Fail to start W3SVC: The parameter is incorrect

  • Article

 

Symptom

 

When start World Wide Web Publishing Service service, the following Service error message popup

Could not start the World Wide Web Publishing Service service on Local Computer.

Error 87: The parameter is incorrect.

In the system log, Event 7000 was logged:

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7000

Date: 11/26/2009

Time: 3:49:37 PM

User: N/A

Computer: XXXXX

Description:

The World Wide Web Publishing Service service failed to start due to the following error:

The parameter is incorrect.

Troubleshooting

 

Run net start command, still get the same issue:

 

net start w3svc

Run the Process Monitor log, we found there is no service command to start executing the World Wide Web Publishing Service (i.e. C:\WINDOWS\System32\svchost.exe -k iissvcs)

Events should be similar with below when starting W3SVC on good IIS box.

12:26:26.6020853 PM 1040 services.exe 400 Process Create C:\WINDOWS\System32\svchost.exe SUCCESS PID: 10692, Command line: C:\WINDOWS\System32\svchost.exe -k iissvcs

12:26:26.6020970 PM 1041 svchost.exe 10692 Process Start SUCCESS Parent PID: 400

12:26:26.6021233 PM 1042 svchost.exe 10692 Thread Create SUCCESS Thread ID: 11680

Hence, the issue can be caused by register key since the system service needs to get related information from service register value first.

Root Cause

 

We found extra Environment value under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\, as below:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC]

….

"Environment"=hex(7):00,00

Data of Environment value is empty.

We have reviewed OS source code, when system starts service, the environment value will be read by service if exists and merge into parent’s Environment value. If there is no environment value, the value will be inherited from parent node. Then it is used by service starting procedure.

The issue can be reproduced after add Environment Multi-String Value with empty data under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\

Solution

Delete the Environment value under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\
Successfully start the World Wide Web Publishing Service.

Enjoy!

Anik Shen