Windows 10: Defragment Drives (dfrgui.exe) won't start after 1703 Update

Defrag and Optimization (e.g. c:\windows\system32\dfgui.exe) will not start after update to Version 1703 (OS Build 15063.423). It Is not shown in service.msc. Can anyone confirm this behavior. I have attempted to run it manually from cmd.exe and it simply does nothing. I have task manager open to verify whether a process starts. It does not. The only place I can find any reference to Defrag is in Computer Management -> System Tools -> Task Scheduler -> Microsoft -> Windows -> Defrag (which just runs the old 'defrag.exe -c -h -o -$')

What do I have to do to get dfrgui.exe to run after the creator's update?

P.S. Absolutely nothing works as described in Optimize and Defrag Drives in Windows 10 Literally I get no response attempting to start Defrag any way.

:)

 

Defragment Drives (dfrgui.exe) won't start after 1703 Update

All, this is a curious problem after the creators (1703) update. Defragment and Optimize drives will not launch at all. For instance clicking on Defragment and Optimize drives (start menu -> Microsoft Administrative Tools -> Defragment and Optimize Drives)
does nothing. With task manager open, it is apparent that no process has started. Further, opening an administrator console and executing dfrgui.exe does nothing either, e.g.

Microsoft Windows [Version 10.0.15063]

(c) 2017 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>dfrgui.exe

C:\WINDOWS\system32>

Nothing, no error, no application, no nothing.

The only error in event viewer (apparently unrelated) is an iexplorer.exe error:

The program iexplore.exe version 11.0.15063.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 291c

Start Time: 01d2f1daa83bab96

Termination Time: 10

Application Path: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Report Id: 801a3d36-17a3-48f1-8b91-8deb780bda57

Faulting package full name:

Faulting package-relative application ID:

So I'm stuck. How do I troubleshoot why dfrgui.exe will not launch after the 1703 update? What to look for? (there is plenty of free space (e.g. only 33G of 128G used). Is this an error indicating I should roll-back my old 1607 version of windows? Any help
greatly appreciated.

Thanks to all that replied, here is what I've tried so far, I updated to KB4022716 (OS Build 15063.447) -- no help, same problem. My original update to creators update was today and it was just done by windows update. I didn't get it as part of the insiders
preview. Before the creators update 'Defragment and Optimize' worked just fine. I'll try a rollback to the anniversary edition and see if that corrects the problem.

 

Defragment Drives (dfrgui.exe) won't start after 1703 Update

Thank you Wayne,

That is a good idea. I do have restore points available and I do have usb recovery tool created and the isos for both anniversary and creators editions available. I guess I'll keep that in my hip pocket for a worst case scenario.

Currently, other than the dfrgui.exe issue, I'm not having any other problems (that I know of) with the creators update (.447 build) to make me want to chance the rollback. The update from the .423 build (mistyped earlier as the .413 build) fixed a majority
of the critical event log errors I was getting and stabilized IE. (in the days of DOS 4.1 and Window 3.1, there was nothing more than 3 floppies for DOS and 3 floppies for windows and one floppy for Word 1.0f that made a 10 minute reformat/reinstall the first
option) Now, risking 24 hours of painful reinstall and reconfiguration of dozens of applications, compilers, updates, repositories, etc... really puts the "Press the BIG RED BUTTON" option way down at the bottom of the decision tree.

From a helpful standpoint, I would really like to help get this issue resolved. There has already been a "Me Too" on the issue, and I suspect there is a generic problem with the creators update that will catch people who have options X, Y & Z set when
the update hits (whatever X, Y & Z may end up being). The 15005 error in the kernel trace is really curious given the description of the error:

ERROR_EVT_INVALID_EVENT_DATA
15005 (0x3A9D)
The event data raised by the publisher is not compatible with the event template definition in the publisher's manifest.

Huh??

Why, in my case, on dfrgui start is "The event data raised by the publisher is not compatible with the event template definition in the publisher's manifest."

