Symptom
There are occasions where Claims To Windows Token Service (c2WTS) is unable to start automatically after a reboot. The Application Event Log will also show that c2WTS timed out, and, in a later entry that Cryptographic Services Service was started. When c2WTS starts automatically, the Application Event Log will show Cryptographic Services Service starting before c2WTS. This can happen specially in SharePoint 2010 when Claims to Windows Service is configured in one or more servers.
Cause
Claims To Windows Token Service (c2WTS) has a dependency on Cryptographic Services but this dependency is not added to the service definition. Since the execution order of the services are not guaranteed to happen in any specific order unless it is defined in the service dependencies, it may lead to intermittent problems where c2WTS service will time out and fail to start. Observing the Application Event Viewer, you can see that Cryptographic Services Service was trying to start while c2WTS was also starting and it timed out just before Cryptographic Services Service has started.
c2WTS is part of the Windows Identity Foundation framework (WIF) which is one of the dependencies of SharePoint. The framework installation does not include the service dependency automatically.
Resolution
The solution is to make sure that Cryptographic Services Service is guaranteed to start before c2WTS starts by explicitly adding the dependency in the service definition. These steps will add the dependency:
1. Open the command-prompt window.
2. Type: sc config c2wts depend= CryptSvc
3. Find the Claims to Windows Token Service in the services console (click Start | Run | services.msc).
4. Open the properties for the service.
5. Check the Dependencies tab. Make sure Cryptographic Services is listed.
6. Click OK.
The next time the system reboots, Cryptography Services will start before c2WTS starts which resolves the dependency problem and the intermittent problem. If you are using SharePoint 2010 this must be done in all servers running the service.
More Information
Identity delegation for PerformancePoint Services (SharePoint Server 2010)
http://technet.microsoft.com/en-us/library/gg502603.aspx
