Registry bloat causes slow logons or insufficient system resources error 0x800705AA in Windows 8.1

This article describes issues that registry bloat may cause user logon delays or cause application users to receive a "0x800705AA" error. These issues occur on computers using Windows 8.1, Windows RT 8.1, or Windows Server 2012 R2. KB 3063843 consists of a corrective fix that prevents WNF registrations from being leaked after fix installation, and the wnfcleanup tool that removes stale WNF registrations created before the installation of the leak fix. Before you install this update, review the Prerequisites section. Additional steps for configuration are required to enable this update after the installation.
Symptoms

Symptom 1

You experience slow interactive logons and RDP logons to a computer that is running Windows 8.1, Windows RT 8.1, or Windows Server 2012 R2.

The explorer.exe process reads thousands of Windows Push Notification Platform (WPN) and Windows Notification Facility (WNF) values from the following registry subkey during the user logon:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications

Also, the logon may consume high CPU usage for a long period of time during using logon.

Symptom 2

You may receive an error message that resembles the following when you use an app that uses the BackgroundDownloader class:
0x800705AA ("Insufficient system resources exist to complete the requested service")

After you encounter this error, restarting the app or the system does not resolve the issue. At the same time, other apps (such as the Windows Store app) that use the BackgroundDownloader class may also experience the same error.
Cause
These issues occur because WNF registrations entries in the Notifications registry subkey are leaked, and this causes registry bloat.

Leaked WNF registrations cause the Explorer.exe process to read many registry values from the notification registry subkey when the system initializes the process. Lots of WNF registrations can delay user logon and increase CPU usage.

Additionally, the 0x800705AA error may occur when the BackgroundDownloader class tries to allocate a WNF state name and fails.
How to obtain this update
Important Do not install a language pack after you install this update. If you do, the language-specific changes in the update will not be applied, and you will have to reinstall the update. For more information, see Add language packs to Windows.

This update improves performance when system initializes the explorer.exe process.

Method 1: Windows Update (recommended)

This update is provided as an Optional update on Windows Update. For more information on how to run Windows Update, see How to get an update through Windows Update.

Method 2: Microsoft Download Center

The following files are available for download from the Microsoft Download Center:
Operating systemUpdate
All supported x86-based versions of Windows 8.1DownloadDownload the package now.
All supported x64-based versions of Windows 8.1 DownloadDownload the package now.
All supported x64-based versions of Windows Server 2012 R2DownloadDownload the package now.
The update for Windows RT 8.1 can be obtained only from Windows Update.
For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Update detail information

Prerequisites

To install this update, you must have April 2014, update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 (2919355) installed in Windows 8.1 or Windows Server 2012 R2.

Note If update 2919355 is not preinstalled, the installation of update 3063843 may fail with "The update is not applicable to your computer" error.

Registry information

To apply this update, you do not have to make any changes to the registry.

Restart requirement

You may have to restart the computer after you apply this update.

Update replacement information

This update does not replace a previously released update.

File information

The global version of this update installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.

Windows 8.1 and Windows Server 2012 R2 file information and notes


  • The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
    VersionProductMilestoneService branch
    6.3.960 0.16 xxxWindows RT 8.1, Windows 8.1, and Windows Server 2012 R2RTMGDR
    6.3.960 0.17 xxxWindows RT 8.1, Windows 8.1, and Windows Server 2012 R2RTMGDR
  • GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
  • The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately in the "Additional file information" section. MUM, MANIFEST, and the associated security catalog (.cat) files, are very important to maintain the state of the updated components. The security catalog files, for which the attributes are not listed, are signed with a Microsoft digital signature.
For all supported x86-based versions of Windows 8.1
File nameFile versionFile sizeDateTimePlatform
Bisrv.dll6.3.9600.17415206,33629-Oct-201400:54x86
Csystemeventsbrokerclient.dll6.3.9600.1741515,87229-Oct-201401:04x86
Eventaggregation.dll6.3.9600.1741522,01629-Oct-201401:04x86
Systemeventsbrokerserver.dll6.3.9600.17827207,36012-May-201513:18x86
Wnfcleanup.exe6.3.9600.1782724,86413-May-201522:08x86
For all supported x64-based versions of Windows 8.1 or Windows Server 2012 R2
File nameFile versionFile sizeDateTimePlatform
Bisrv.dll6.3.9600.17415270,33629-Oct-201401:12x64
Csystemeventsbrokerclient.dll6.3.9600.1741520,48029-Oct-201401:27x64
Eventaggregation.dll6.3.9600.1741528,16029-Oct-201401:27x64
Systemeventsbrokerserver.dll6.3.9600.17827294,91212-May-201513:19x64
Wnfcleanup.exe6.3.9600.1782725,37613-May-201522:11x64
For all supported Windows RT 8.1
File nameFile versionFile sizeDateTimePlatform
Bisrv.dll6.3.9600.17278200,19216-Aug-201400:17Not applicable
Csystemeventsbrokerclient.dll6.3.9600.1638416,89622-Aug-201302:18Not applicable
Eventaggregation.dll6.3.9600.1638422,01622-Aug-201302:18Not applicable
Systemeventsbrokerserver.dll6.3.9600.17827202,24012-May-201513:18Not applicable
Wnfcleanup.exe6.3.9600.1782724,86413-May-201522:05Not applicable




Additional file information


Additional file information for Windows 8.1 and for Windows Server 2012 R2

Additional files for all supported x86-based versions of Windows 8.1
File propertyValue
File nameX86_422e140eb67951f493acf4a158432e4b_31bf3856ad364e35_6.3.9600.17828_none_e2646b105e1e67e7.manifest
File versionNot applicable
File size708
Date (UTC)13-May-2015
Time (UTC)21:37
PlatformNot applicable
File nameX86_9f7f8c0fb5d0980fc3b760fff73e3405_31bf3856ad364e35_6.3.9600.17828_none_b9977e7b07cf6986.manifest
File versionNot applicable
File size706
Date (UTC)13-May-2015
Time (UTC)21:37
PlatformNot applicable
File nameX86_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_f2e3096e0fc85050.manifest
File versionNot applicable
File size8,450
Date (UTC)13-May-2015
Time (UTC)21:41
PlatformNot applicable
File nameX86_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_5d85dbc258e120cb.manifest
File versionNot applicable
File size16,856
Date (UTC)13-May-2015
Time (UTC)21:41
PlatformNot applicable

Additional files for all supported x64-based versions of Windows 8.1 and of Windows Server 2012 R2
File propertyValue
File nameAmd64_be0e94fcda3ee60a1ede60fe31e5389e_31bf3856ad364e35_6.3.9600.17828_none_d1a60b293faadd63.manifest
File versionNot applicable
File size710
Date (UTC)13-May-2015
Time (UTC)21:37
PlatformNot applicable
File nameAmd64_ee5cb5ce84252f9d3fabb4879489e10c_31bf3856ad364e35_6.3.9600.17828_none_c836fdf6567b4fd0.manifest
File versionNot applicable
File size712
Date (UTC)13-May-2015
Time (UTC)21:37
PlatformNot applicable
File nameAmd64_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_4f01a4f1c825c186.manifest
File versionNot applicable
File size8,456
Date (UTC)13-May-2015
Time (UTC)21:45
PlatformNot applicable
File nameAmd64_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_b9a47746113e9201.manifest
File versionNot applicable
File size16,860
Date (UTC)13-May-2015
Time (UTC)21:45
PlatformNot applicable
Additional files for all supported Windows RT 8.1
File propertyValue
File nameArm_64b15a158868e8846656a5536f4db8de_31bf3856ad364e35_6.3.9600.17828_none_625f9a4efd2f86a1.manifest
File versionNot applicable
File size706
Date (UTC)13-May-2015
Time (UTC)21:37
PlatformNot applicable
File nameArm_92b5141a9db799e78ed4fe090155570e_31bf3856ad364e35_6.3.9600.17828_none_a4739496745a1a93.manifest
File versionNot applicable
File size708
Date (UTC)13-May-2015
Time (UTC)21:37
PlatformNot applicable
File nameArm_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_6.3.9600.17828_none_f2e57bc60fc56f16.manifest
File versionNot applicable
File size8,450
Date (UTC)13-May-2015
Time (UTC)21:37
PlatformNot applicable
File nameArm_microsoft-windows-systemeventsbroker_31bf3856ad364e35_6.3.9600.17828_none_5d884e1a58de3f91.manifest
File versionNot applicable
File size16,856
Date (UTC)13-May-2015
Time (UTC)21:37
PlatformNot applicable


Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
References
See the terminology that Microsoft uses to describe software updates.
More information

Additional steps for configuration

We recommend that you install this update through Windows Update as doing this installs the fix and removes the leaked registrations.

If you download the package directly from the Microsoft Download Center, you have to manually extract the wnfcleanup tool from the MSU package. To extract the cleanup tool from the MSU package by opening an elevated command prompt by using Run as administrator, run the following commands in order:
MD c:\wnfcleanupCopy %userprofile%\Downloads\Windows8.1-KB3063843-* c:\wnfcleanupCD \wnfcleanupexpand Windows8.1-KB3063843-*.msu -F:wnfcleanup.exe .\

Note The full stop (.\) is important as it says to extract the EXE to the current location where the MSU is.

Then, create a scheduled task to clean up the existing registry entries by running the wnfcleanup.exe tool as SYSTEM.
The following commands should be run in an elevated command prompt to create a scheduled task. The task executes a command as SYSTEM to run the cleanup tool. Then, the task is deleted.
SCHTASKS /create /f /SC hourly /TN Wnfcleanup /TR "cmd /c c:\wnfcleanup\wnfcleanup.exe -delete" /RU "SYSTEM" SCHTASKS /run /I /TN "Wnfcleanup"
Note "c:\wnfcleanup\wnfcleanup.exe" is a location that is used in this example. You should modify this to reflect the exact drive and path where the wnfcleanup tool was extracted to if you did not follow the earlier instructions exactly.

Now leave the system for several minutes so that the task can execute and be completed. You can check the status of the Wnfcleanup task to see whether it has completed and returned to the "ready" state by running the following commands:
SCHTASKS /QUERY /V | findstr /I "wnfcleanup" > .\cleanup.txtCleanup.txt
Note The Cleanup.txt should show a status of "Ready." If it shows as "Running," rerun the two commands above. As soon as the status shows "Ready," locate "cmd /c c:\wnfcleanup\wnfcleanup.exe -delete" in the Clanup.txt.  Immediately to the left is the result code that is followed by the account name which created the scheduled task.  It will be as follows "0 Administrator." The result code should be "0" that indicates the task ran successfully.

As soon as it is completed, delete the task:
SCHTASKS /delete /TN "Wnfcleanup" /f
You can now delete the c:\wnfcleanup directory that you created and its contents.

Note The wnfcleanup tool must be run in the SYSTEM security context. This is why the task scheduler is used. Or, you could run it by using a tool such as PsExec.

About Windows Push Notification Platform

Windows Push Notification Platform is a component that exposes a notification sink to notify of notification changes, and an API to communicate how to interact with the notifications.

About Windows Notification Facility

Windows Notification Facility is an infrastructure for secured publish-subscribe messaging among kernel components, system services, and user-space applications.

When you try to register for a notification to a new state name, there will be a potential access to the registry. All state name definitions are stored in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications.
Properties

Article ID: 3063843 - Last Review: 07/17/2015 03:35:00 - Revision: 5.0

Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Standard, Windows Server 2012 R2 Essentials, Windows Server 2012 R2 Foundation, Windows 8.1 Enterprise, Windows 8.1 Pro, Windows 8.1, Windows RT 8.1

  • kbsurveynew kbfix kbexpertiseadvanced atdownload KB3063843
Feedback