I wrote a file system minifilter that has been run as a service on 10-15 machines for the past several weeks. The machines run constant, long automated regression tests, which install our software (including installing and starting the minifilter), run a regression test, then stop/uninstall the minifilter, then do it all over again for the next test.
On a few occasions, this error has been seen: "StartService failed with 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." The offending machine had to be rebooted before it would successfully run the regression tests again. When this error occurred, the machine was in the middle of some regression tests (i.e. it ran test1 - test19 successfully and was starting test20 out of 30).
I have searched extensively online and cannot find any info on when Windows sets the start type of a service to disabled (only info on manually setting services to disabled).
Would this happen if the minifilter driver service crashed? There were no records of any errors or problems in the Event Log. If a device driver fails for some reason, shouldn't there be a record in the Event Log? If not, is there anywhere to look for such info? There was no crash dump file.
Alternatively, does Windows set the start type to disabled when the service is "marked for deletion" (but not actually deleted)? If so, I am also unclear on how the service could have been marked for deletion, since there should have only been a single handle to it (no services.msc open and only one test running at a time).
Could there be some kind of timing issue with many install/start <-> stop/uninstall service cycles? These cycles happen hundreds of times a day, every day, for weeks on many machines, and this error has only been seen a handful of times.
Any insight into how a running service could become disabled would be appreciated.