Summary
The SPNT Normal Server shows a STOP sign and any attempt to restart the service fails.
The following events appear in the Event Viewer System Logs when the new start service is found to be a duplicate:
- 203 - RPC Server start error! Return Code: 1740
- 210 - ServerProtect service could not be started! Return Code 1114
Details
To resolve the issue:
- Open the Task Manager.
- Click the Process tab. Check if Spntsvc.exe is listed. This is the process to be terminated.
- Terminate the process.
If this does not work, then follow these steps:
- Write down the PID of the Spntsvc.exe process.
- Open a DOS prompt and change the command line to point to the ServerProtect's home directory.
- Execute this command:
spntsvc /x 12345Where: 12345 is the PID of the Spntsvc.exe process.
- Watch out for any further spntsvc process instance. You can now try to kill process instances.
- Restart the ServerProtect service.
Download and apply the latest patch for ServerProtect.
If you encounter issues when applying the Patch, do the following:
Note: Take note of the any scheduled task running during the Service crash>
- Enable spnt.log debugging before the Trend service crash. The spnt.log on the registry.
Important: Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
- Open the regedit file and go to HKEY_LOCAL_MACHINE\Software\TrendMicro\DebugLog\SPNT.
Note: Create this file if it does not exist.Create or modify the String value HomeDirectory to the preferred complete path and filename for the log (Example: C:\spnt.log).
- Create or modify the DWORD value MethodMask to 0x00000002 (2).
- Create or modify the DWORD value ModuleMask to 0xFFFFFFFF (4294967295).
- Create or modify the DWORD value TypeMask to 0x00000003 (3).
- Close the registry editor.
Note: Make sure there is enough disk space on the target drive to hold the log.
- Gather the SPNT.log file and turn off the debug by turning off the spnt.log file by following the same procedure as enabling it but this time set MethodMask and ModuleMask to 0x00000000 (0).
- Open the regedit file and go to HKEY_LOCAL_MACHINE\Software\TrendMicro\DebugLog\SPNT.
- Get the drwtsn32.log. To enable Doctor Watson, refer to the following Microsoft solution article: How to disable or enable Dr. Watson for Windows.
- Latest application and system event logs.
- Export copy of SPROTECT directory list with version and build number to verify if the latest Patches has been applied successfully on the Normal Server.
- The admin.csv of both the Information and Normal Server. This is typically located at:\Program Files\Trend\Sprotect directory.
- Get a copy copy of the spntlog.dbf & spntlog.cdx. These are usually located at:\Program Files\Trend\SProtect\SpntLog\ directory.