There is something wrong with how some manifest or template got configured to make dfrgui think there is a problem with the template definition not matching the publisher' manifest. (both those are well above my window-user-pay-grade...)

The only other thing I can think of, is I do have Windows 10 set to developer mode with WSL enabled and Powershell set accordingly to allow the running of apps and scripts I write. I wonder if there is a problem with dfrgui's response to those settings?

I suspect the answer is buried in the long string of bytes contained in the
<EventPayload> I posted as part of the kernel trace. (which is something I have no idea how to decode).

This is a curious problem. Generally when faced with any OS type problem, I can figure it out fairly quickly, but I'm a bit of a fish-out-of-water with windows problems just from the standpoint of I can't go look at the source or ask the developers directly
on the kernel mailing list

The frustrating part is I'm not sure what I need to do next to help further debug the issue. I can google or bing with the best of them (or actually startpage), but other than logman and tracerpt used to produce the kernel trace, I haven't been able to find
a good flowchart of "here is what you do to find out why an app won't start on windows 10..."

Thank you again for the restore point and repair install reminders, those will be options if we can't get this issue resolved before the disk is crying for a SSD trim.

I do find the ExitStatus 259 a bit ironic given:

"Important The GetExitCodeProcess function returns a valid error code defined by the application only after the thread terminates. Therefore, an application should not use
STILL_ACTIVE (259) as an error code. If a thread returns
STILL_ACTIVE (259) as an error code, applications that test for this value could interpret it to mean that the thread is still running and continue to test for the completion of the thread after the thread has terminated, which could put the application
into an infinite loop."

See: GetExitCodeProcess function (Windows)

 

Here is a bit of additional information. I've updated to KB4022716 (OS Build 15063.447) from the update catalog -- no help *Sad

Here are a couple of diagnostic on what I get from the command line, dfrgui -- nothing, defrag -- OK:


PS C:\Users\david> dfrgui
PS C:\Users\david> write-host $?
True

PS C:\Users\david> dfrgui /?
PS C:\Users\david> dfrgui c:

PS C:\Users\david> defrag /?
Microsoft Drive Optimizer
Copyright (c) 2013 Microsoft Corp.

Description:

Optimizes and defragments files on local volumes to
improve system performance.

<snip>


I have also created a new User Account to eliminate anything in my user account being involved. It makes no difference. dfrgui.exe does not work under the new user either.

This is more a curiosity now since update to (OS Build 15063.447) left me unable to restore the anniversary 1607 files. The crux of the question is what in the 1703 update broke dfrgui.exe? What does it take to fix it? Since defrag.exe still works, the scheduled task will run, but without dfrgui.exe I've lost the interface to command an unscheduled trim through the Windows Administrative Tools -> Defragment and Optimize menu item. Any further suggestions would be welcome.

 

Unfortunately, I cannot say what is happening in your system but in my two Windows 10 Pro x64 1703 15063.447, Optimize works as it should.

 

Thank you for your feedback, that is a good reference point. I also created a new User Account to eliminate the possibility that there was something in my account to blame -- it makes no difference, dfrgui.exe does nothing. I'm also posted to the answers.microsoft site and there is no quick answer, but within a couple of hours the question was marked as "I have this question too"', so apparently I'm not alone. I have determined that dfrgui is exiting without an error, e.g.

PS C:\Users\david> dfrgui
PS C:\Users\david> write-host $?
True
So it appears to be a bug related to what it sees in my system. (HP 8760w Elitebook Pro w/128G SSD primary for windows and 1T WD Black as 2nd drive MBR w/ext4 partitions)

We will see if some others may have a deeper insight as we go along.

 

Running sfc / scannow from an admin command prompt to check /repair system files is worth a try. I don''t see a service on my PCs related to defrag?

 

I recall that when trying BitDefender free AV I was unable to run disk defrag anymore on one of my PCs. Are you using a different AV than Windows Defender?

 

I have never had any 3rd party anti-virus or malware tool. Windows Defender is the only tool installed. This is just a basic windows 10 pro install on an HP 8760w Elitebook that is used very little.

