Symptoms:
Critical: Your Hyper-V licensed as Essentials R2 Server shuts down weekly. You observe the log "The process C:\Windows\system32\silsvc.exe [computername] has initiated the power off of computer [computername] on behalf of user NT AUTHORITY\SYSTEM" or similar, as described here.
Non-critical: You receive an error message "The SILSVC should be started automatically but it is stopped" as described here. If this is the case, you can either follow this link for a workaround, or read further below.
Issue:
In both cases above you are running an ex-Windows Essentials that was either upgraded to Standard or stripped down to its sole Hyper-V functionality. There is a service called Server Infrastructure Licensing Service (aka silsvc if you are using sc command) that is causing the trouble after you transmogrify the Essentials edition. By the way, this Transmog term was new for me 🙂
The problem is the service cannot be stopped, neither from the services.msc nor using sc stop silsvc.
First question that needs to be cleared reads: ‘how critical is the service?’ If you look at it, there are no dependencies. Also the TechNet blog above confirms that you are not going to break your server if the service is missing or disabled.
As described by the first symptom though, you would hardly be able to restart a Hyper-V on which the productive environment is running. So how can you stop the service?
The first reasoning was to use SC from the elevated prompt: sc config "silsvc" start= disabled
Unluckily although a successful exit code is returned if you run sc query silsvc you will still see that nothing has changed and the service is still running and not stoppable. SC stop silsvc is as useless as you can imagine.
The second reasoning is to go and change the settings directly into the registry that can be found under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\silsvc. You will be confronted with security restrictions:
And you cannot add your account with Full Access permissions:
Since taking ownership on registry keys is not very comfortable for me, I decided to try a third option.
Third playground: NTFS permissions and Task Manager.
If you try to kill the process directly from the Task Manager you will most probably think that this cannot act also. By looking closely however, you will see that each time you end a task, the process ID is being changed.
Exactly this is the Achilles’ heel of the service: if you succeed in deleting or renaming the silsvc.exe file there will be nothing to start again. The file itself is precautionally NTFS protected. You will have to take ownership of the file and then grant yourself sufficient permissions to move or rename the file (I never recommend deleting!).
After adjusting the NTFS permissions and changing the file’s name and/or location you can kill the process and subsequently change the start type of the service to disabled. All can be done online without stopping any productive function.
Enjoy!
Well. I see no comments. This was incredibly helpful to me so I thought I’d leave you a note. Done the exact same setup with an R2 Essentials Hyper-V holding another Essentials VM.
Same issue. Lets see if it stops restarting!
Incredibly helpful thanks. Same setup here, R2 Essentials Hyper-V with R2 Essentials VM.
Let’s hope it doesn’t shut down again!
Hi Luke, thanks for the feedback. Logically thinking if the file was renamed there is no way to start it again, ergo nothing to restart your server 🙂
Has this worked, I am running into this on a windows sbs 2011 essentials that had the DC and DNS server roles removed since I wanted it to be in a workgroup? Has it shutdown since? Has there been any other problems?
Hi, definitely no problem after multiple restarts and updates. It works as far as I can judge based on my environment.
Just an FYI – this works for Server 2008/SBS 2011 – however I found when I killed the process it returned almost instantly – I was not able to take ownership of the silsvc.exe file either – the SYSTEM account kept taking it back. The only thing could do was attempt to give myself ownership of the file, then DENY ALL SYSTEM and EVERYONE from the file. Once that was done I was able to kill the process without it returning.
Hi PG, interesting workaround. In my case after taking ownership (and subsequently allowing me full access) of the file I could rename it and after that kill the process permanently. But your solution with denying access to SYSTEM account has the same impact. Thanks for the feedback.
Excellent additional comments Very useful in similar situation with old SBS2008 part way through removing… Had to take ownership then deny system from execute permissions so I could then rename. Technically renaming not necessary at that stage as System is unable to restart the service… Many Thanks
Has anyone contacted Microsoft on this? Those idiots don’t get their own licensing correct. They allow us to install Server 2012 R2 Essentias VM on top of Server 2012 R2 Essentials PHYSICAL, see here http://blogs.technet.com/b/sbs/archive/2013/09/03/understanding-licensing-for-windows-server-2012-r2-essentials-and-the-windows-server-essentials-experience-role.aspx
Now they just shut down my physical server because of non-compliance. Arrrrgh!!!
Hi Anguel, I totally understand the frustration. But correct licensing doesn’t explicitly mean carefree implementation. The VM on physical scenario was meant for OEMs, hence someone else should take care of disabling the service with OOBE configs.
Another example: “Windows is free on tablets with screen sizes of 9 inches or less”. I’ve never seen a system install image for that. Period.
Moodjbow, you are right. But the thing that really annoys me is that they dare to completely shutdown a properly licensed business server without displaying a single warning before doing so. I had to dig through the logs to understand what was going on, first I thought that my power supply had failed. Who do they think they are to decide when to stop our business for some stupid licensing that is not implemented properly? In the licensing description (also ridiculous that it is put on a blog, like all their non-existing docs) I don’t even see a statement that the hyper-v host server is expected to be left in a workgoup. And leaving it in a workgoup has some other negative implications regarding management etc. I had tried to find information on this and finally decided that adding the host to the domain is the best solution, of course I did not know that the server would shut down after a couple of days… I had spent so much time to make Server 2012 R2 Essentials virtual and even wrote my own how-to on my blog : http://techie-blog.blogspot.de/2014/02/windows-server-2012-r2-essentials.html
In the meantime I disabled silsvc – thank you very much for the wonderful solution! I just hope that they won’t push out some stupid update to break things completely.
I can’t find the actual silsvc.exe file…is it named something else? I looked in system32 folder
Hi Jack, not that I am aware of. Please have a look at the path properties of Server Infrastructure Licensing Service when you open services.msc.
Jack, you have to make system files visible first – go to control panel there is file / folder settings somewhere, it opens a dialog similar to old Win XP folder properties where you can tell Windows to show hidden system files. Then you just right click the silsvc.exe, take ownership as your admin accound, then you can add your admin account to permissions and give it all permissions. From now on you can rename the file, kill the process, and finally set the service to disabled. Hope this helps.
P.S.: Still can’t believe that Microsoft dares to shut down a properly licenced running business server without displaying a warning… Stupid idiots.
Just wanted to point something out. After researching (for months actually!!) a small problem where I would get 2 audit failures on startup, I have finally found the culprit. Apparently SBS adds a service called “Windows Server Identity Management Service” that is not a part of the 2008r2 server install. I disabled the service and now I no longer get the audit failures on startup. Seems to be unnecessary.
My initial reaction was ‘what the hell is silsvc.exe’ then I found your post. Definitely saved me some time- Thanks!!
(running virtualized 2012 R2 Essentials)