This article describes issues that registry bloat may cause user logon delays or cause application users to receive a "0x800705AA" error. These issues occur on computers using Windows 8.1, Windows RT 8.1, or Windows Server 2012 R2. KB 3063843 consists of a corrective fix that prevents WNF registrations from being leaked after fix installation, and the wnfcleanup tool that removes stale WNF registrations created before the installation of the leak fix. Before you install this update, review the Prerequisites section. Additional steps for configuration are required to enable this update after the installation.
Symptoms
Symptom 1
You experience slow interactive logons and RDP logons to a computer that is running Windows 8.1, Windows RT 8.1, or Windows Server 2012 R2. The explorer.exe process reads thousands of Windows Push Notification Platform (WPN) and Windows Notification Facility (WNF) values from the following registry subkey during the user logon:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NotificationsAlso, the logon may consume high CPU usage for a long period of time during using logon.
Symptom 2
You may receive an error message that resembles the following when you use an app that uses the BackgroundDownloader class:
0x800705AA ("Insufficient system resources exist to complete the requested service")
After you encounter this error, restarting the app or the system does not resolve the issue. At the same time, other apps (such as the Windows Store app) that use the BackgroundDownloader class may also experience the same error.
Cause
These issues occur because WNF registrations entries in the Notifications registry subkey are leaked, and this causes registry bloat.Leaked WNF registrations cause the Explorer.exe process to read many registry values from the notification registry subkey when the system initializes the process. Lots of WNF registrations can delay user logon and increase CPU usage.Additionally, the 0x800705AA error may occur when the BackgroundDownloader class tries to allocate a WNF state name and fails.
How to obtain this update
Important Do not install a language pack after you install this update. If you do, the language-specific changes in the update will not be applied, and you will have to reinstall the update. For more information, see Add language packs to Windows.This update improves performance when system initializes the explorer.exe process.
Method 1: Windows Update (recommended)
This update is provided as an Optional update on Windows Update. For more information on how to run Windows Update, see How to get an update through Windows Update.
Method 2: Microsoft Download Center
The following files are available for download from the Microsoft Download Center:
|
Operating system |
Update |
|---|---|
|
All supported x86-based versions of Windows 8.1 |
|
|
All supported x64-based versions of Windows 8.1 |
|
|
All supported x64-based versions of Windows Server 2012 R2 |
The update for Windows RT 8.1 can be obtained only from Windows Update. For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to obtain Microsoft support files from online services Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.
Update detail information
Prerequisites
To install this update, you must have April 2014, update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 (2919355) installed in Windows 8.1 or Windows Server 2012 R2. Note If update 2919355 is not preinstalled, the installation of update 3063843 may fail with "The update is not applicable to your computer" error.
Registry information
To apply this update, you do not have to make any changes to the registry.
Restart requirement
You may have to restart the computer after you apply this update.
Update replacement information
This update does not replace a previously released update.
The global version of this update installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.
Windows 8.1 and Windows Server 2012 R2 file information and notes
-
The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
Version
Product
Milestone
Service branch
6.3.960 0.16 xxx
Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2
RTM
GDR
6.3.960 0.17 xxx
Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2
RTM
GDR
-
GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
-
The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information" section. MUM, MANIFEST, and the associated security catalog (.cat) files, are very important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.
For all supported x86-based versions of Windows 8.1
|
File name |
File version |
File size |
Date |
Time |
Platform |
|---|---|---|---|---|---|
|
Bisrv.dll |
6.3.9600.17415 |
206,336 |
29-Oct-2014 |
00:54 |
x86 |
|
Csystemeventsbrokerclient.dll |
6.3.9600.17415 |
15,872 |
29-Oct-2014 |
01:04 |
x86 |
|
Eventaggregation.dll |
6.3.9600.17415 |
22,016 |
29-Oct-2014 |
01:04 |
x86 |
|
Systemeventsbrokerserver.dll |
6.3.9600.17827 |
207,360 |
12-May-2015 |
13:18 |
x86 |
|
Wnfcleanup.exe |
6.3.9600.17827 |
24,864 |
13-May-2015 |
22:08 |
x86 |
For all supported x64-based versions of Windows 8.1 or Windows Server 2012 R2
|
File name |
File version |
File size |
Date |
Time |
Platform |
|---|---|---|---|---|---|
|
Bisrv.dll |
6.3.9600.17415 |
270,336 |
29-Oct-2014 |
01:12 |
x64 |
|
Csystemeventsbrokerclient.dll |
6.3.9600.17415 |
20,480 |
29-Oct-2014 |
01:27 |
x64 |
|
Eventaggregation.dll |
6.3.9600.17415 |
28,160 |
29-Oct-2014 |
01:27 |
x64 |
|
Systemeventsbrokerserver.dll |
6.3.9600.17827 |
294,912 |
12-May-2015 |
13:19 |
x64 |
|
Wnfcleanup.exe |
6.3.9600.17827 |
25,376 |
13-May-2015 |
22:11 |
x64 |
For all supported Windows RT 8.1
|
File name |
File version |
File size |
Date |
Time |
Platform |
|---|---|---|---|---|---|
|
Bisrv.dll |
6.3.9600.17278 |
200,192 |
16-Aug-2014 |
00:17 |
Not applicable |
|
Csystemeventsbrokerclient.dll |
6.3.9600.16384 |
16,896 |
22-Aug-2013 |
02:18 |
Not applicable |
|
Eventaggregation.dll |
6.3.9600.16384 |
22,016 |
22-Aug-2013 |
02:18 |
Not applicable |
|
Systemeventsbrokerserver.dll |
6.3.9600.17827 |
202,240 |
12-May-2015 |
13:18 |
Not applicable |
|
Wnfcleanup.exe |
6.3.9600.17827 |
24,864 |
13-May-2015 |
22:05 |
Not applicable |
Additional file information
Additional file information for Windows 8.1 and for Windows Server 2012 R2
Additional files for all supported x86-based versions of Windows 8.1
|
File property |
Value |
|---|---|
|
File name |
X86_422e140eb67951f493acf4a158432e4b_31bf3856ad364e35_6.3.9600.17828_none_e2646b105e1e67e7.manifest |
|
File version |
Not applicable |
|
File size |
708 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:37 |
|
Platform |
Not applicable |
|
File name |
X86_9f7f8c0fb5d0980fc3b760fff73e3405_31bf3856ad364e35_6.3.9600.17828_none_b9977e7b07cf6986.manifest |
|
File version |
Not applicable |
|
File size |
706 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:37 |
|
Platform |
Not applicable |
|
File name |
X86_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_f2e3096e0fc85050.manifest |
|
File version |
Not applicable |
|
File size |
8,450 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:41 |
|
Platform |
Not applicable |
|
File name |
X86_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_5d85dbc258e120cb.manifest |
|
File version |
Not applicable |
|
File size |
16,856 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:41 |
|
Platform |
Not applicable |
Additional files for all supported x64-based versions of Windows 8.1 and of Windows Server 2012 R2
|
File property |
Value |
|---|---|
|
File name |
Amd64_be0e94fcda3ee60a1ede60fe31e5389e_31bf3856ad364e35_6.3.9600.17828_none_d1a60b293faadd63.manifest |
|
File version |
Not applicable |
|
File size |
710 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:37 |
|
Platform |
Not applicable |
|
File name |
Amd64_ee5cb5ce84252f9d3fabb4879489e10c_31bf3856ad364e35_6.3.9600.17828_none_c836fdf6567b4fd0.manifest |
|
File version |
Not applicable |
|
File size |
712 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:37 |
|
Platform |
Not applicable |
|
File name |
Amd64_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_4f01a4f1c825c186.manifest |
|
File version |
Not applicable |
|
File size |
8,456 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:45 |
|
Platform |
Not applicable |
|
File name |
Amd64_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_b9a47746113e9201.manifest |
|
File version |
Not applicable |
|
File size |
16,860 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:45 |
|
Platform |
Not applicable |
Additional files for all supported Windows RT 8.1
|
File property |
Value |
|---|---|
|
File name |
Arm_64b15a158868e8846656a5536f4db8de_31bf3856ad364e35_6.3.9600.17828_none_625f9a4efd2f86a1.manifest |
