Scheduled Scans Not Running

[Guest]

I've installed Windows Defender on 7 different Windows 2000 computers I own,
operate, and maintain, and none of them have successfully began running the
daily scheduled scans I've set up. All computers tell me after 2-3 days that
I should run regular scheduled scans, but there is no entry under "Scheduled
Tasks" in the Control Panel that require passwords, and there is no other
place to schedule them other than in the Tools Option Tab on the main Windows
Defender startup screen that has been saved in all cases. Any suggestions?

 

[Bill Sanderson MVP]

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

 

[Guest]

Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact Error
Message is shown below and appears to refer to it being run as a "networked
service" and it's not. It is loaded on individual machines and scheduled to
run by an Administrator account, and the machines are always "logged on" to
the desktops because several other anti-spyware programs I also have running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact Error
Message is shown below and appears to refer to it being run as a "networked
service" and it's not. It is loaded on individual machines and scheduled to
run by an Administrator account, and the machines are always "logged on" to
the desktops because several other anti-spyware programs I also have running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Bill Sanderson MVP]

Ok - the job IS being scheduled by the scheduled jobs facility--I just
haven't figured out how to spot the details under Windows 2000.

If you go to settings, control panel, scheduled tasks, and click Advanced in
the menu, and click View Log, you should find entries like these:
--------------------------------------
"MP Scheduled Scan.job" (MpCmdRun.exe)
Started 5/4/2006 1:51:00 AM
"MP Scheduled Scan.job" (MpCmdRun.exe)
Finished 5/4/2006 2:05:05 AM
Result: The task completed with an exit code of (0).
---------------------------------------------------

These correspond to the equivalent entries in mpcmdrun.log:

-------------------------------------------------------------------------------------
MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe"
Scan -RestrictPrivileges
Start Time: Thu May 04 01:51:02 2006


Start: MpScan(MP_ANTISPYWARE, dwOptions=1)
Start: MpSignatureUpdate()
Update started (Type:Scheduled)
SearchStarted...
Time Info - Thu May 04 02:05:03 2006
Search Completed with hr: 0x00000000
Error received: 0x80072efd
Update completed with hr: 0x80072efd
ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e
MpCmdRun: End Time: Thu May 04 02:05:04 2006

-------------------------------------------------------------------------------------


-------------------------------------------------------------------------------------
MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe"
Scan -RestrictPrivileges -Reinvoke
Start Time: Thu May 04 02:05:05 2006


Start: MpScan(MP_ANTISPYWARE, dwOptions=1)
MpScan() started
Time Info - Thu May 04 02:07:15 2006
MpScan() was completed
Finish: MpScan(MP_ANTISPYWARE, dwOptions=1)
MpScan() has detected 0 threats.
MpCmdRun: End Time: Thu May 04 02:07:20 2006

-------------------------------------------------------------------------------------

So--you can see that I am getting that same error about loggin in as a
Network Service--but the task scheduler believes that my job is completing
properly, and the timespan involved is appropriate to a quickscan, which is
what I have scheduled.

Windows Defender transcends many of the limitations of Microsoft
Antispyware. The scanning code runs as a service, I believe, and is
perfectly capable of running even with no user logged in, or with a Limited
user logged in.

Scanning is a background task, with no UI unless you open the UI during the
scan, in which case the UI code will connect to the scanner and display
progress. When the scan completes, if nothing's found there's no report
except for incrementing the last scan date and time. (Which, in your case,
isn't happening, right?)

I think I'm stumped (can that phrase REALLY come from cricket?) at the
moment. Let me think more about this and see whether I can see a way
forward--or maybe somebody who knows this stuff better than I can suggest
where to look next....

--

 

[Guest]

Yes. The problem could be that the incremental reporting of the last scan
date and time is not going forward, but I also see that the time elapsed from
the start of the attempt to scan to the end of the attempt to scan is only 2
seconds, which is certainly not enough time for even a quick scan, much less
a complete system scan. I originally switched my scheduled scans to quick
scans from complete system scans in an attempt to get the scans to run, but
it still appears to me they are failing to run from the get-go.

Think about it and get back to me, and if a copy of the entire log entry as
opposed to just the error message and code itself would be helpful, I'd be
happy to send it to you separately; it's only 3KB but much longer than these
word limitations allow. And again I'll look forward to hearing back from you
about any other suggestions or questions you might have.

