Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2004 Source: PerfNet

Source
Level
Description
Unable to open the Server service. Server performance data  will not be returned. Error code returned is in data DWORD 0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:
0000: 34 00 00 c0
Comments
 
In my case, this was related to mobsync.dll. Follow the instructions described in ME289650:

regsvr32 "%systemroot%\system32\mobsync.dll" /u

After this command the problem was solved.
Several services can be recorded with this event but the most common are Server and Redirector. Both these services depend on network connectivity for their functionality so this may be a sign of problems with the network settings on this particular computer. PerfNet is simply trying to read some information it needs in order to provide performance information about these services but since they are not running it cannot get this info.

* * *

Some newsgroup posts suggest to run exctrlst.exe (Extensible Counter Listing Tool) from the resource kit (see the link below for download)  and disable the counter if you don't use it.

As per Microsoft: "The extensible counter list utility (EXCTRLST.EXE) is used to obtain information about the extensible performance counter dynamic-link libraries (DLLs) on a computer running Windows NT/Windows 2000. This utility lists the applications, drivers, and services that are registered to provide performance data through the performance registry. You can use this utility for finding information and for troubleshooting"
In my case, this error happened on a workstation running Windows XP SP2 (volume license) that used to get an IP address in a network with a DHCP server, but was moved to another network without a DHCP Server. After assigning a fixed IP address, the error did not occur any more.
This event, along with events 2005 and 2006 of the same source (PerfNet), began to occur upon startup after I installed the newest version of Symantec LiveUpdate (3.0) on a Windows XP home edition machine. I confirmed that the problem is somehow caused by LiveUpdate v3.0 by uninstalling it then replacing it with LiveUpdate v2.5. The event log did not show these events anymore.
See the link to "Symantec Knowledge Base Document ID: 2003040408054454" for information about this event.


As per Microsoft: "A performance monitoring program tried to open the performance counters for the Server service. The Server service could not respond to the request. The Server service is not running or is transitioning between starting and stopping or vice versa". See MSW2KDB for information on this event.
Based on the other comments related to this Event ID, it seemed that this event has something to do with File & Print Sharing. Therefore, I uninstalled and then reinstalled this service and now all is well.
To fix this error, I had previously used the EXCTRLST.EXE utility and disabled the performance counters.  This stopped the error message appearing in the event viewer, but I still did not have a server service in Services and I got an error message when clicking on shares in computer Management.Not a big deal I suppose, but I wanted to find out what was wrong. As I have a stand alone machine, I did not have File and Printer Sharing for Microsoft Networks installed. So, I went to dial up properties for my Dial up connection, Under Networking, installed the service File and Printer Sharing for Microsoft Networks Left the check box for this service blank (as I don't want to use it) This immediately enabled the server service and I have since re-enabled the performance counters without any problems or error messages.  A sharing tab now also appears under folder properties.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...