A Service is misconfigured

Microsoft.Windows.Server.10.0.OperatingSystem.ServiceMisconfigured.Alert (Rule)

A service has been detected as misconfigured.

Knowledge Base article:

Summary

Each of these events indicates that a service’s configuration is incorrect and that the service might not be able to start up appropriately. This alert is generated when any one of the following Service Control Manager events occur:

Causes

The Service Control Manager has generated an event indicating that a service failed to start due to the service having an invalid configuration, such as the service having a circular dependency with another service.

Resolutions

To resolve this issue, follow the steps below:

7015: To resolve this issue, change the dependency of the boot-start or system-start driver service indicated in the event message text. To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To list the dependent services for a service and modify the dependencies:

7017: To resolve this issue, remove the circular dependency. To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To list the dependent services or service groups for a service and remove the circular dependencies:

7018: To resolve this issue, remove the circular dependency. To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To list the dependent services for a service and remove the circular dependencies:

7019: To resolve this issue, remove the circular dependency. To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To list the dependent services or service groups for a service and remove the circular dependencies:

7020: To resolve this issue, remove the circular dependency. To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To list the dependent services or service groups for a service and remove the circular dependencies:

Element properties:

TargetMicrosoft.Windows.Server.10.0.OperatingSystem
CategoryEventCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Service is misconfigured
{0}
Event LogSystem

Member Modules:

ID Module Type TypeId RunAs 
EventDS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.Server.10.0.OperatingSystem.ServiceMisconfigured.Alert" Enabled="true" Target="ServervNext!Microsoft.Windows.Server.10.0.OperatingSystem" ConfirmDelivery="true">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventDS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventSourceName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Service Control Manager</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7015</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7017</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7018</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7019</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>7020</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.10.0.OperatingSystem.ServiceMisconfigured.Alert.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue/>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>