This article describes issues that registry bloat may cause user logon delays or cause application users to receive a "0x800705AA" error. These issues occur on computers using Windows 8.1, Windows RT 8.1, or Windows Server 2012 R2. KB 3063843 consists of a corrective fix that prevents WNF registrations from being leaked after fix installation, and the wnfcleanup tool that removes stale WNF registrations created before the installation of the leak fix. Before you install this update, review the Prerequisites section. Additional steps for configuration are required to enable this update after the installation.

Symptoms

Symptom 1

You experience slow interactive logons and RDP logons to a computer that is running Windows 8.1, Windows RT 8.1, or Windows Server 2012 R2.

The explorer.exe process reads thousands of Windows Push Notification Platform (WPN) and Windows Notification Facility (WNF) values from the following registry subkey during the user logon:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications
Also, the logon may consume high CPU usage for a long period of time during using logon.

Symptom 2

You may receive an error message that resembles the following when you use an app that uses the BackgroundDownloader class:

0x800705AA ("Insufficient system resources exist to complete the requested service")


After you encounter this error, restarting the app or the system does not resolve the issue. At the same time, other apps (such as the Windows Store app) that use the BackgroundDownloader class may also experience the same error.

Cause

These issues occur because WNF registrations entries in the Notifications registry subkey are leaked, and this causes registry bloat.

Leaked WNF registrations cause the Explorer.exe process to read many registry values from the notification registry subkey when the system initializes the process. Lots of WNF registrations can delay user logon and increase CPU usage.

Additionally, the 0x800705AA error may occur when the BackgroundDownloader class tries to allocate a WNF state name and fails.

How to obtain this update

Important Do not install a language pack after you install this update. If you do, the language-specific changes in the update will not be applied, and you will have to reinstall the update. For more information, see Add language packs to Windows.

This update improves performance when system initializes the explorer.exe process.

Method 1: Windows Update (recommended)

This update is provided as an Optional update on Windows Update. For more information on how to run Windows Update, see How to get an update through Windows Update.

Method 2: Microsoft Download Center

The following files are available for download from the Microsoft Download Center:

Operating system

Update

All supported x86-based versions of Windows 8.1

Download Download the package now.

All supported x64-based versions of Windows 8.1

Download Download the package now.

All supported x64-based versions of Windows Server 2012 R2

Download Download the package now.

The update for Windows RT 8.1 can be obtained only from Windows Update.



For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Update detail information

Prerequisites

To install this update, you must have April 2014, update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 (2919355) installed in Windows 8.1 or Windows Server 2012 R2.

Note If update 2919355 is not preinstalled, the installation of update 3063843 may fail with "The update is not applicable to your computer" error.

Registry information

To apply this update, you do not have to make any changes to the registry.

Restart requirement

You may have to restart the computer after you apply this update.

Update replacement information

This update does not replace a previously released update.

The global version of this update installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.

Windows 8.1 and Windows Server 2012 R2 file information and notes


  • The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:

    Version

    Product

    Milestone

    Service branch

    6.3.960 0.16 xxx

    Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

    RTM

    GDR

    6.3.960 0.17 xxx

    Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

    RTM

    GDR

  • GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

  • The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information" section. MUM, MANIFEST, and the associated security catalog (.cat) files, are very important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows 8.1

File name

File version

File size

Date

Time

Platform

Bisrv.dll

6.3.9600.17415

206,336

29-Oct-2014

00:54

x86

Csystemeventsbrokerclient.dll

6.3.9600.17415

15,872

29-Oct-2014

01:04

x86

Eventaggregation.dll

6.3.9600.17415

22,016

29-Oct-2014

01:04

x86

Systemeventsbrokerserver.dll

6.3.9600.17827

207,360

12-May-2015

13:18

x86

Wnfcleanup.exe

6.3.9600.17827

24,864

13-May-2015

22:08

x86

For all supported x64-based versions of Windows 8.1 or Windows Server 2012 R2

File name

File version

File size

Date

Time

Platform

Bisrv.dll

6.3.9600.17415

270,336

29-Oct-2014

01:12

x64

Csystemeventsbrokerclient.dll

6.3.9600.17415

20,480

29-Oct-2014

01:27

x64

Eventaggregation.dll

6.3.9600.17415

28,160

29-Oct-2014

01:27

x64

Systemeventsbrokerserver.dll

6.3.9600.17827

294,912

12-May-2015

13:19

x64

Wnfcleanup.exe

6.3.9600.17827

25,376

13-May-2015

22:11

x64

For all supported Windows RT 8.1

File name

File version

File size

Date

Time

Platform

Bisrv.dll

6.3.9600.17278

200,192

16-Aug-2014

00:17

Not applicable

Csystemeventsbrokerclient.dll

6.3.9600.16384

16,896

22-Aug-2013

02:18

Not applicable

Eventaggregation.dll

6.3.9600.16384

22,016

22-Aug-2013

02:18

Not applicable

Systemeventsbrokerserver.dll

6.3.9600.17827

202,240

12-May-2015

13:18

Not applicable

Wnfcleanup.exe

6.3.9600.17827

24,864

13-May-2015

22:05

Not applicable





Additional file information


Additional file information for Windows 8.1 and for Windows Server 2012 R2


Additional files for all supported x86-based versions of Windows 8.1

File property

Value

File name

X86_422e140eb67951f493acf4a158432e4b_31bf3856ad364e35_6.3.9600.17828_none_e2646b105e1e67e7.manifest

File version

Not applicable

File size

708

Date (UTC)

13-May-2015

Time (UTC)

21:37

Platform

Not applicable

File name

X86_9f7f8c0fb5d0980fc3b760fff73e3405_31bf3856ad364e35_6.3.9600.17828_none_b9977e7b07cf6986.manifest

