Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,096 questions
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 15%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EL%3C/text%3E%3C/svg%3E)
I am experiencing the same error. Is this fixed in 13.02?
Possible bug in 13.01 - Failed to open service configuration
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 37%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEL%3C/text%3E%3C/svg%3E)
Elias Leslie
6
Reputation points
We're noticing a potential bug in 13.01 that will only clear when NetworkConnect is completely disabled or the "Network List" or "Network Location Awareness" services are disabled. We've tested and seen this on multiple Windows 10 Pro x64 20H2 (19042) systems. We've also seen this on a fresh install of Windows 10 Pro x64 20H2 (19042).
This has caused issues with services hanging on startup. The Cisco Umbrella Roaming Client for example. This may also be causing issues when patches apply and systems get stuck in a "Restarting" state but that is not conclusive.
Our current workaround is to not gather NetworkConnect events which is definitely not ideal. Any help would be greatly appreciated!
Error:
ID: GetConfigurationOptions
Description: Failed to open service configuration with error 94 - Last error: The media is write protected.
Thanks,
Elias
Sysinternals
{count} vote
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 35%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ED%3C/text%3E%3C/svg%3E)
dstaulcu 351 Reputation points2021-02-26T12:24:53.687+00:00 those are troubling symptoms!
ill check our environment to see if we have an uptick in service startup errors corresponding to our deployment of 13.01
odd that networkconnect is implicated. that has been around for a while and i imagine it to be etw sourced rather than a blocking oriented driver.
what binary and schema version did you upgrade from? was network connect enabled before?
-
Elias Leslie 6 Reputation points
2021-02-27T03:34:10.453+00:00 We just started using Sysmon in this environment. They were all fresh installs of 13.01. We started with 13.00 on a couple but held off because of the initial issues. I thought it odd as well. The Sysmon driver was also the highest altitude driver according to fltmc so it doesn't seem like a driver conflict. We disabled all non-MS services and then quite a few MS services until we found that disabling the Network List service stopped the errors.
-
dstaulcu 351 Reputation points
2021-03-11T03:10:19.227+00:00 I was finally able to review the rate of service control manager eventcode 7000 events having "the media is write protected" in message.
The message was barely present in our environment but increased to include about 1.5% of our hosts, per reboot, since the night of our deployment of Sysmon 13.01.For the most recent 3 hosts impacted today, I checked the current state of both sysmon and service name listed in the error log and confirmed that both services were running. I did not check to see if there happened to be a reboot between failure event and the time of my interactive service status checks.
Long story short, I'm seeing this behavior too, I'm just not yet sure about the impact or component of sysmon causing the problem. My guess is that the responsible component would be the new process tampering feature. That's the only new feature since the last version we had deployed.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 51%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Alex 1 Reputation point2021-03-11T03:26:41.67+00:00 You mentioned you disabled a lot of non Microsoft services. Did that include anti-virus and security software? The network location awareness function can be very troublesome from past experience...this is an intriguing issue.
-
Elias Leslie 6 Reputation points
2021-03-19T12:59:34.437+00:00 Correct, we tested on a fresh reset of W10 without AV or other security software installed. The two things that stop the error are either completely disabling the NetworkConnect (EventID 3) functionality in Sysmon OR to disable the "Network List" or "Network Location Awareness" services.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(294.40000000000003, 86%, 38%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELS%3C/text%3E%3C/svg%3E)
Langley, Scott 6 Reputation points2021-09-08T13:48:34.22+00:00 Did anyone identify any earlier versions affected. We have a similar experience but more widespread. About 5% of 1800 devices. We deployed version 12.0.3 in February and have been experiencing services stuck starting and stopping since. Cisco Umbrella, Sophos network Threat Defense, Windows PushToInstall Service, and Update Orchestrator Service. Some others randomly.
Was this fixed in a later version of Sysmon?
Sign in to comment