WSL2 fails to start with Error code: Wsl/Service/CreateInstance/CreateVm/MountVhd/HCS/0x800706bf

[ilyaradko]

Windows Version

Microsoft Windows [Version 10.0.19045.3930]

WSL Version

2.0.14.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

5.15.133.1-1

Distro Version

Ubuntu 20.04

Other Software

No response

Repro Steps

Try to start WSL from command line: wsl.

Expected Behavior

WSL starts.

Actual Behavior

WSL throws an error:

C:\Users\dtu>wsl
Failed to attach disk 'C:\Program Files\WSL\system.vhd' to WSL2: The remote procedure call failed and did not execute.
Error code: Wsl/Service/CreateInstance/CreateVm/MountVhd/HCS/0x800706bf

C:\Users\dtu>

This happens after a recent Windows updates (KB5034122 and KB5033909). I tried to rollback the updates, but they are pushed again by the group policies, so can't roll them back.

Diagnostic Logs

WslLogs-2024-01-16_12-42-26.zip

[github-actions]

Hi I'm an AI powered bot that finds similar issues based off the issue title.

Please view the issues below to see if they solve your problem, and if the issue describes your problem please consider closing this one and thumbs upping the other issue to help us prioritize it. Thank you!

Open similar issues:

• Cannot start WSL after reboot, Error code: Wsl/Service/CreateInstance/CreateVm/MountVhd/0x80070032 (#9178), similarity score: 0.86
• Error code: Wsl/Service/CreateInstance/CreateVm/ConfigureGpu/HCS/0x80041001 (#10917), similarity score: 0.85
• Error code: Wsl/Service/CreateInstance/CreateVm/HCS/E_INVALIDARG (#10285), similarity score: 0.85

Closed similar issues:

• WSL2 fails to start with Error code: Wsl/Service/CreateInstance/CreateVm/ConfigureNetworking/HNS/0x80070424 (#10755), similarity score: 0.90
• Error code: Wsl/Service/CreateInstance/CreateVm/HCS/0x80070032 (#10809), similarity score: 0.87

Note: You can give me feedback by thumbs upping or thumbs downing this comment.

[OneBlue]

Thank you @ilyaradko. It looks like something is failing inside the storage stack.

Can you collect storage logs of repro ? You can do this via (powershell):

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
.\collect-wsl-logs.ps1 -LogProfile storage 

[ilyaradko]

Sure. Here it is.
WslLogs-2024-01-17_10-09-41.zip

[manofsticks]

I am encountering the same issue, and here are the additional steps I've tried.

-I unregistered my installed Distributions by running the following

wsl --unregister Debian

Upon trying to reinstall, I get the same error code with a different message

wsl --install debian

wslRegisterDistribution failed with error: 0x800706bf
Error: 0x800706bf The remote procedure call failed and did not execute

After getting this error, my computer will fail with a bluescreen within a few minutes with the following message:

Stop code: SYSTEM_SERVICE_EXCEPTION
What failed: dxgkrnl.sys

I've also tried with ubuntu and get the same error.

[ilyaradko]

Yes, it seems that the problem is not in WSL itself, but in an RPC that is called to mount the .vhdx image of the Linux. Just trying to mount it (wsl --mount) without starting WSL also fails with the same RPC error.

[manofsticks]

This error appears to have resolved itself with the most recent Windows Update for me; unfortunately I'm not knowledgeable enough about Windows update process to better inform which update specifically resolved it, and my only Windows device is my work machine so I can't experiment to find out.

[ilyaradko]

@manofsticks, if you press Win+R (run window) end execute appwiz.cpl, you will see a window with installed apps. In that window, click "View installed updates" in the upper left corner. Then sort updates by the last column (Installed On) and scroll down till "Microsoft Windows". You will see the recently installed Windows updates. I would very much appreciate if you post here the updates that were installed recently. For me the problem still persists and I can try manually installing the same updates to fix it. Thank you!

[manofsticks]

Here are the most recent updates listed there.

[ilyaradko]

Thank you @manofsticks for posting it. I have exactly the same last three updates, but the problem is still there.

[lcrok]

I started receiving this same error today. The only update I see today is the KB5034466. I believe this could be causing this error.
I cannot Run, Import nor Install any distro on WSL.
Has anyone found a solution for this?

[lcrok]

I found the issue on my system. It was Avecto Trust Center that was updated as a company wide push that broke it. Upon downgrading Avecto, WSL erro was gone. So, my advice is, look for other apps/av/sec software that may be have been installed recently.

[ilyaradko]

@lcrok, thanks a lot for the hint! Indeed, the problem was caused by Avecto. I disabled the Avecto's kernel-level driver PGDriver.sys to test it, and WSL started.

Avecto is known to be a problem for a lot of software to the extent that they introduced a registry key for exclusions. However, I tried adding wsl.exe into HKLM\SOFTWARE\Avecto\Privilege Guard Client\"ManagedHookExclusions" and HKLM\SOFTWARE\WOW6432Node\Avecto\Privilege Guard Client\"ManagedHookExclusions" without success. Perhaps, it is not wsl.exe that fails, but the modules it depends on (vmcompute.exe, vmwp.exe, vmmem, etc.)

[OneBlue]

Thank you for the conclusion @ilyaradko.

Closing since the issue is caused by a third party driver.

[uncreativespace]

@lcrok, thanks a lot for the hint! Indeed, the problem was caused by Avecto. I disabled the Avecto's kernel-level driver PGDriver.sys to test it, and WSL started.

Avecto is known to be a problem for a lot of software to the extent that they introduced a registry key for exclusions. However, I tried adding wsl.exe into HKLM\SOFTWARE\Avecto\Privilege Guard Client\"ManagedHookExclusions" and HKLM\SOFTWARE\WOW6432Node\Avecto\Privilege Guard Client\"ManagedHookExclusions" without success. Perhaps, it is not wsl.exe that fails, but the modules it depends on (vmcompute.exe, vmwp.exe, vmmem, etc.)

It's 2 of the dependencies that need hook exclusions set, yeah.

C:\Windows\system32\vmcompute.exe
C:\Windows\system32\vmwp.exe

... Need to be set in the 64 & 32 bit locations for ManagedHookExclusions. You'll still see PGHook.dll get injected with them set in ManagedHookExclusions but it won't do anything. Mitigates the issue.