Jeffrey B Brooks

 

[Guest]

I have the same problem on Windows 2000 systems with error in MpCmdRun.log:
ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

It seems like a bug in MpCmdRun.exe. My temporary solution:
1. Manualy schedule scan job with these parameters:
Run: "C:\Program Files\Windows Defender\MpCmdRun.exe" Scan
-RestrictPrivileges
Run as: user different from user NT AUTHORITY\SYSTEM, Administrator for
example

or

2. Manualy schedule scan job with these parameters:
Run: "C:\Program Files\Windows Defender\MpCmdRun.exe" Scan
Run as: NT AUTHORITY\SYSTEM

It works for me, hope it will be corrected.
Enjoy.

 

[Guest]

Reasonable suggestions, tried both alternatives for authority to run scan,
and both still ended as quickly as they started with the program itself still
telling me to set a schedule to run scans regularly as it my system hasn't
been scan in 5 days. Seems the bugs are more trouble than they're worth and
will likely just continue using Spy Sweeper and CounterSpy as my alternatives.

 

[Steve Dodson [MSFT]]

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

 

[Guest]

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks




Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Guest]

Still not running on any machine. Any other suggestions....or do I just
uninstall it and go back to using third party anti-spyware programs again?
--
Jeffrey B Brooks

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

:

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just
fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

--

I've installed Windows Defender on 7 different Windows 2000 computers I
own,
operate, and maintain, and none of them have successfully began running
the
daily scheduled scans I've set up. All computers tell me after 2-3
days
that
I should run regular scheduled scans, but there is no entry under
"Scheduled
Tasks" in the Control Panel that require passwords, and there is no
other
place to schedule them other than in the Tools Option Tab on the main
Windows
Defender startup screen that has been saved in all cases. Any
suggestions?
--
Jeffrey B Brooks


Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Guest]

Try disable Automatic scanning under Tools -> Options in Windows Defender,
all other settings leave unchanged, or schedule suggestions added job to a
differrent time from setting in WD.

Still not running on any machine. Any other suggestions....or do I just
uninstall it and go back to using third party anti-spyware programs again?
--
Jeffrey B Brooks

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

:

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just
fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

--

I've installed Windows Defender on 7 different Windows 2000 computers I
own,
operate, and maintain, and none of them have successfully began running
the
daily scheduled scans I've set up. All computers tell me after 2-3
days
that
I should run regular scheduled scans, but there is no entry under
"Scheduled
Tasks" in the Control Panel that require passwords, and there is no
other
place to schedule them other than in the Tools Option Tab on the main
Windows
Defender startup screen that has been saved in all cases. Any
suggestions?
--
Jeffrey B Brooks


Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Guest]

Tried both alternatives and neither worked. Still same networking error.
--
Jeffrey B Brooks

Try disable Automatic scanning under Tools -> Options in Windows Defender,
all other settings leave unchanged, or schedule suggestions added job to a
differrent time from setting in WD.

Still not running on any machine. Any other suggestions....or do I just
uninstall it and go back to using third party anti-spyware programs again?
--
Jeffrey B Brooks

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks


:

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

:

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just
fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

--

I've installed Windows Defender on 7 different Windows 2000 computers I
own,
operate, and maintain, and none of them have successfully began running
the
daily scheduled scans I've set up. All computers tell me after 2-3
days
that
I should run regular scheduled scans, but there is no entry under
"Scheduled
Tasks" in the Control Panel that require passwords, and there is no
other
place to schedule them other than in the Tools Option Tab on the main
Windows
Defender startup screen that has been saved in all cases. Any
suggestions?
--
Jeffrey B Brooks


Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Guest]

OK. Try to start scan from command line.
Run cmd.exe, change directory to WD,
run MpCmdRun.exe Scan.
Log of this scan will be in TEMP directory of current user.
What results ?

Tried both alternatives and neither worked. Still same networking error.
--
Jeffrey B Brooks

Try disable Automatic scanning under Tools -> Options in Windows Defender,
all other settings leave unchanged, or schedule suggestions added job to a
differrent time from setting in WD.

