Event ID 4107 or Event ID 11 is logged in the Application log in Windows and in Windows Server

Applies to: Windows Server 2012 StandardWindows Server 2012 StandardWindows Server 2012 Essentials More

Symptoms

On a computer that is running Windows 7 or Windows Server 2008 R2, an error that resembles the following is logged in the Application log:
Log Name: Application
Source: Microsoft-Windows-CAPI2
Date: Date and time
Event ID: 4107
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Computer name
Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Or, on a computer that is running Windows Vista or Windows Server 2008, an error that resembles the following is logged in the Application log:
Log Name: Application
Source: Microsoft-Windows-CAPI2
Date: Date and time
Event ID: 11
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Computer name
Description:
Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Cause

This error occurs because the Microsoft Certificate Trust List Publisher certificate expired. A copy of the CTL with an expired signing certificate exists in the CryptnetUrlCache folder.

Resolution

To have us resolve the problem for you, go to the "Fix it for me" section. If you prefer to fix this problem yourself, go to the "Let me fix it myself" section.

Fix it for me



To fix this problem automatically, click the Fix it button or link. Click Run in the File Download dialog box, and then follow the steps in the Fix it wizard.







Let me fix it myself

To resolve the problem, follow these steps:
  1. Open a command prompt. To do this, click Start Start button , click All Programs, click Accessories, and then click Command Prompt.
  2. At the command prompt, type the following command, and then press ENTER:
    certutil -urlcache * delete
    Note The certutil command must be run for every user on the workstation. Each user must login and follow steps 1 and 2 above.
  3. If the expired certificate is cached in one of the local system profiles, you must delete the contents of some directories by using Windows Explorer. To do this, follow these steps:
    1. Start Windows Explorer. To do this, click Start, click All Programs, click Accessories, and then click Windows Explorer.

      Note You must enable hidden folders to view the directories whose contents you must delete. To enable hidden files and folders, follow these steps:
      1. Click Organize, and then click Folder and search options.
      2. Click the View tab.
      3. Click to select the Show hidden files and folders check box.
      4. Click to clear the Hide extensions for known file types check box.
      5. lick to clear the Hide protected operating system files check box.
      6. Click Yes to dismiss the warning, and then click OK to apply the changes and to close the dialog box.
    2. Delete the contents of the directories that are listed here. (%windir% is the Windows directory.)

      Note You may receive a message that states that you do not have permission to access the folder. If you receive this message, Click Continue.

      LocalService:

      %windir%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
      %windir%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData

      NetworkService:
      %windir%\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
      %windir%\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData

      LocalSystem:
      %windir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content
      %windir%\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData

More Information

Additionally, event ID 4107 can also be logged with a “The data is invalid” error instead of the “A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file” error.

This error “Data is invalid” indicates the object returned from the network was not a valid cab file and hence Windows could not parse it correctly. Instances of such an error can occur when the network retrieval attempt for the cab file fails to go through a proxy. If the proxy returns some data or message instead of a standard HTTP error code, Windows will try to parse the message received from the proxy expecting it to be the cab. This will fail with the "data is invalid” error.

To address this error, you need to remove the invalid entry in the cache by clearing the cache following the steps outlined in the “Resolution” section.