| Event Id | 3 |
| Source | Winsock Proxy Client |
| Description | The application was started while the Service Manager was locked and NTLMSSP was not running. If the application will try to remote via winsock proxy it can cause a deadlock with the Service Manager. For this reason the remoting is disabled. If the application is a service, and you want it to be able to remote, make it dependant upon NTLMSSP. |
| Event Information | One or more services may not start, and this event message may be reported in Event
Viewer. CAUSE: This behavior can occur when a service that requires the NTLM Security Service Provider (NTMLSSP) service to operate is loaded before NTLMSSP has started. To prevent the Service Control Manager from locking, the service is temporarily unable to make remote calls. The service can be manually started without error after the NTLMSSP has loaded. RESOLUTION: To resolve this behavior, follow these steps: Start Registry Editor (Regedt32.exe). Locate and click the key for the service name indicated in the Event Viewer error messages: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\FailedServiceName NOTE: Match the .exe file listed in the Type field of the Event Viewer message to the ImagePath value of the registry key. Add the following value: Value Name: DependOnService Data Type: REG_MULTI_SZ Value: NtLmSsp Click OK to save the values. When you add this value, the service waits until the NTLMSSP service starts. If the NTLMSSP service has not started, this configuration starts the NTLMSSP service before it starts the other services. |
| Reference Links | Service Does Not Start and an Event ID 3 Message Is Logged |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.