You know when something doesn't work and as soon as you start digging, starts pulling another, and another, and another …?
As it is. It all started with a VHD larger than I should. And arrived at the event Log service of Windows that did not work.
But at least now everything is working normally.
On the new series of posts about legacy control in TFS, I needed to go up a virtual machine with Windows 7 x 86. After installing what I needed and run Windows Update (almost 300 updates!), I came across a problem: Although the guest be using only 18 GB of disk space, the VHD had been fully expanded (consuming their maximum of 127 GB).
I tried to use the Compact of Hyper-V (which removes the free disk space to reduce their consumption on the host) but he failed to reduce anything, which typically indicates a virtual disk fragmented. To be able to compress it would need, first, defragment the guest. And that's where the story starts to get fun.
When I tried to run the Disk Defragmenter in Windows 7 VM's, I got the following error:
Disk Defragmenter cannot start because the task scheduler service is not running. Start the task scheduler service and try again.
Weird, huh? Well, I was checking out and the Task Scheduler service was stopped. When I try to start it manually, another error:
Windows could not start the Task Scheduler service on Local Computer. Error 1068: The dependency service or group failed to start.
UM, so is there a service that depends on Task Scheduler and it's not working. What are the services it depends on?
Now that I know the Task Scheduler relies on two services (Remote Procedure Call, Windows Event Log), I need to see if any of them is stopped and can't climb. The RPC service was normal; already the service Windows Event Log was in trouble:
Windows could not start the Windows Event Log service on Local Computer. Error 1079: The account specified for this service is different from the account specified for other services running in the same process.
Jeez! The event Log is not working!
The error message, oddly enough, is very clear: the event Log is configured to use a different account to other services that are running within the same Host. You know that svchost.exe process that you see in the Task Manager and you have no idea what? So, he is a Host of services, "hosting" services such as the Task Scheduler.
Looking on the internet for 1079 error message, I found an article from the Microsoft Knowledge Base ("KB article") talking about the problem, indicating that it is a known error. The solution is to change the logon account of the Task Scheduler service, changing System to LocalService.
In an elevated prompt, run the following command line:
sc.exe config "eventlog" obj = "NT AUTHORITYLocalService"
Restart the computer and voila! -everything back