This article applies to:

• Marshal Reporting Console
• MailMarshal SPE 3.0 and above

Symptoms:

• MailMarshal SPE Agent services do not start
• MRC Executor or Scheduler services do not start
• Service logs do not contain any entries
• Error dialog text: 1053 - service did not start in a timely fashion
• Log entries similar to the following in the installation log:
  
  

  15:01:30 Checking if Service Exists: SPEStatusAgent
  15:02:01  Failed to start service (1): The service did not respond to the start or control request in a timely fashion.

Causes:

• The services executables are authenticode signed. The signing certificate is validated on startup.
• This process requires access to a Certificate Revocation List (generally via HTTP), but the servers affected do not have access to this URL.
• This is a known issue affecting .NET services, when strict security is enforced in a domain.
• Other critical Windows services have not yet started

Resolution:

For the CRL problem, several options are available to resolve this issue. Options are listed below in order from most to least secure.

1. Allow access from the server(s) to the CRL (crl.verisign.com or crl.trustwave.com depending on product version)
   • This is the most secure option, because any applications that do CRL checking will properly validate their certificate.
2. Create a configuration file to disable CRL checking for the affected Agents. For information, see Microsoft Knowledge Base article .NET configuration information for the generatePublisherEvidence element.
• Locate the .config file for each service
• Within the Configuration section, BELOW the end of the "configSections" section, add the following lines:
  <runtime> 
  <generatepublisherevidence enabled="false"> 
  </generatepublisherevidence>
  </runtime>
3. Increase the service startup timeout and/or decrease the timeout on the CRL checking.
   • The service will start, after the timeouts elapse. The CRL check timeout can be up to 60 seconds, and the default service startup timeout is 30 seconds.
   • For information about changing these timeouts (ServicesPipeTimeout), see this Microsoft article.