solidworks Explorer 2011: This version of Solidworks has not been commissioned properly, please contact your supplier (A100,66)
http://social.technet.microsoft.com/Forums/en-US/appvgeneralsequencing/thread/efe0594e-0d5c-40d0-aa56-edccac532d01/

HP Discover

I just had the possibility to attend HP Discover, which really was about discovering the broad depth of HP offerings. Considering the fact that previously my engagement has only been with their hardware, outsourcing services and a few tools within their software-suites – my knowledge of them were probably not the complete HP.

During the event we met quite a few people working with cutting edge technology and got the idea of how HP views the enterprise segment.Obviously quite a few sessions focused on their next step, product and services announcements aswell as how they could assist your business with things, but certainly not limited to the to those sessions. After digesting through a key note or two – quite interesting topics were discovered and the fact that you could interact with HP in so many ways were amazing.

One thing was especially appreciated; Their cloud-concepts were not as unclear. Usually cloud is a concept vaguely referring to a change of a business model where you are traditionally using an outside service providing the hands and feet of IT in a standardized process. There are several services out there – working in quite few different ways. However, HP admitted that they had some offerings, others were just started and some were just concepts beeing discussed. The good part about this is that we got to see demos (yeah, woho!) of products that was in progress.

However, some interesting topics that was gathered;

HP ProLiant Server and BladeSystem Management Packs for Microsoft System Center Operations Manager 2007

The HP StorageWorks Management Packs for Microsoft Systems Center 2007

HP Client Catalog for Microsoft System Center Products

Application Transformation Solutions << These consultants blew me away !

Looking into the HP Application Transformation Solutions were quite amazing in many ways as they provided tools, know-how and processes. Having discussions with those guys provided great new insights and really challenged ones mindset in many ways.

Favourite speaker? Prith Banerjee was giving a key note that was electric and really got everyone excited about all the topics he brought up! Prith is responsible for HP Labs – which is their research department look at future use of any type of technology.

After three days of non-stop discussing from early morning till late evening – I am kinda tired and will definitely appreciate my own bed at home. Btw, Vienna Airport has free WiFi!

This application has failed to start because the application configuration is incorrect

This application has failed to start because the application configuration is incorrect. Reinstalling the application may fix this problem.

xxxxxxx-xxxxxx2C-000036B1

This error indicates that certain components that needs to available to the application are not when running a virtualized application within App-V.

VC++ 2005: http://www.microsoft.com/download/en/details.aspx?id=3387
VC++ 2005 SP1: http://www.microsoft.com/download/en/details.aspx?id=5638
VC++ 2005 SP1 ATL security update: http://www.microsoft.com/download/en/details.aspx?id=14431
VC++ 2008: http://www.microsoft.com/downloads/details.aspx?familyid=9b2da534-3e03-4391-8a4d-074b9f2bc1bf
VC++ 2008 SP1: http://www.microsoft.com/download/en/details.aspx?id=5582
VC++ 2008 SP1 with ATL security update: http://www.microsoft.com/download/en/details.aspx?id=15303
VC++ 2010: http://www.microsoft.com/download/en/details.aspx?id=5555
VC++ 2010 SP1: http://www.microsoft.com/download/en/details.aspx?id=8328
Visual J# 2.0: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=4712
VS 2010 F# 2.0 SP1: http://www.microsoft.com/download/en/details.aspx?id=15834

Incase installing one of the above does not remedy the problem – you can manually setup the missing sidebyside-component. Review the error
message from the Application Log – see example below;

Log Name:      Application

Source:        SideBySide

Level:         Error

Keywords:      Classic

Description:

Activation context generation failed for “Q:\ecowin.002\VFS\CSIDL_PROGRAM_FILES\EcoWin\EcoWin.exe”. Dependent Assembly Vinga.vscom90u,processorArchitecture=”X86″,publicKeyToken=”e520fe831c9439c8″,type=”Win32″,version=”1.0.0.55″ could not be found. Please use sxstrace.exe for detailed diagnosis.

Locate the referenced file within the package and copy it to the same folder as the application.
Create the first manifest to tell Ecowin where it should get its above Vinga.vscom90u (named ecowin.exe.manifest)

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
<dependency>
<dependentAssembly>
<assemblyIdentity type="win32" name="Vinga.vscom90u" version="1.0.0.55" processorArchitecture="x86"></assemblyIdentity>
</dependentAssembly>
</dependency>
</assembly>

The second manifest telling Ecowin where VScom90u.dll was (named Vinga.vscom90u.manifest)

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<noInheritable />
<assemblyIdentity type="win32" name="Vinga.vscom90u" publicKeyToken="e520fe831c9439c8" version="1.0.0.55" processorArchitecture="x86" />
<file name="vscom90u.dll" />
</assembly>

The version, name, type, processorArchitecture, publicKeyToken are all picked up from the original error message.

