JSI Tip 1764. Service Control Manager Event IDs 7013 and 7014.


If the Service Control Manager can't start a service in the security context of its' user account and current password, your SYSTEM event log will contain:

Event ID    = 7013
Source      = Service Control Manager
Type        = Error
Description = Logon attempt with current password failed with the
              following error: Logon failure: unknown user name or
              bad password.
If the Service Control Manager can't start a service in the security context of its' user account and backup password, your SYSTEM event log will contain:
Event ID    = 7014
Source      = Service Control Manager
Type        = Error
Description = Second logon attempt with old password also failed with
              the following error: Logon failure: unknown user name or
              bad password.
Services can run in the security context of an ordinary user account.

The Service Control Manager keeps copies of the current and backup password. When first configured, the password is stored in the current password and the backup password is not created. When the service first logs on, it uses the current password. If successful, it saves the current password in the backup password. If you change the password, the current password is first stored in the backup password and the new password becomes the current password. When you try to start the service, the Service Control Manager uses the current password. If this fails, event 7013 is logged and the backup password is tried. If this succeeds, the backup password becomes the current password. If it fails, event 7014 is logged.

Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish