000012900 - RSA NetWitness Informer service starts and then stops immediately

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000012900
Applies ToRSA NetWitness NextGen
RSA NetWitness Informer
RSA NetWitness Informer and above
IssueRSA NetWitness Informer service starts and then stops immediately.

If the Informer service gives the following error when trying to start the service manually:

 The Netwitness Informer Service service on Local Computer started and then stopped.

 Some services stop automatically if they are not in use by other services or programs.

Look in the Windows Event Viewer under the Application Log for the following error:

   Service cannot be started. The handle is invalid


If both messages are received attempt the following to fix the issue.

Note: It may have only required adding the license to LicenseMgr. This would need to be tested the next time it is seen.

1. Uninstall Informer from Programs and Features

    Netwitness Informer 2.0 (Remove All)

2. Manually remove the Netwitness Informer Service in a ellivated command prompt

    sc delete "Netwitness Informer Service"

3. Reboot the Informer Appliance

4. Install Informer as usual

5. License Informer via Informer's LicenseMgr

6. Manually start Netwitness Informer Service via the Services MMC

   Run -> Services.msc

This should allow the service to start as normal.

Legacy Article IDa58686