European App-V User Group – 18 Nov, 2011

Presentations PDFs will be available at; www.appvug.com

Presenters were;
Impact AppVirt on VDI (Project VRC phase IV) by Ruben Spruijt
Troubleshooting App-V & Common Issues by Madelinde Walraven and Sebastian Gernert
Future: App-V in Configuration Manager 2012 by  Ment van der Plas
Heavy Duty Sequencing by Nicke Källén
Server App-V by Jurjen van Leeuwen
Dynamic Suite Composition: Boon or Bane? by Falko Gräfe
User State Virtualization: Do I still need it when using App-V? by Rodney Medina
Top 10 Myths around App-V (all)

Shot and cut by Olle Källén, best quality available at his Vimeo account

Successful sequencing (or an interview with the guy who solved the excel.exe started by svchost.exe issue)

After a Microsoft support-case in which I was assisted by Sasha Loncarevic in resolving a problem where excel.exe initiated by a virtual application – had a parent process named SVCHOST.exe – an original solution came about. This solution could in a very short time be reused in a very similar scenario. Previously – only one similar thread had been posted in the forums describing a very spot on scenario. Excel is started outside of the virtual environment. Hopefully this interview can bring insight how Microsoft assists customers in resolving their issues and some insight to the details that caused it.

 

Hello Sasha,

sashalonFB (3)Can you please introduce yourself?

Hi, my name is Sasha Loncarevic and I am an Escalation Engineer at Microsoft UK.  I have been with Microsoft for 11 years, most of that time working with Enterprise customers to resolve complex issues in Remote Desktop Services and APP-V scenarios.  Besides working on the most political/severe problems, Escalation Engineers also work with the Product Groups and Sustained Engineering teams to debug problems and deliver Hotfixes for bugs in the source code.

How long have you been working with App-V / Softgrid?

I started working with APP-V in early 2007; shortly after Softricity was acquired by Microsoft.

Whats installed on your computer?

A full Microsoft stack as you can imagine!  I have several machines at work: three are running Hyper-V to host my repro environments, so around 10 guest VMs each at any one time.  My main tools machine has Office 2010 (OneNote and Lync being my favourite apps), Visual Studio 2008 and 2010, Platform SDKs, DDK, Debugging Tools for Windows, our internal CRM tools, and a loads more.

How are you assisting customers?

Around half of my time is reactive – working on support incidents raised by external customers.  The other half of my time is dedicated to building out our internal and external diagnostics capabilities: tools for data collection, automation of problem identification etc.  The third half of my time is spent mentoring junior engineers and working on business improvement projects.

Are you actively participating in the App-V Community – directly or indirect?

Unfortunately not as much as I would like.  With my work time already over-committed and having four beautiful and active children, I can never find time to maintain a blog, or regularly contribute to other blogs or newsgroups.  However, after resolving a reactive incident I will often promote the solution to a knowledge base (KB) article.  We do track how often our articles are viewed by the public, so I know that my contributions are making a difference (aggregated to >5000 views in the past year).

Since this interview came about after investigating OLE-calls and / or COM-objects – lets transition into that…

 

You assisted in investigating issues – where Excel and other locally installed applications were called from a virtual application, but not started within the virtual environment. Usually the parent process of those applications (excel as an example) was SVCHOST.exe

Can you tell us more about why SVCHOST.EXE starts Excel.exe among several other programs?

First some background: Excel is an OLE server.  OLE is an old technology that allowed you to embed content from different applications into a single document stream – for example if you embed an Excel spreadsheet into a Word document, you could double click the object to start editing the spreadsheet using Excel menus and functions, but whilst still in the Word window.  OLE evolved into COM, which defines a standard way of interfacing with objects.  Excel is a COM server, and Word (or any other application) can use COM to create Excel objects and control them, including what OLE originally enabled.  COM allows objects to support multiple interfaces, and many objects support the IDispatch interface, which allows them to be controlled via scripts e.g. vbscript.

