Event Id 8, Crypt32

Greetings,

On our network all traffic out to the MS update site is blocked both in group policy and at the firewall. I have WSUS implemented and have all workstations pointing at the WSUS server for updates via group policy. I have a machine that is logging tons of event ID 8 errors. I've pasted the event log for reference.


Source: Crypt32
Type: Error
Event ID: 8

Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: 0x197

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Does WSUS download and install the updates to MS Certificates? If not, anyone know how to centrally deploy those certificates without machines being able to connect to the MS update site? Or does anyone have any info on the above event? A Google search hasn't produced many good results.

I suspect this may be a Windows XP SP2 system attempting to do an Automatic Root Certificates Update.

WSUS does not do anything with certificates.

If you have Automatic Root Certificate updating installed in Windows XP or Windows Server 2003, you'll need to allow that functionality through your firewall. Otherwise, you'll want to /uninstall/ it from all of your XP/2003 systems, and determine some other methodology for ensuring that your clients have updated Root Certificates.

I realize WSUS doesn't have anything to do with certificates, but aren't the root certificates typically updated thru Windows update as a non-critical patch? Or did XP SP2 change that?

I assued that if Windows Update had an option for updated root Certs then WSUS would probably also add an update for it.

There is a Root Certificates Update available through WindowsUpdate.com as an /Optional/ update for Windows 9x/ME/2000 systems.

Windows XP and Windows Server 2003 have a feature called automatic root certificates updating. It's an installation option, and it's installed by default. Go to Add/Remove Programs > Add/Remove Windows Components, and scroll all the way down, three lines up from the bottom, where you'll see the item "Update Root Certificates".

You can find a detailed description of your /EXACT/ situation in KB317541 at http://support.microsoft.com/default...b;en-us;317541 which confirms my original suspicion as to the cause.

This error occurs because, your IP Address was block by this site http://www.download.windowsupdate.co...uthrootseq.txt

There is no need remove the Update Root Certificates in Add/Remove Component.
just turn off the Automatic Root Certificate Update via GPO.

here is the path where you can disable this Update:

Click Run > type gpedit.msc > Computer Configuration > Administrative Templates > System > Internet Communication Management >Internet Communication Settings
Under this setting Enable the Turn Off Automatic Root Certificates Update.
Then on your command prompt, type gpupdate /force.

try to check your app log tomorrow, this error will not appear on you event viewer again.

What, pray tell, are you responding to. (I had to go to the web interface to find out; an *empty* message with only a subject line "Event Id 8, Crypt32".

No quotes of the original message, and this thread has no other messages in my message store which goes back to the middle of June, 2009.

Wouldn't be better, don't you think, to FIX the cause of the error, rather than disabling the updating of root certificates, which is *required* to sustained continued functionality of SSL web browsing?

=OR= ... we could wait to see if the original poster (who doesn't even have an identity in the original post), comes back and gives us some real information where we can make and intelligent and educated determination of the *problem*, and then apply the *Correct Solution*, rather than simply disabling a critical subsystem of the operating system as a 'workaround'.

Heck, we don't even know what triggered the error!! Maybe that error is a VALID indication because something inappropriate was being attempted.

This is what happens when wanna-be web forum sites replicate Microsoft Public Newsgroups. (Who knows what might actually be in the message store of forums.techarena.in that might not even have replicated back to the microsoft.public newsservers.)

I had the same issue and this article provided the solution

I am having the same issue. I work in a data center with 100s of Windows 2003 boxes and I've never encountered this error. Here is the error:

Type: Error
User: N/A
Source: crypt32
Event ID: 8

Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The specified server cannot perform the requested operation.

I get this error 38 times in the same second in the event viewer every time I boot the computer. I had GhostWall installed and removed it to see if that was causing the issue. The issue persists.

I have my computer connected to AT&T Uverse's modem/router which has a firewall built in. It's a simple one very similar to the firewall on a Linksys WRT54G. I am able to connect to update.microsoft.com, download.microsoft.com and even browse the link specified in the error all without issue. As I have never seen this error before in my experience on 100s of Windows boxes I believe this may be the cause. Any help figuring out if that's doing it and how to fix it? I don't really want to disable a feature that seems as though it would be a useful one to have.

Microsoft says in KB317541 to disable it or connect to the internet. I am connected to the internet so no disabling features.

from KB2253680:
Modify router or proxy configuration to allow computers recording these events to connect to Windows Update. I don't know what needs to be modified to allow this.

I'm part of an IT staff that services one of NY State's courts. We've got over 100 Dell OptiPlex PC's, all with Win XP SP3. Little by little, we'll get a PC that starts behaving erratically, slow boot ups, slow response when opening programs, among other things.

When checking the event log, invariably the Event ID 8, Crypt32 error appears, as described by the original poster of this thread. So far the only solution we've come across, it to disable the Update Root Cetificates in Add/Remove Programs, Windows Componants.

The Crypt32 error stops immediately and the PC returns to normal functionality. If someone can discover a "proper" fix for this error, PLEASE do share. I'm not a big fan of disabling Window's functions, so a true solution would be greatly appreciated. Thanks!

I came across this thread as I have encountered this "Crypt32, Event ID 8, Failed .." issue following a clean reinstall of a Windows XP x64 Pro based workstation.

While Digital certificates have been in the news lately for the wrong reasons, as an old Geek, all those error messages in the Event Log are .. well, not a good look, to say the least :-)

A number of new programs were also installed, one of which is a third party (non-Microsoft) Security Suite.

While my setup may be slightly different to others, I tracked and fixed it thus:

- Firstly, the System process "Generic Host Process for Win32 Services" (svchost) requires outbound access.
The new Security Suite software Firewall was not allowing unrestricted access to the Internet/Untrusted Network.
Check your Firewall/security Apps.

I also found that the Automatic Updates service (wuauserv) needed to be set to Automatic and in the Running Status, although it did not matter if in the System Properties, it was either "Notify me but don't automatically download or install them" or "Turn off Automatic Updates".

As this is XP x64 I'm not sure if it made any difference or not, but as I normally run a 'trimmed" services configuration, I reset to their default:
- IAS Jet Database Access - Manual
- WinHTTP Web Proxy Auto-Discovery Service - Manual

Trust this may be of some help to those who may come across this thread with this issue as a possible solution.