Failed to schedule Software Protection service on Windows Server 2008 R2 with Event ID: 16385

If you see an error “Failed to schedule Software Protection service” in event log with Event ID:  16385 on Windows Server 2008 R2, you can try below steps to fix the problem.

Run the below mentioned commands sequentially one by one from elevated cmd (Run as admin).

icacls %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /grant “BUILTIN\Administrators:(OI)(CI)(F)” “NT AUTHORITY\SYSTEM:(OI)(CI)(F)” “NT Service\sppsvc:(OI)(CI)(R,W,D)” “NETWORK SERVICE:(OI)(CI)(F)”

net stop sppsvc && net start sppsvc

Tagged with: , ,
Posted in Break-Fix, Event ID
4 comments on “Failed to schedule Software Protection service on Windows Server 2008 R2 with Event ID: 16385
  1. Santosh, can you provide any information about how/why changing the ACL for the SoftwareProtectionPlatform folder fixes the issue of the Software Protection Service starting and stopping every 5 minutes?

    Is there a known bug associated with this behavior, or is it indended? Like many others, I am interested in the details of this because it constantly generates alerts in our monitoring system when the service stops.

    Thank you very much!

  2. hey Sam,

    As far as I know or I had noticed, this issue occurs, if you change the ownership of Windows and it’s sub folders &/ change any default NTFS permissions on Windows and it’s sub folders. Changed permissions on Windows or it’s sub folders somehow (not sure how) affects permissions of Tokens.dat file and Token.dat file’s default permissions are altered which causes errors.

    Applying the correct ACL on Tokens.dat file fixes the issue.

  3. Ah, ok thanks. In my case I am seeing this service stop and start numerous times per day on all new server builds, with no ACL changes to the image. Unfortunately this post does not address the issue, but I will keep it in mind!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s