Still not running on any machine. Any other suggestions....or do I just
uninstall it and go back to using third party anti-spyware programs again?
--
Jeffrey B Brooks


:

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks


:

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

:

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just
fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

--

I've installed Windows Defender on 7 different Windows 2000 computers I
own,
operate, and maintain, and none of them have successfully began running
the
daily scheduled scans I've set up. All computers tell me after 2-3
days
that
I should run regular scheduled scans, but there is no entry under
"Scheduled
Tasks" in the Control Panel that require passwords, and there is no
other
place to schedule them other than in the Tools Option Tab on the main
Windows
Defender startup screen that has been saved in all cases. Any
suggestions?
--
Jeffrey B Brooks


Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Guest]

I got into computers around the time of the transition from Windows 3.1 to
Windows 95 so my background in DOS is not that good. You'll have to give me
more specifics on how to try to run the program from the command line.....and
then I can give you the Temp directory results.
--
Jeffrey B Brooks

OK. Try to start scan from command line.
Run cmd.exe, change directory to WD,
run MpCmdRun.exe Scan.
Log of this scan will be in TEMP directory of current user.
What results ?

Tried both alternatives and neither worked. Still same networking error.
--
Jeffrey B Brooks

Try disable Automatic scanning under Tools -> Options in Windows Defender,
all other settings leave unchanged, or schedule suggestions added job to a
differrent time from setting in WD.

:

Still not running on any machine. Any other suggestions....or do I just
uninstall it and go back to using third party anti-spyware programs again?
--
Jeffrey B Brooks


:

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks


:

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

:

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just
fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

--

I've installed Windows Defender on 7 different Windows 2000 computers I
own,
operate, and maintain, and none of them have successfully began running
the
daily scheduled scans I've set up. All computers tell me after 2-3
days
that
I should run regular scheduled scans, but there is no entry under
"Scheduled
Tasks" in the Control Panel that require passwords, and there is no
other
place to schedule them other than in the Tools Option Tab on the main
Windows
Defender startup screen that has been saved in all cases. Any
suggestions?
--
Jeffrey B Brooks


Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Guest]

So in this case I think is better wait for the bug fix from MS. If WD updates
and real time
protection is working, you are still protected and you can abide with WD.
Malfunction of
scheduled scans "only" causes no detecting and clearing malware already in
system which
can be discovered by future definition updates.

Good luck.

I got into computers around the time of the transition from Windows 3.1 to
Windows 95 so my background in DOS is not that good. You'll have to give me
more specifics on how to try to run the program from the command line.....and
then I can give you the Temp directory results.
--
Jeffrey B Brooks

OK. Try to start scan from command line.
Run cmd.exe, change directory to WD,
run MpCmdRun.exe Scan.
Log of this scan will be in TEMP directory of current user.
What results ?

Tried both alternatives and neither worked. Still same networking error.
--
Jeffrey B Brooks


:

Try disable Automatic scanning under Tools -> Options in Windows Defender,
all other settings leave unchanged, or schedule suggestions added job to a
differrent time from setting in WD.

:

Still not running on any machine. Any other suggestions....or do I just
uninstall it and go back to using third party anti-spyware programs again?
--
Jeffrey B Brooks


:

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks


:

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

:

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just
fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

--

I've installed Windows Defender on 7 different Windows 2000 computers I
own,
operate, and maintain, and none of them have successfully began running
the
daily scheduled scans I've set up. All computers tell me after 2-3
days
that
I should run regular scheduled scans, but there is no entry under
"Scheduled
Tasks" in the Control Panel that require passwords, and there is no
other
place to schedule them other than in the Tools Option Tab on the main
Windows
Defender startup screen that has been saved in all cases. Any
suggestions?
--
Jeffrey B Brooks


Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Guest]

That sounds fine if Microsoft is aware of this as a system-wide Windows 2000
problem for Windows Defender. Do you know if they are aware and working on a
bug fix......or do I just hope?
--
Jeffrey B Brooks

So in this case I think is better wait for the bug fix from MS. If WD updates
and real time
protection is working, you are still protected and you can abide with WD.
Malfunction of
scheduled scans "only" causes no detecting and clearing malware already in
system which
can be discovered by future definition updates.

Good luck.

I got into computers around the time of the transition from Windows 3.1 to
Windows 95 so my background in DOS is not that good. You'll have to give me
more specifics on how to try to run the program from the command line.....and
then I can give you the Temp directory results.
--
Jeffrey B Brooks

OK. Try to start scan from command line.
Run cmd.exe, change directory to WD,
run MpCmdRun.exe Scan.
Log of this scan will be in TEMP directory of current user.
What results ?


