Solved Event ID 513 CAPI 2 errors

Steve C · Mar 10, 2015

I'm getting the error reports shown below in my Windows 8.1 Pro x64 PC. Please advise what this error means and how to fix it.

adamf · Mar 10, 2015

It is an authority issue when making backups or restore points. There is a fix detailed here that works: Event 513 errors when setting a restore point or running backup - Microsoft Community (look at the "most helpful reply" post)

Be sure to read it carefully and to enter the string on one line. It is difficult to reset the authority if you get it wrong so make a restore point first. My results for SC sdshow MSLLDP were different to the one in the link so for me the fix was

Code:

sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CCLCSWLOCRRC;;;SU)

It is quite simple though - you just add (A;;CCLCSWLOCRRC;;;SU) after (A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453) wherever it is in the string. This adds NT AUTHORITY\SERVICE to the MSLLDP service.

If you aren't sure post the output of SC sdshow MSLLDP and SC sdshow MUP commands.

Steve C · Mar 11, 2015

Thanks for this.

Fearless 96 at Cryptographic Services failed while processing the - Microsoft Community mentions a slightly different approach which gives fewer rights to mslldp. Is this approach better?

The results to the two commands are copied below. Any further guidance is appreciated.

adamf · Mar 12, 2015

That solution looks better - nice find. I just tested it on a clean Windows 10 install and it worked perfectly. I created a restore point with zero errors

This is what I did - added the SERVICE_QUERY_CONFIG as he describes (in red over on the far right of the box below). I didn't have the final SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) so I just put it after the (A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453) block. You need it between the two.

Code:

C:\WINDOWS\system32>SC sdshow MSLLDP

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)

C:\WINDOWS\system32>sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)[COLOR=#ff0000](A;;CC;;;S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459)[/COLOR]
[SC] SetServiceObjectSecurity SUCCESS

C:\WINDOWS\system32>accesschk.exe -v -c mslldp

Accesschk v5.21 - Reports effective permissions for securable objects
Copyright (C) 2006-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

mslldp
  Medium Mandatory Level (Default) [No-Write-Up]
  RW NT AUTHORITY\SYSTEM
        SERVICE_ALL_ACCESS
  RW BUILTIN\Administrators
        SERVICE_QUERY_STATUS
        SERVICE_QUERY_CONFIG
        SERVICE_CHANGE_CONFIG
        SERVICE_INTERROGATE
        SERVICE_ENUMERATE_DEPENDENTS
        SERVICE_PAUSE_CONTINUE
        SERVICE_START
        SERVICE_USER_DEFINED_CONTROL
        DELETE
        READ_CONTROL
        WRITE_DAC
        WRITE_OWNER
  RW S-1-5-32-549
        SERVICE_ALL_ACCESS
  R  NT SERVICE\NlaSvc
        SERVICE_QUERY_STATUS
        SERVICE_START
        SERVICE_STOP
  R  NT SERVICE\CryptSvc
        SERVICE_QUERY_CONFIG

C:\WINDOWS\system32>

As your sdshow is the same as Fearless 96 (please double check it) you can just copy what he or she has in step 4 on the December 1st post. Make sure you get rid of any new lines/carriage returns - you should copy it into one line in notepad.

Just in case you didn't know you can download the accesschk utility from here https://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

Steve C · Mar 13, 2015

All sorted thanks using the Fearless 96 method - note the method was referenced in your original post.

I did a System Restore with no CAPI2 errors.

Solved Event ID 513 CAPI 2 errors

Steve C

Member

My Computer

System One

adamf

Banned

My Computer

System One

Steve C

Member

My Computer

System One

adamf

Banned

My Computer

System One

Steve C

Member

My Computer

System One