Windows 11 23H2 and CryptSvc - Huge delays in software installs or first launches of software

Question

I have officially exhausted everything I can find relating to cryptsvc and nothing has been able to resolve this issue for me.

I've been testing Windows 11 (23H2) in our environment which is mostly HP Laptops. Overall, it USED to work fine. Since April/May of this year we have had some random laptops that just become painfully slow to install anything, slow to launch programs for the first time, and just generally unusable. I've been just reimaging the devices but then the problems creep back. Installs that should take 30 seconds will take 30 minutes. MSI logs will show minutes at a time without appearing to do anything. The processes themselves will show 0 CPU usage in task manager and the RAM usage will be frozen as if the process is just suspended in the background.

Finally I made some headway in getting closer to the root cause and realized something with the Windows CryptSvc is what seems to be causing the huge delays in opening/installing programs. Whenever I launch a program, if it is not opening (though it shows in task manager), I can taskkill the CryptSvc PID and the program IMMEDIATELY launches. The same is true for installations that don't go anywhere. If I kill cryptsvc then the install will progress a bit. Sometimes I have to kill it multiple times to complete the install in a timely manner.

Of note, in all of the machines behaving poorly, the dberr.txt in C:\Windows\System32\catroot2 is filled with the same error over and over. Sometimes many lines within a minute:

CatalogDB: 12:18:22 PM 8/29/2024: catdbsvc.cpp at line #630 encountered error 0x00000032
CatalogDB: 12:18:54 PM 8/29/2024: catdbsvc.cpp at line #630 encountered error 0x00000032
CatalogDB: 12:19:32 PM 8/29/2024: catdbsvc.cpp at line #630 encountered error 0x00000032
CatalogDB: 12:22:47 PM 8/29/2024: catdbsvc.cpp at line #630 encountered error 0x00000032
CatalogDB: 12:23:15 PM 8/29/2024: catdbsvc.cpp at line #630 encountered error 0x00000032
CatalogDB: 12:23:25 PM 8/29/2024: catdbsvc.cpp at line #630 encountered error 0x00000032
CatalogDB: 12:23:33 PM 8/29/2024: catdbsvc.cpp at line #630 encountered error 0x00000032

I can't find anything helpful online related to this error. I've tried erasing the catroot2 folder plenty of times with no effect. I used Procmon and thought I found some shady HP Analytics drivers always doing something when the errors were logged but removing those have done nothing. I've ran DISM, sfc, etc and again, nothing makes this go away. It primarily affects new installations or when launching a program for the first time. It's as if once the info has been registered by CryptSvc once, then it works fine going forward.

Any help would be greatly appreciated... or even just someone else acknowledging having a similar issue so I don't feel so crazy.

Answer 1

If anyone else is running into this issue I believe we found the problem (at least in our environment).

Windows 11 introduced 'Smart App Control' starting from 22H2 on new installations. It defaults to evaluation mode, which is what was set on all of the workstations that were having issues with. With this on, or in eval mode, it runs the AppIDSvc which depends on CryptSvc. This seems to be why killing cryptsvc caused things to start working again until the AppIDSvc restarted itself. Since it is in Eval mode it doesn't seem like it should have been interfering but perhaps it was struggling to verify app signatures. The support topic for 'What is Smart App Control?' mentioned keeping Windows Defender updates installed; we don't use Windows Defender and so we don't deploy updates for it. So maybe that is why - or perhaps it just didn't get along with our current endpoint protection software.

Either way, turning this off has made Windows 11 work like a dream again for us. Now I just need to find how to disable this garbage automatically on new installs.