Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Occasional StartService failed with 1058

TimCTimC Member Posts: 25
I wrote a file system minifilter that has been run as a service on 10-15 machines for the past several weeks. The machines run constant, long automated regression tests, which install our software (including installing and starting the minifilter), run a regression test, then stop/uninstall the minifilter, then do it all over again for the next test.

On a few occasions, this error has been seen: "StartService failed with 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." The offending machine had to be rebooted before it would successfully run the regression tests again. When this error occurred, the machine was in the middle of some regression tests (i.e. it ran test1 - test19 successfully and was starting test20 out of 30).

I have searched extensively online and cannot find any info on when Windows sets the start type of a service to disabled (only info on manually setting services to disabled).

Would this happen if the minifilter driver service crashed? There were no records of any errors or problems in the Event Log. If a device driver fails for some reason, shouldn't there be a record in the Event Log? If not, is there anywhere to look for such info? There was no crash dump file.

Alternatively, does Windows set the start type to disabled when the service is "marked for deletion" (but not actually deleted)? If so, I am also unclear on how the service could have been marked for deletion, since there should have only been a single handle to it (no services.msc open and only one test running at a time).

Could there be some kind of timing issue with many install/start <-> stop/uninstall service cycles? These cycles happen hundreds of times a day, every day, for weeks on many machines, and this error has only been seen a handful of times.

Any insight into how a running service could become disabled would be appreciated.

Thanks,

--Tim

Comments

  • OSR_Community_UserOSR_Community_User Member Posts: 110,217
    Do you know it's being set to 'disabled,' or you just going of the error message? If the later, I wouldn't personally trust that.

    Also, the 'service' in question is actually your driver, correct?


    mm
  • Ken_JohnsonKen_Johnson Member - All Emails Posts: 1,559
    Yes, I think you're running into marked for deletion. That results in the service being considered disabled like that the last that I recall.

    - S

    -----Original Message-----
    From: [email protected] <[email protected]>
    Sent: Friday, September 11, 2009 14:49
    To: Windows File Systems Devs Interest List <[email protected]>
    Subject: [ntfsd] Occasional StartService failed with 1058


    I wrote a file system minifilter that has been run as a service on 10-15 machines for the past several weeks. The machines run constant, long automated regression tests, which install our software (including installing and starting the minifilter), run a regression test, then stop/uninstall the minifilter, then do it all over again for the next test.

    On a few occasions, this error has been seen: "StartService failed with 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." The offending machine had to be rebooted before it would successfully run the regression tests again. When this error occurred, the machine was in the middle of some regression tests (i.e. it ran test1 - test19 successfully and was starting test20 out of 30).

    I have searched extensively online and cannot find any info on when Windows sets the start type of a service to disabled (only info on manually setting services to disabled).

    Would this happen if the minifilter driver service crashed? There were no records of any errors or problems in the Event Log. If a device driver fails for some reason, shouldn't there be a record in the Event Log? If not, is there anywhere to look for such info? There was no crash dump file.

    Alternatively, does Windows set the start type to disabled when the service is "marked for deletion" (but not actually deleted)? If so, I am also unclear on how the service could have been marked for deletion, since there should have only been a single handle to it (no services.msc open and only one test running at a time).

    Could there be some kind of timing issue with many install/start <-> stop/uninstall service cycles? These cycles happen hundreds of times a day, every day, for weeks on many machines, and this error has only been seen a handful of times.

    Any insight into how a running service could become disabled would be appreciated.

    Thanks,

    --Tim


    ---
    NTFSD is sponsored by OSR

    For our schedule of debugging and file system seminars
    (including our new fs mini-filter seminar) visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
  • Daniel_TerhellDaniel_Terhell Member Posts: 1,361
    I'm getting error 1058 if I call IoCreateDevice in DriverEntry and forget to
    call IoDeleteDevice in the unload routine. Maybe you are keeping a reference
    on a device object somewhere which causes your driver to be marked as
    'delete pending'.

    //Daniel


    <[email protected]> wrote in message news:xxxxx@ntfsd...
    > I wrote a file system minifilter that has been run as a service on 10-15
    > machines for the past several weeks. The machines run constant, long
    > automated regression tests, which install our software (including
    > installing and starting the minifilter), run a regression test, then
    > stop/uninstall the minifilter, then do it all over again for the next
    > test.
    >
    > On a few occasions, this error has been seen: "StartService failed with
    > 1058: The service cannot be started, either because it is disabled or
    > because it has no enabled devices associated with it." The offending
    > machine had to be rebooted before it would successfully run the regression
    > tests again. When this error occurred, the machine was in the middle of
    > some regression tests (i.e. it ran test1 - test19 successfully and was
    > starting test20 out of 30).
    >
    > I have searched extensively online and cannot find any info on when
    > Windows sets the start type of a service to disabled (only info on
    > manually setting services to disabled).
    >
    > Would this happen if the minifilter driver service crashed? There were no
    > records of any errors or problems in the Event Log. If a device driver
    > fails for some reason, shouldn't there be a record in the Event Log? If
    > not, is there anywhere to look for such info? There was no crash dump
    > file.
    >
    > Alternatively, does Windows set the start type to disabled when the
    > service is "marked for deletion" (but not actually deleted)? If so, I am
    > also unclear on how the service could have been marked for deletion, since
    > there should have only been a single handle to it (no services.msc open
    > and only one test running at a time).
    >
    > Could there be some kind of timing issue with many install/start <->
    > stop/uninstall service cycles? These cycles happen hundreds of times a
    > day, every day, for weeks on many machines, and this error has only been
    > seen a handful of times.
    >
    > Any insight into how a running service could become disabled would be
    > appreciated.
    >
    > Thanks,
    >
    > --Tim
    >
    >
  • TimCTimC Member Posts: 25
    Thanks for your replies. Yes, the service in question is the driver.

    My guess is that you are right - the process is being marked for deletion (and therefore the start type is set to disabled). I don't do any IoCreate calls, but I suspect that somehow there was another handle to the driver, and therefore instead of being deleted, it got 'marked for deletion'.

    Thanks,

    --Tim
  • Sam21RCSam21RC Member Posts: 1

    I have solved my issue by making sure the startup type is not disabled.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online