In further effort to run the problem down, I created a kernel trace of the attempt to start dfrgui.exe with a short batch file:

Code: logman start "NT Kernel Logger" -p "Windows Kernel Trace" (process,thread,img,disk,net,registry) -o systemevents.etl -ets dfrgui.exe logman stop "NT Kernel Logger" -ets[/quote] I then processed the event file, systemevents.etl, (5.5M) with tracerpt systemevents.etl which created a huge 46M dumpfile.xml. I have reviewed the dumpfile and paired it down to the starting and ending events related to dfrgui.exe (which thankfully is only 428K). However, I'm no wizard in interpreting window kernel tracing. Both files are too large to use here, but I can make them available if they will help.

The one set of event data that stood out was:

Code: <EventData> <Data Name="UniqueProcessKey">0xFFFFA008A692A2C0</Data> <Data Name="ProcessId">0xFCC</Data> <Data Name="ParentId">0x25F8</Data> <Data Name="SessionId"> 1</Data> <Data Name="ExitStatus">259</Data> <Data Name="DirectoryTableBase">0x1EAF8A000</Data> <Data Name="Flags"> 0</Data> <Data Name="UserSID">\\ELITE\david</Data> <Data Name="ImageFileName">dfrgui.exe</Data> <Data Name="CommandLine">dfrgui.exe</Data> <Data Name="PackageFullName"></Data> <Data Name="ApplicationId"></Data> </EventData>[/quote] Looking, I guess the next event is as important as it relates to processing the error:

Code: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Guid="{9e814aad-3204-11d2-9a82-006008a86939}" /> <EventID>0</EventID> <Version>3</Version> <Level>0</Level> <Task>0</Task> <Opcode>1</Opcode> <Keywords>0x0</Keywords> <TimeCreated SystemTime="2017-07-02T00:16:57.024179100-0500" /> <Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" /> <Execution ProcessID="9720" ThreadID="11156" ProcessorID="2" KernelTime="45" UserTime="15" /> <Channel /> <Computer /> </System> <ProcessingErrorData> <ErrorCode>15005</ErrorCode> <DataItemName /> <EventPayload>CC0F0000082800000040659081D9FFFF00E0649081D9FFFF0000C8987A00000000E0C7987A0000000F000000000000008020DDE7F77F000000B0B8987A00000000000000080502000000</EventPayload> </ProcessingErrorData> <RenderingInfo Culture="en-US"> <Opcode>Start</Opcode> <Provider>MSNT_SystemTrace</Provider> <EventName xmlns="http://schemas.microsoft.com/win/200...ead</EventName> </RenderingInfo> <ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace"> <EventGuid>{3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c}</EventGuid> </ExtendedTracingInfo> </Event>[/quote] The 15005 error code being:

ERROR_EVT_INVALID_EVENT_DATA15005 (0x3A9D)
The event data raised by the publisher is not compatible with the event template definition in the publisher's manifest.
(according to: https://msdn.microsoft.com/en-us/lib...(v=vs.85).aspx)

It's pretty much Greek to me, but some of you smart folks here may be able to decode the information. Let me know if there are further parts that may be helpful.

 

Ahah! I found the problem!

For some reason unexplained (perhaps a cosmic string was tweaked wrong on 1703 install, or just gremlins) the "Optimize drives" service startup was "Disabled". Don't ask me how or why...

Basically snooping though TaskMgr services led me to 'defragsvc' which I then rt-clicked to "open in Services". I then found 'defragsvc' was actually renamed "Optimize drives". Checking properties, I found it disabled (which I changed to 'Manual') and viola! Clicking on Defragment and Optimize Drives in the start menu works as it should.

4 days of headache over a darn app that won't tell you "Hey I'm a Disabled Service" when you invoke it from the command line....

Now the question to the MS devs is what the heck caused this to be set to disabled during 1703 update??

 

Yesssss. this finally worked!!!!