|
File version |
Not applicable |
|
File size |
706 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:37 |
|
Platform |
Not applicable |
|
File name |
Arm_92b5141a9db799e78ed4fe090155570e_31bf3856ad364e35_6.3.9600.17828_none_a4739496745a1a93.manifest |
|
File version |
Not applicable |
|
File size |
708 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:37 |
|
Platform |
Not applicable |
|
File name |
Arm_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_f2e57bc60fc56f16.manifest |
|
File version |
Not applicable |
|
File size |
8,450 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:37 |
|
Platform |
Not applicable |
|
File name |
Arm_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_5d884e1a58de3f91.manifest |
|
File version |
Not applicable |
|
File size |
16,856 |
|
Date (UTC) |
13-May-2015 |
|
Time (UTC) |
21:37 |
|
Platform |
Not applicable |
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
References
See the terminology that Microsoft uses to describe software updates.
More Information
Additional steps for configurationWe recommend that you install this update through Windows Update as doing this installs the fix and removes the leaked registrations.If you download the package directly from the Microsoft Download Center, you have to manually extract the wnfcleanup tool from the MSU package. To extract the cleanup tool from the MSU package by opening an elevated command prompt by using Run as administrator, run the following commands in order:
MD c:\wnfcleanupCopy %userprofile%\Downloads\Windows8.1-KB3063843-* c:\wnfcleanupCD \wnfcleanupexpand Windows8.1-KB3063843-*.msu -F:wnfcleanup.exe .\
Note The full stop (.\) is important as it says to extract the EXE to the current location where the MSU is.Then, create a scheduled task to clean up the existing registry entries by running the wnfcleanup.exe tool as SYSTEM.The following commands should be run in an elevated command prompt to create a scheduled task. The task executes a command as SYSTEM to run the cleanup tool. Then, the task is deleted.
SCHTASKS /create /f /SC hourly /TN Wnfcleanup /TR "cmd /c c:\wnfcleanup\wnfcleanup.exe -delete" /RU "SYSTEM" SCHTASKS /run /I /TN "Wnfcleanup"
Note "c:\wnfcleanup\wnfcleanup.exe" is a location that is used in this example. You should modify this to reflect the exact drive and path where the wnfcleanup tool was extracted to if you did not follow the earlier instructions exactly.Now leave the system for several minutes so that the task can execute and be completed. You can check the status of the Wnfcleanup task to see whether it has completed and returned to the "ready" state by running the following commands:
SCHTASKS /QUERY /V | findstr /I "wnfcleanup" > .\cleanup.txtCleanup.txt
Note The Cleanup.txt should show a status of "Ready." If it shows as "Running," rerun the two commands above. As soon as the status shows "Ready," locate "cmd /c c:\wnfcleanup\wnfcleanup.exe -delete" in the Clanup.txt. Immediately to the left is the result code that is followed by the account name which created the scheduled task. It will be as follows "0 Administrator." The result code should be "0" that indicates the task ran successfully.As soon as it is completed, delete the task:
SCHTASKS /delete /TN "Wnfcleanup" /f
You can now delete the c:\wnfcleanup directory that you created and its contents.Note The wnfcleanup tool must be run in the SYSTEM security context. This is why the task scheduler is used. Or, you could run it by using a tool such as PsExec.
About Windows Push Notification Platform Windows Push Notification Platform is a component that exposes a notification sink to notify of notification changes, and an API to communicate how to interact with the notifications.
About Windows Notification FacilityWindows Notification Facility is an infrastructure for secured publish-subscribe messaging among kernel components, system services, and user-space applications.When you try to register for a notification to a new state name, there will be a potential access to the registry. All state name definitions are stored in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications.