File version

Not applicable

File size

706

Date (UTC)

13-May-2015

Time (UTC)

21:37

Platform

Not applicable

File name

X86_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_f2e3096e0fc85050.manifest

File version

Not applicable

File size

8,450

Date (UTC)

13-May-2015

Time (UTC)

21:41

Platform

Not applicable

File name

X86_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_5d85dbc258e120cb.manifest

File version

Not applicable

File size

16,856

Date (UTC)

13-May-2015

Time (UTC)

21:41

Platform

Not applicable


Additional files for all supported x64-based versions of Windows 8.1 and of Windows Server 2012 R2

File property

Value

File name

Amd64_be0e94fcda3ee60a1ede60fe31e5389e_31bf3856ad364e35_6.3.9600.17828_none_d1a60b293faadd63.manifest

File version

Not applicable

File size

710

Date (UTC)

13-May-2015

Time (UTC)

21:37

Platform

Not applicable

File name

Amd64_ee5cb5ce84252f9d3fabb4879489e10c_31bf3856ad364e35_6.3.9600.17828_none_c836fdf6567b4fd0.manifest

File version

Not applicable

File size

712

Date (UTC)

13-May-2015

Time (UTC)

21:37

Platform

Not applicable

File name

Amd64_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_4f01a4f1c825c186.manifest

File version

Not applicable

File size

8,456

Date (UTC)

13-May-2015

Time (UTC)

21:45

Platform

Not applicable

File name

Amd64_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_b9a47746113e9201.manifest

File version

Not applicable

File size

16,860

Date (UTC)

13-May-2015

Time (UTC)

21:45

Platform

Not applicable

Additional files for all supported Windows RT 8.1

File property

Value

File name

Arm_64b15a158868e8846656a5536f4db8de_31bf3856ad364e35_6.3.9600.17828_none_625f9a4efd2f86a1.manifest

File version

Not applicable

File size

706

Date (UTC)

13-May-2015

Time (UTC)

21:37

Platform

Not applicable

File name

Arm_92b5141a9db799e78ed4fe090155570e_31bf3856ad364e35_6.3.9600.17828_none_a4739496745a1a93.manifest

File version

Not applicable

File size

708

Date (UTC)

13-May-2015

Time (UTC)

21:37

Platform

Not applicable

File name

Arm_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_f2e57bc60fc56f16.manifest

File version

Not applicable

File size

8,450

Date (UTC)

13-May-2015

Time (UTC)

21:37

Platform

Not applicable

File name

Arm_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_5d884e1a58de3f91.manifest

File version

Not applicable

File size

16,856

Date (UTC)

13-May-2015

Time (UTC)

21:37

Platform

Not applicable




Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References

See the terminology that Microsoft uses to describe software updates.

More Information

Additional steps for configurationWe recommend that you install this update through Windows Update as doing this installs the fix and removes the leaked registrations.

If you download the package directly from the Microsoft Download Center, you have to manually extract the wnfcleanup tool from the MSU package. To extract the cleanup tool from the MSU package by opening an elevated command prompt by using Run as administrator, run the following commands in order:

MD c:\wnfcleanup
Copy %userprofile%\Downloads\Windows8.1-KB3063843-* c:\wnfcleanup
CD \wnfcleanup
expand Windows8.1-KB3063843-*.msu -F:wnfcleanup.exe .\


Note The full stop (.\) is important as it says to extract the EXE to the current location where the MSU is.

Then, create a scheduled task to clean up the existing registry entries by running the wnfcleanup.exe tool as SYSTEM.
The following commands should be run in an elevated command prompt to create a scheduled task. The task executes a command as SYSTEM to run the cleanup tool. Then, the task is deleted.

SCHTASKS /create /f /SC hourly /TN Wnfcleanup /TR "cmd /c c:\wnfcleanup\wnfcleanup.exe -delete" /RU "SYSTEM" 
SCHTASKS /run /I /TN "Wnfcleanup"

Note "c:\wnfcleanup\wnfcleanup.exe" is a location that is used in this example. You should modify this to reflect the exact drive and path where the wnfcleanup tool was extracted to if you did not follow the earlier instructions exactly.

Now leave the system for several minutes so that the task can execute and be completed. You can check the status of the Wnfcleanup task to see whether it has completed and returned to the "ready" state by running the following commands:

SCHTASKS /QUERY /V | findstr /I "wnfcleanup" > .\cleanup.txt
Cleanup.txt

Note The Cleanup.txt should show a status of "Ready." If it shows as "Running," rerun the two commands above. As soon as the status shows "Ready," locate "cmd /c c:\wnfcleanup\wnfcleanup.exe -delete" in the Clanup.txt.  Immediately to the left is the result code that is followed by the account name which created the scheduled task.  It will be as follows "0 Administrator." The result code should be "0" that indicates the task ran successfully.

As soon as it is completed, delete the task:

SCHTASKS /delete /TN "Wnfcleanup" /f

You can now delete the c:\wnfcleanup directory that you created and its contents.

Note The wnfcleanup tool must be run in the SYSTEM security context. This is why the task scheduler is used. Or, you could run it by using a tool such as PsExec.


About Windows Push Notification Platform Windows Push Notification Platform is a component that exposes a notification sink to notify of notification changes, and an API to communicate how to interact with the notifications.

About Windows Notification FacilityWindows Notification Facility is an infrastructure for secured publish-subscribe messaging among kernel components, system services, and user-space applications.

When you try to register for a notification to a new state name, there will be a potential access to the registry. All state name definitions are stored in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications.

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

What affected your experience?

Thank you for your feedback!

×