Error: 0x8007005 when Installing Ubuntu

[acash]

• Your Windows build number:
  OS Name: Microsoft Windows 10 Pro
  OS Version: 10.0.16299 N/A Build 16299
  [Version 10.0.16299.125]

• What you're doing and what's happening:
  Enabled WSL
  Restarted computer

PS C:\Users\acash> Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
FeatureName : Microsoft-Windows-Subsystem-Linux
DisplayName : Windows Subsystem for Linux
Description : Provides services and environments for running native user-mode Linux shells and tools on Windows.
RestartRequired : Required
State : Enabled
CustomProperties :

Downloaded and Installed Ubuntu from the Microsoft Store

Entered new UNIX username and get
Error: 0x8007005

Have uninstalled and reinstalled - still same error.

• What's wrong / what should be happening instead:
  Expect to be able to use bash

• Strace of the failing command, if applicable:

[WSLUser]

See #651.

[acash]

@DarthSpock I am not seeing what it is I should do to resolve my issue in the referenced issue.

[WSLUser]

This comment specifically. Here @benhillis says it's fixed with FCU. The last comment should alleviate whatever remaining symptoms you have.

[benhillis]

@DarthSpock - 16299 is FCU, so this is something else.

@acash - Could you collect logs?
https://github.com/Microsoft/WSL/blob/master/CONTRIBUTING.md#8-detailed-logs

[acash]

@benhillis - thank you,
acash_lxcore_logs.zip
here are the logs.

[acash]

@benhillis wondering if the logs I attached provided any insight?

[benhillis]

Unfortunately there is no silver bullet in the logs. I see that attempting to create establish a connection to the service is failing with access denied, but there are no relevant events in the service that would explain why this is happening. Do you see any interesting errors in the Windows Event Viewer?

[cdenneen]

@benhillis #2938 help?

[acash]

@benhillis The Windows Event Viewer shows
EventID=1092
... ran WSL.EXE, which attempted to access LXSSMANAGERPROXYSTUB.DLL, violating the rule "IDS_AP_RULE_PREVENT_WSL_EXECUTION:IDS_BLADE_NAME_SPB", and was blocked. For information about how to respond to this event, see KB85494.

[chrisjbreisch]

I have this same issue, and I don't even have the lxss folder referenced in #651 .

UPDATE: McAfee Endpoint Security appears to be causing this. I have the same event in the event viewer that acash has and that's the Source. How irritating.

[ghost]

After attempting to install another ubuntu instance (after nuking my previous install by deleting the dir containing the previous rootfs etc) I had exactly the same McAfee errors "ran bash.exe, which attempted to access LXSSMANAGERPROXYSTUB.DLL...".

I managed to fix it after seeing this comment: #449 (comment)

I downloaded the ubuntu package from here: https://github.com/x-distro/x.distro/releases

Ran ubuntu.exe - same error 0x8007005 (grr...)
Ran ubuntu.exe clean
Then re-ran ubuntu.exe, and it worked!!!

[chrisjbreisch]

@rpeach - I can (apparently) successfully install using the method you described above.

However, I still can't launch my shell once I have it installed. Same error 0x80070005.

[chrisjbreisch]

I never followed up on this. This is still an issue, but I don't see how Microsoft can resolve it and this should probably be closed.

What's causing this is, as I said, McAfee Endpoint Security. In particular, it's the Access Protection rule "Executing Windows Subsystem for Linux", which is turned on by default. It appears to me that the only way to install WSL if you have McAfee Endpoint Security running is to have your administrator disable this rule.

McAfee does list this as a "known issue" on their site as of the 10.6 release, but no "fix" is currently planned. It doesn't seem like to me that it's an issue at all, but rather a deliberate rule put in place to prevent installation of WSL.

See here: https://kc.mcafee.com/corporate/index?page=content&id=KB82450&actp=null&viewlocale=en_US&showDraft=false&locale=en_US
And here: https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-client-product-guide-windows/page/GUID-44A82DB9-8B4F-4C30-A604-B44E88A33083.html

Recommend that this be documented somewhere obvious, and this issue be closed as unable to fix.

[lewisdonofrio]

@chrisjbreisch just remember the golden rule:
"Dear WSL fans, despite the perf impact of Defender (which we are working to address), THIS is why we DO NOT recommend excluding folders from or disabling Defender"

(https://twitter.com/richturn_ms/status/1095207032292929536)

[chrisjbreisch]

@chrisjbreisch just remember the golden rule:
"Dear WSL fans, despite the perf impact of Defender (which we are working to address), THIS is why we DO NOT recommend excluding folders from or disabling Defender"

Thanks, @lewisdonofrio. However, I'm not recommending any of this. McAfee isn't reporting a malicious file, it's not even checking. The setting mentioned above blocks any WSL process from executing by default. You could (I would hope) change this setting without disabling McAfee completely in WSL folders.

[lewisdonofrio]

What are you talking about I'm not even the OP of that twitter @bitcrazed that posted that. I was just so no-one else does what @ghost steps. They are dangerous and should never be done.

[lo-w]

try below WA:
1)download lxrun from below url
https://github.com/DDoSolitary/LxRunOffline/releases
2)install subsystem linux from microsoft store.
3)execute below command to install your linux in your dir as administrator .
PS C:\Users*> C:\Users*\Downloads\LxRunOffline-v3.4.0\LxRunOffline.exe install -n -d 'dir which you want to installed' -f 'C:\Program Files\WindowsApps\install.tar.gz'
example:
PS C:\Users\test> C:\Users\test\Downloads\LxRunOffline-v3.4.0\LxRunOffline.exe install -n ubuntu1804 -d 'C:\subsystem\ubuntu1804' -f 'C:\Program Files\WindowsApps\CanonicalGroupLimited.Ubuntu18.04onWindows_1804.2019.522.0_x64__79rhkp1fndgsc\install.tar.gz'
4)then you can use bash/wsl to login your subsystem with root user. then uninstall subsystem linux from microsoft store, you don't need it anymore.

[microsoft-github-policy-service]

This issue has been automatically closed since it has not had any activity for the past year. If you're still experiencing this issue please re-file this as a new issue or feature request.

Thank you!