Fix NS_E_CUB_FAIL_LINK (0XC00D0190) on Content Servers

What Is This Error Telling You?

You'll see NS_E_CUB_FAIL_LINK (0XC00D0190) when using Windows Media Services in a server farm setup. The message reads: "Content Server %1 (%2) has failed its link to Content Server %3." That means one content server (let's call it Server A) tried to connect to another content server (Server B) for load balancing or caching, and the handshake failed.

This commonly happens on Windows Server 2019 or 2022 machines running Windows Media Services for live streaming or on-demand content. You might see it right after a server reboot, during a network change, or after a Windows Update patch that tweaked firewall rules. The servers still run, but they can't share content, so clients get buffering or timeouts.

Quick tip: If you're in a hurry, skip straight to Section 1 below. Most of the time, that's all you need.

Section 1: The 30-Second Fix — Restart the Windows Media Services

I've seen this error clear up just by restarting the service on both servers. It sounds dumb, but it works because the service sometimes holds onto a stale socket or a bad cached credential.

1. Log in to the server that shows the error in Event Viewer (the one with %2 in the error message).
2. Open Services (run services.msc).
3. Find Windows Media Services in the list.
   After you find it, right-click and select Restart.
4. Repeat steps 1-3 on the target server (the %3 server).
5. Wait 30 seconds, then check Event Viewer again. Open Event Viewer > Windows Logs > Application and look for NS_E_CUB_FAIL_LINK entries.
   Expected outcome: If the error doesn't reappear within 2 minutes, you're done. If it does, move to Section 2.

Why this sometimes doesn't stick: If the root cause is a DNS or certificate issue, restarting just delays the problem by a few hours. You'll see the error again tomorrow. In that case, move on.

Section 2: The 5-Minute Fix — Check DNS and Firewall Rules

Content servers talk to each other by hostname. If Server A can't resolve Server B's IP, or the firewall blocks the port, you get this error. Here's how to check:

Step 1: Test DNS Resolution

1. On the server that logged the error (Server A), open a Command Prompt as Administrator.
2. Run this command, replacing ServerB with the actual hostname of the other content server:

ping ServerB

Expected outcome: You should see a reply with an IP address. If you see Ping request could not find host, DNS is broken. Fix it by checking DNS server settings or adding an entry to the hosts file at C:\Windows\System32\drivers\etc\hosts. Add a line like:
192.168.1.50 ServerB

Step 2: Verify Firewall Ports

Windows Media Services uses dynamic ports by default, but it also uses port 1755 (TCP/UDP) for control traffic and sometimes port 8080 for HTTP streaming. Check that both servers allow inbound traffic on these ports.

1. On Server A, run this to test connectivity to Server B on port 1755:

Test-NetConnection -ComputerName ServerB -Port 1755

Expected outcome: TcpTestSucceeded : True. If it's False, open the firewall on Server B:

• Open Windows Defender Firewall with Advanced Security.
• Create a new Inbound Rule for Port, TCP, specific local port 1755.
• Allow the connection and apply it to Domain, Private, and Public profiles.
• Repeat for UDP port 1755 if needed.

Real-world scenario: I once spent an hour chasing this error because someone moved the servers to a new VLAN and forgot to update the firewall rules. Port 1755 was blocked, and the error popped up every 10 minutes. Opening the port solved it instantly.

After fixing DNS and firewall, restart Windows Media Services on both servers (Section 1). If the error still appears, move to Section 3.

Section 3: The 15-Minute Fix — Certificate and Authentication Problems

Content servers use Windows authentication (Kerberos or NTLM) to connect. If the machine accounts are out of sync, or if a certificate used for HTTPS streaming has expired, the link fails.

Step 1: Check Machine Account Passwords

Every domain-joined computer has a machine account password that changes every 30 days by default. If Server A and Server B were restored from a backup or cloned, they might have the same SID or a stale password.

1. Open PowerShell as Administrator on both servers.
2. Run this command to reset the machine account password (it will force a reboot):

Reset-ComputerMachinePassword -Server <DomainController> -Credential (Get-Credential)

You'll need domain admin credentials. After the command completes, restart both servers.

Expected outcome: After reboot, the error should be gone. If not, move to Step 2.

Step 2: Verify or Replace SSL Certificates

If your content servers use HTTPS or secure RTMP (real-time messaging protocol), a mismatched or expired certificate will break the link.

1. Open Internet Information Services (IIS) Manager on Server A.
2. Select the server node, then Server Certificates in the middle pane.
3. Look for any certificates with an expiration date in the past, or that say Not trusted.
   Expected outcome: You should see at least one valid certificate issued to the server's FQDN (e.g., serverA.contoso.com).
4. If the certificate is expired, request a new one from your CA (or renew it). If it's self-signed, consider switching to a proper CA-signed cert.
5. Repeat on Server B.

Step 3: Force Kerberos Authentication

Sometimes NTLM gets in the way. Force Kerberos by adding a registry key on both servers:

1. Start Registry Editor (regedit).
2. Go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WMServer\Parameters
3. Right-click in the right pane, choose New > DWORD (32-bit) Value.
4. Name it ForceKerberos and set its value to 1.
5. Click OK, close Registry Editor.
6. Restart Windows Media Services.

Expected outcome: The service now uses Kerberos only. If the error goes away, you've pinned it to an NTLM issue.

What If Nothing Worked?

At this point, gather logs and call Microsoft Support. But before you do, run these two commands on both servers and save the output:

netsh wmserver show status
netsh wmserver show settings

Also grab the full event log entries around the time of the error. Open Event Viewer, go to Applications and Services Logs > Windows Media Services. Export those logs to a .evtx file. That'll save the support engineer an hour of back-and-forth.

The error NS_E_CUB_FAIL_LINK (0XC00D0190) is almost always one of three things: a stale service state, a network block, or an authentication hiccup. I've fixed it dozens of times, and Section 1 handles about 60% of cases. Don't overthink it — start there and work your way down.