Ghosts and ghouls in your server: 0x80004015 -- NT Service out-of-body experience

Authors in the New Age genre like to quote so called out-of-body-experience like memories of people who survivedd clinical death, tunnel with the light in the end and so on. Today I found that this is not a purely human phenomena...

Suppose you wrote an NT service and implemented a COM object inside. Sure thing, you have to call CoRegisterClassObject to register the class factory. Then you quickly start and stop your service and CoRegisterClassObject returns 0x80004015, which means that identity to run COM object and identity of the process don't match. EXCUSE ME? BUT HOW? The only way to do so is to set RunAs property on AppId registry key for your class CLSID, and you did not do that!!!

Well, the secret is easy. Your initialization got a little late and your process already got shutdown event and even killed most of the threads. While it prepares itself for the better world and observes the light in the end of the tunnel, it's idenity SYSTEM evaporates and it transgresses into a new, sort of semi-divine entity that exists mostly as a memory inside the OS core... The problem is that what's allowed to SYSTEM, is not allowed to Jupiter, including registering a class with a different identity. Amazing, isn't it?

And the fix is easy. It only happens if your service already shuts down, so you can just ignore this specific code. Well, not always -- it can also mean that your registry is bad -- but in this specific case that's just it. One-line fix, a whole day of investigation!...

Comments

• Anonymous
  November 15, 2007
  so what do u suggest , cause we are not super developers like u and do not understand a s***

• Anonymous
  November 26, 2007
  As I said in the end, in most cases just ignore the code. Leave a trace for investigation if it happens during the testing. If you can distinct the state of shutdown, ignore it just in this case (you are shutting down anyway, why bother?)