:

Tried both alternatives and neither worked. Still same networking error.
--
Jeffrey B Brooks


:

Try disable Automatic scanning under Tools -> Options in Windows Defender,
all other settings leave unchanged, or schedule suggestions added job to a
differrent time from setting in WD.

:

Still not running on any machine. Any other suggestions....or do I just
uninstall it and go back to using third party anti-spyware programs again?
--
Jeffrey B Brooks


:

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks


:

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

:

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just
fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

--

I've installed Windows Defender on 7 different Windows 2000 computers I
own,
operate, and maintain, and none of them have successfully began running
the
daily scheduled scans I've set up. All computers tell me after 2-3
days
that
I should run regular scheduled scans, but there is no entry under
"Scheduled
Tasks" in the Control Panel that require passwords, and there is no
other
place to schedule them other than in the Tools Option Tab on the main
Windows
Defender startup screen that has been saved in all cases. Any
suggestions?
--
Jeffrey B Brooks


Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks

 

[Guest]

I don't know nothing about current events in Microsoft. Seems Microsoft is
seriously registering Windows 2000 WD problem with scheduled scans in build
1347.
See thread "Automatic scans don't work on Win2K" in General from 5/10/2006.

That sounds fine if Microsoft is aware of this as a system-wide Windows 2000
problem for Windows Defender. Do you know if they are aware and working on a
bug fix......or do I just hope?
--
Jeffrey B Brooks

So in this case I think is better wait for the bug fix from MS. If WD updates
and real time
protection is working, you are still protected and you can abide with WD.
Malfunction of
scheduled scans "only" causes no detecting and clearing malware already in
system which
can be discovered by future definition updates.

Good luck.

I got into computers around the time of the transition from Windows 3.1 to
Windows 95 so my background in DOS is not that good. You'll have to give me
more specifics on how to try to run the program from the command line.....and
then I can give you the Temp directory results.
--
Jeffrey B Brooks


:

OK. Try to start scan from command line.
Run cmd.exe, change directory to WD,
run MpCmdRun.exe Scan.
Log of this scan will be in TEMP directory of current user.
What results ?


:

Tried both alternatives and neither worked. Still same networking error.
--
Jeffrey B Brooks


:

Try disable Automatic scanning under Tools -> Options in Windows Defender,
all other settings leave unchanged, or schedule suggestions added job to a
differrent time from setting in WD.

:

Still not running on any machine. Any other suggestions....or do I just
uninstall it and go back to using third party anti-spyware programs again?
--
Jeffrey B Brooks


:

It was changed to run under Administrator and then NT AUTHORITY\SYSTEM.
Neither fixed the problem so changed it back to the default that it was
originally scheduled under.....even though there was never an entry under
Scheduled Tasks after I installed the program until I manually set up a
Scheduled Scan as part of trying these suggestions to fix it.
--
Jeffrey B Brooks


:

Was the service changed to start under different credentials than the
default?

--
--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I do not, do you
also
see a way to work around it?

Thanks for your time and I'll look forward to your reply,

Jeffrey B Brooks

:

I've looked at, and failed to spot, how this works on Windows 2000. I'm
sitting at a Windows 2000 server which is doing scheduled scans just
fine,
and there is no visible scheduled job.

There is, however, a log file: \winnt\temp\mpcmdrun.log.

You might check this log file with notepad to see whether there's any
information about what's happening with the scans.

--

I've installed Windows Defender on 7 different Windows 2000 computers I
own,
operate, and maintain, and none of them have successfully began running
the
daily scheduled scans I've set up. All computers tell me after 2-3
days
that
I should run regular scheduled scans, but there is no entry under
"Scheduled
Tasks" in the Control Panel that require passwords, and there is no
other
place to schedule them other than in the Tools Option Tab on the main
Windows
Defender startup screen that has been saved in all cases. Any
suggestions?
--
Jeffrey B Brooks


Bill:

I checked the log entry and spyware "dat file" updates from the Microsoft
Website are running fine, but the scans themselves are not. The exact
Error
Message is shown below and appears to refer to it being run as a
"networked
service" and it's not. It is loaded on individual machines and scheduled
to
run by an Administrator account, and the machines are always "logged on"
to
the desktops because several other anti-spyware programs I also have
running
at other times require this.

ERROR: LogonUserExW(NetworkService) Failed 8007052E
Error running as network service. hr = 0x8007052e

If you see something in the error message itself that I don't, do you also
see a way to work around it?

Thanks for your time,

Jeffrey B Brooks