Service Misconfigured Alert

Microsoft.Windows.Client.Win10.OperatingSystem.ServiceMisconfigured.Alert.MissionCritical (Rule)

Knowledge Base article:

Summary

This alert is generated when any one of the following Service Control Manager events occur:

Each of these events indicates that a service’s configuration is incorrect and that the service might not be able to start up appropriately.

Causes

Each of these events indicates that a service has either been configured to start before the service’s dependent services; service groups have started; or that a circular list of service dependencies has been configured. More specific descriptions of the cause of each event are shown below:

The specified service is dependent on a chain of other services. One of the other services is dependent on another service that appears earlier in the chain.

An auto-start service is dependent on a chain of other services. One of the services in that chain is dependent on another service that appears earlier in the chain.

The service depends on a service in a group that starts later.

The service specified depends on another service that is in a group which is configured to start later than the specified service.

The specified service depends on a group that is configured to start later than that service.

Resolutions

To resolve this issue, follow the steps below:

Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

SCSI miniport

port

Primary disk

SCSI class

SCSI CDROM class

filter

To adjust the load order for a ServiceGroup, move the relevant ServiceGroup further down the list so that the dependent service starts before the service that has generated the alert does.

CAUTION: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. To do this, open Registry Editor and navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder registry key. The ServiceGroupOrder registry key contains a registry value named “List,” and the data in this registry value enumerate the group names in the order in which they will be loaded. Here is a portion of the “List” registry value data: SCSI miniportportPrimary diskSCSI classSCSI CDROM classfilter… To adjust the load order for a ServiceGroup, move the relevant ServiceGroup further down the list so that the dependent service starts before the service that has generated the alert does.

Element properties:

TargetMicrosoft.Windows.Client.Win10.OperatingSystem
CategoryEventCollection
EnabledFalse
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Service is misconfigured
{0}
Event LogSystem

Member Modules:

ID Module Type TypeId RunAs 
EventDS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.Client.Win10.OperatingSystem.ServiceMisconfigured.Alert.MissionCritical" Enabled="false" Target="Win10!Microsoft.Windows.Client.Win10.OperatingSystem" DiscardLevel="100" ConfirmDelivery="true" Remotable="true" Priority="Normal">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventSourceName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Service Control Manager</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7017</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7018</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7019</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7020</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</Or>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.Client.Win10.OperatingSystem.ServiceMisconfigured.Alert.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue/>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>