AppLocker service issue: AppIDSvc not running, but enforcement working.

Question

I have a strange problem with AppLocker.  I configured the service (AppIDSvc) and some policies using group policy and deployed it to some computers in my domain.  I logged onto one of the systems and verified that AppIDSvc was running, and that
enforcement and logging were working correctly.
Later, I decided to expand that policy to more computers.  I reorganized the policies somewhat, but the RSOP is the same.  I logged onto one of the new machines that I applied the policy to, and noticed that the service was not running and nothing
audited in the AppLocker logs.  When I try to start the service, I get "System error 31 has occurred.  A device attached to the system is not functioning."
This is strange, but what is more strange is that on the first set of systems I deployed AppLocker to, I am seeing the same behavior from the service: not starting, and attempts to start result in the same error.  However, AppLocker is still working! 
It is still enforcing the original policies I created, and is still logging events.
I did a little more investigation, and I see that the AppID service (which AppIDSvc depends on) is running, and must be the service doing the heavy lifting behind the scenes.  When I prevent the AppID service from starting (by removing it from [HKLM\SYSTEM\CurrentControlSet\services]),
and restart the system; the enforcement/logging stops.  When I put it back, it restarts.  But, I cannot get it to start on systems other than the original test group, and obviously something is wrong that the AppIDSvc won't start.
It's as if the enforcement mechanism (provided by AppId.sys?) cannot be called by the AppIDSvc, or AppIDSvc cannot access the resources in use by AppID; or something to that effect.  I have tried auditing the behavior of the system using procmon, but
haven't made much headway yet.
Any insight into this issue, or how to better troubleshoot it would be greatly appreciated.

Answer 1

Despite hours of troubleshooting, just minutes after resorting to posting about this problem I solved it!
The issue ended up being that when I updated my group policy to ensure that the AppIDSvc was enabled, in my due diligence to ensure that everything was set correctly, I selected the radio button for "Log on as: Local System account."  In fact, this
service must run under the "NT Authority\Local Service" account, not the Local System account.  Once the account settings were corrected, the service started no problem.
I have updated my group policy to fix the issue and all seems to be well.