COM also defined ways for objects to be created – either within the host process, or in a separate process.  In the early days of Office, it was possible for an embedded spreadsheet to be served (drawn, updated) by an Excel DLL loaded into the Word process.  Nowadays Office is too big and complex for that, and Excel objects are served by an external instance of Excel.exe.  This is called an ‘Out-of-process’ COM object, and the COM server process (Excel.exe) will be usually be launched by the DcomLaunch service, running in an svchost.exe process.

As we know, svchost.exe is not running within the APP-V virtual environment and this can therefore present problems for virtualized applications that use out-of-process COM.  APP-V examines all CoCreateInstance calls inside the virtualized processes, and will launch out-of-process server processes inside the virtual environment in most cases.  Recently we had a case where APP-V was fooled by SAP asking for an in-process Excel object, and mistakenly allowed Windows to handle the activation because the target object (Excel) had a legacy “InProcServer32” and “InProcHandler32” registry entry (i.e. it incorrectly appears to support in-process activation).  In this case Excel was launched by svchost.exe outside the virtual environment.  There are two potential solutions for this problem – change SAP to request an out-of-process Excel object, or delete the “InProcServer32” and “InProchandler32” registry value for Excel.

There often many questions regarding “the wrong” software starting when using a combination of virtual and locally installed applications – one scenario described by the App-V Team blog (1)

How can one avoid such issues – what can one do to resolve those if they show themselves?

I don’t believe there is a blanket rule, or general advice for this.  I expect that even armed with the knowledge from my earlier statement there will still be borderline scenarios that will require a live debug to resolve.  That being said, the tool that we almost always start off with when troubleshooting problems of this nature is Process Monitor (procmon) from SysInternals (now Microsoft).  The standard advice is to get traces from working (i.e. non-virtualised) and failing examples, and compare the two.  I usually start analysis by right clicking on process names in both traces that I am definitely not interested in, and then selecting ‘exclude’ in the dropdown menu – usually by process name but in some cases by process ID (we wouldn’t want to take out all svchost.exe’s for example, if we were troubleshooting an issue like the ‘wrong parent’ problem).

Is this the reason why the previous recommendation was that any virtualized program should not be installed natively?

I think you mean any application that will be need to be accessed by a virtualized application should also be virtualized…

APP-V does try its best to “marshal” interaction between locally installed and virtualized applications, however in some cases there are just too many brittle touch points, or different ways to exercise the Windows APIs to achieve the same result, that APP-V hasn’t catered for.

What does a registry key under HKEY_CLASSES_ROOT\CLSID represent (or HKLM\Software\Classes)?

COM objects are identified by GUIDs and friendly names e.g. {00030000-0000-0000-C000-000000000046} is also Excel.Worksheet.  The CLSID subkey of HKEY_CLASSES_ROOT is where every COM object is defined, listed by its GUID.  Here will be detailed whether the COM object supports in-process and/or out-of-process activation, and what executables encapsulate the object’s functionality.   If an object has a friendly name, it will also have an entry (using that name) in the base of HKEY_CLASSES_ROOT, where we map to its GUID.  The base of HKEY_CLASSES_ROOT also contains file association information used by the Windows shell.

Why does removing InprocHandler32 and InprocServer32 let us avoid having SVCHOST.exe starting a locally installed application outside of the virtual environment?

This should be answered earlier.

What tools did you use while troubleshooting?

Mostly WinDBG (Windows Debugger) and our source code explorer, but also Netmon, Perfmon, many SysInternals tools (Process Monitor being an important one).  I also use tools I have written myself, e.g. to gather and decode software traces (ETW)

How many applications have you sequenced?

Only around 20, and usually following customer recipes in order to reproduce problems that I can then debug or troubleshoot further.

Any special thanks you wish to send-out?

I work with really smart and motivated people at Microsoft; far too many to call out individually.  Often I also work with customers that deserve special mention, in that they partner well with us to find solutions to really tricky problems (e.g. willing to capture endless traces, enable remote debugging etc).

What improvements do you wish to see in App-V?

I believe that error handling and reporting could be improved to help customers resolve problems without coming back to Microsoft.  I would also love to see a Process Monitor Comparison tool, that would know what sort of differences to look for during sequencing, native execution and virtualised execution.  In fact I started writing such a tool, but it is currenlty somewhere in the middle of a huge ’to-do when I get time’ pile.

 

With that – we thank Sasha for the time taken to answer this and hope that it can provide insight for everyone using App-V!

 

(1) http://blogs.technet.com/b/appv/archive/2011/08/25/office-documents-may-not-open-in-the-expected-version-when-using-multiple-versions-of-office-with-microsoft-app-v.aspx