How to repair Software service won’t start on a domain controller or Windows software protection will not start access denied 5. on server 2012 R2.

Good day all,

I had the strangest activation issue today. I decided to detail the issue If I ever see it again. So I must admit, the whole idea came from searching the core team blog. My issue was the Software activation service would not start. This resulted in all of the activation related items failing from the customer perspective.

My particular error code was a little different, but the error verbiage was the same. I considered the verbiage enough to try a few things, and I found success. Its always important to share success.

The Core Team can solve your issue without me, so feel free to consult their article. I am just showing the folder and registry locations I needed to add the SPPSVC to, for my protection service to start. This is apparently only on a Domain Controller, Hence the name.

The Key was to add the NT Service\SPPSVC to some specific locations, both in the Folder system and the Registry. There was a little trick here. You have to deselect the domain, when choosing the account. This caused me to wallow along for much longer, as I never thought of doing this on my own power. That is where the Core Team Saved me. Thank you guys.

Screen shots of my 42DC Server look like:



Just to be clear what I am saying, you are to not use active directory groups when making your search. If you do, the NT SERVICE\SPPSVC will not be

there. So select your local machine and add your group. It should be there.


So now we understand how to make an otherwise mysterious user account show up on a Domain controller, here we go with the folder and registry locations.

  1. The Store Folder Located:

C:\Windows\System32\spp\ – Right click and chose the store folder permissions

2. The SPPSVC registry folder located at the  SPPSVC folder


3. The SoftwareProtection Registry Folder located at

Regedit\Computer\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Software Protection

4. This one, I don’t know if this was necessary, so I would not do this unless it was your last gasp:

  • Take ownership of C:\Windows\System32\SPPSVC.EXE
  • Make sure you screen shot original permissions and put them back
  • Add SPPSVC as needed.

Those were the locations I found. Now I did not find this all on one MS KB, so I certainly don’t recommend this is a true fix for an issue. I simply found this in the moment of trying to get a customer back into functionality. Please look to the core team for updated information. This will supersede anything I have here today.


Update 6/22/2017


So in my one particular case, there was an additional location that changed. I had to find it with PROCMON by sysinternals. Using Procmon, I followed the MS blog to capture the traffic. I did not even need to filter the traffic. It clearly showed the WPA folder in the registry was missing a permission. Since the Service stared, after I made this change, It was definately the network service that was missing:

Here is the Key Location in regedit:



I hope this may help get you out of a Jam, and I hope your licensing functions well.


Microsoft Licensing Issues may Require a Tool Called MGADiag or the Web Version of Genuine Microsoft Advantage!

Good day,


A friend of mine hit me up looking for an application called MGADiag. Wow what an old tool!! But yes, I still have a copy.

I sent it to him. After review, I decided not to include a copy to this article. I did post a link to it, but i want to let people know

they should really look a the new web based tool.(Here) The new tool does not do the same thing, at first glance. but on further review, the

web page relies on a plugin, which seemingly collects similar information.

We don’t have much choice on newer Systems. Just look at figure 1. MGADIAG doesn’t work too well with Windows 10.  Other tabs have worse errors, but some tabs work OK.  .


Figure 1.

Reason for most failures

Hey, In its time, this was a great tool. It collected a lot of the licensing information, all in a few tabs. Great for Windows XP and maybe Vista and Windows 7. Beyond that, let the caveat emptor!

It looks like MGADiag was retired for a reason. So my evaluation of MGADiag in 2017 is its in need of a re-vamp

Well the revamp is basically this article and the web tool. here.

Basically there is a 90% chance your activation issue is captured in this simple document ( here). Did you activate the key from this server already? One License equals one machine. These are basic Tenants, that will tell you if you are genuine or not.

So My Licensing is really Broke

If everything checks out against the article, then go ahead and check licensing with the Genuine Advantage Web tool. If that checks out, then you can check with MS.

What to do about Activation (MS)

If you end up with MS, Microsoft, where you are not in the wrong, you should use standard procedures to get activation and license issues fixed.  So lets get that out of the way.

So you can just do the right thing. Just go to a command line and type  SLUI 3 or SLUI 4. This is command line activation and Voice Activation. When the Voice Activation answers the phone, you will be made to explain why you think your license is genuine. This may require a supervisor. Only the supervisors apparently have the information to make a determination, or perhaps, only the supervisors have the ability to fix a wrong determination in their job description.

So here is the thing. Microsoft can see all license keys. they can see if they are activated. So your story needs to explain why a license would be activated in their system. If your story makes sense, and you don’t mind a deactivation to activate your machine, or multiple activation’s are justified for the key you are using, they will generally make good on your license. .

To conclude, we have MGADiag, Genuine Advantage website, and we have SLUI as tools we can use to work on licensing issues.

But Be careful! MGADiag is no longer a public MS download

For example, look at this link, its wrapped in another application completely! Beware!

Here is the Newer tool, in all its glory:


and Finally, Another Blog example of the basic activation steps as they have not changed much over the years


Louis Reeves