SharePoint 2010 Administration Service won’t start

This one had me banging my head against the wall for a while. On our two web front-ends, the SharePoint 2010 Administration Service would not start. The only difference between the WFE’s and the App servers where the service was working, was some firewall rules.

I could not find useful information in the Windows Event logs. A couple errors, the most prominent bein “Error 1053: The service did not respond to the start or control request in a timely fashion” is not very helpful. I also found some Event ID 4656 audit failure errors in the security log that coincide with when I try to start the service. Lots of advice on turning off logging for this particular event, but nothing I found that told me what kind of problem would cause that error.

Finally, I found this blog which was short on details: http://blogs.microsoft.co.il/blogs/or_biran/archive/2012/06/24/wus-warning-sharepoint-2010-administration-service-not-started-kb2677070.aspx , but it turned out to be the cause of my pain.

Microsoft patch kb2677070 is an automatic updater of revoked security certificates. It will let Windows Server go out to the internet, get an updated list of revoked certificates, and make security decisions based on that. But if your server is firewalled away in a DMZ and does not have unfettered internet access, this call to the find the updated revocation list will fail. When it does, the SharePoint 2010 Administration service will not start.

To fix this problem, you can uninstall the patch, or disable the network check in group policy. Some have reported that uninstalling the patch does not fix the problem. I couldn’t find the patch in add/remove programs, and I wonder if there isn’t a newer patch that might include this “functionality”. Anyway, disabling the network check fixed the issue for me. Here’s how to do it:

• Open Group Policy Editor. From start->search box, type in gpedit.msc and hit return.
• Navigate to Computer Configuration->Windows Settings->Public Key Policies-> Certificate Path Validation Settings.
• Click on the “Network Retrieval” tab.
• Check the “Define these policy settings” and uncheck the “Automatically update certificates in the Microsoft Root Certificate Program”
• Click OK

Now try to start your SharePoint 2010 Administration service.