Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 7023 Source: ServiceControlManager

Level
Description
The <name of the service> service terminated with the following error: <error description>
Comments
 
- Service: "DNS Server", error: "The network is not present or not started" - See ME954423.
- Service: "OpsMgr Health Service" - See ME948731.
- Service: "Task Scheduler" - See ME935641.
- Service: "Task Scheduler", error: "The endpoint mapper database entry could not be created" - See ME930220.
- Service: "Server", error: "The server is in use and cannot be unloaded" - See ME910666.
- Service: "Server", error: "Access is denied" - See ME910666.
- Service: "Automatic Updates", error: "The class is configured to run as a security id different from the caller" - See "Automatic Updates Service Terminated".
- Service: "Microsoft iSCSI Initiator Service", error: "A required privilege is not held by the client" - See ME909585.
- Service: "Windows Time", error: "Not all privileges referenced are assigned to the caller" - See WITP83181.
- Service: "DNS server", error: "The data is invalid" - See WITP72200.
- Service: "IPSEC Services", error: "The system cannot find the file specified" - See ME870910 and ME912023.
- Service: "Intruder Alert Agent v3.6.1", error: "The network request is not supported" - See "Symantec Knowledge Base Document ID: 2004123009343753".
- Service: "Cluster Server", error: "The endpoint cannot be created" - See WITP73741.
- Service: "Cluster Server" - See ME246784.
- Service: "Cluster Server", error: "The quorum log could not be created or mounted successfully" - See "Windows Cluster Service Troubleshooting and Maintenance" to download a white paper on the Windows Cluster Service.
- Service: "Cluster Service", error: "A security package specific error occurred" - See ME272129.
- Service: "IIS Admin Service", error: "The system cannot find the file specified" - See ME332103.
- Service: "IISservice", error: "Incorrect function" - See ME905423.
- Service: "IISservice", error: "The system can not find the file specified" - See ME905423.
- Service: "Microsoft Exchange Routing Engine", error: "Access is denied" - See ME312417.
- Service: "Microsoft Exchange Routing Engine", error: "The system cannot find the path specified" - See ME323672.
- Service: "Membership Agent", error: "The service has not been started" - See ME171331.
- Service: "FTP Publishing Service" - See ME209400.
- Service: "Netlogon", error: "Access denied" - See ME153719, ME293127 and WITP73105.
- Service: "Microsoft DNS Server", error: "The system cannot find the file specified" - See ME171781 and ME197146.
- Service: "Microsoft DNS Server", error: "The data is invalid" - See ME168033, ME195669, ME203009 and ME256318.
- Service: "Microsoft DHCP Server", error: "No further data is available" - See ME200462.
- Service: "OSD Agent", error: "No application is associated with the specific file for this operation." - See ME899614.
- Service: "World Wide Web Publishing Service", error: "The endpoint cannot be created" - See ME217351.
- Service: "World Wide Web Publishing Service", error: "Not enough resources are available to complete this operation" - See ME234230.
- Service: "World Wide Web Publishing Server", error: "The RPC protocol sequence is not supported" - See ME317037.
- Service: "Windows Internet Name Service" - See ME205100.
- Service: "Workstation" - See WITP72260 and WITP72305.
- Service: Windows Search -  The trick is to delete all files related to search indexing, located by default at:

C:\ProgramData\Microsoft\Search\Data\Applications\Windows

and:

C:\ProgramData\Microsoft\Search\Data\Temp

Delete all files and folders in these directories (you might want to make a backup, I did, but it proved unnecessary).

Then, change the service back to starting automatically and restart service.

See EV100429 (Microsoft Windows Search Indexer stopped working and was closed).
Service: IPSEC Services, Error: Element not found - Also received Failure Audit 615 with failed to initialize IKE module with Element not found. I had previously deleted the IPSEC registry key and recreated it while troubleshooting another error and IPSEC entered block mode upon reboot. Disabling IPSEC bypassed the problem, but it wouldn't go away until I reset Winsock according to ME811259.
Service: Windows Audio Endpoint Builder, error: RPC Service Unavailable. For me this was due to the ''power'' service being disabled, enabling it fixed the problem.
On Windows 7:
Service: Windows Modules Installer
Error: Insufficient resources exist to complete the requested service.

Event ID 7023 was being logged approx every 30 seconds while Windows Update never finished "checking for updates".

Other symptoms (from Control Panel''s Programs and Features):
- "View installed updates" incorrectly shows no updates.
- "Windows Features" shows a blank list.

Workaround:
In HKLM/System/CurrentControlSet/Control
set key "RegistrySizeLimit"
to value 0xffffffff (4294967295)

While waiting for comment from Microsoft, we do not know the implications of setting this value as shown.  (I.e. Is it too high?).  However in our case this resolved all three of the above-listed problems.

ME292726 claims that this functionality was removed in Server 2003 and XP. I cannot find MS info on its role in Windows 7, but it appears to be back with a vengeance. Have not found any new documentation. MS states that for Windows 2000 Server, if RSL is set to greater than 80% of Paged Pool Size it will be reduced to 80% of PPS. Alternatively if set between 16MB and 80% of PPS, it will not be altered. We are guessing at the formula in Win7, and determining PPS at any given time does not appear to be straight-forward. However we have established that too low an RSL value definitely causes the various problems previously described. We have also observed auto-changes on a 32-bit Win7 Pro system as follows:

- When Event ID 7023 errors and other symptoms were experienced, RSL was found to be set at 68MB (0x04400000).
- RSL was changed to 0xFFFFFFFF as suggested in original comments, and this resolved all symptoms.
- At next inspection, RSL was found to have been auto-reduced to 81MB (0x05100000).  The PC remained symtom free.
- It was then manually raised to 104MB (0x06800000).
- A new program was installed (iTunes).  RSL was then found to have auto-increased to 112MB (0x07000000).  So far that value remains constant.

Interim conclusion: The previously-listed problems can be solved by manipulating the RegistrySizeLimit value. However there is a degree of "trial and error" involved, and we still lack information on when and how further value changes will occur.


Service Internet Authentication, Error: "Only one usage of each socket address (protocol/network address/port) is normally permitted". To fix this, I have added port range to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ReservedPorts as per ME956189 and ME812873.
- Service: "Server", error: "The specified driver is invalid." - One of my XP SP3 domain computers stopped responding to any remote administration and I couldn''t UNC to the computer. This was related to a corrupt sys.dll. The Sharing Tab was no longer present on folder/file properties. To fix, I ran "scf /scannow" to fix system files back to original state. Then rebooted the machine and the sys.dll was restored as well as the Sharing tab. Full remote administration was restored.
- Service: "DNS Server", error: "The network is not present or not started" - See ME954423.
- Service: "OpsMgr Health Service" - See ME948731.
- Service: "Task Scheduler" - See ME935641.
- Service: "Task Scheduler", error: "The endpoint mapper database entry could not be created" - See ME930220.
- Service: "Server", error: "The server is in use and cannot be unloaded" - See ME910666.
- Service: "Server", error: "Access is denied" - See ME910666.
- Service: "Automatic Updates", error: "The class is configured to run as a security id different from the caller" - See "Automatic Updates Service Terminated".
- Service: "Microsoft iSCSI Initiator Service", error: "A required privilege is not held by the client" - See ME909585.
- Service: "Windows Time", error: "Not all privileges referenced are assigned to the caller" - See "JSI Tip 9132".
- Service: "DNS server", error: "The data is invalid" - See WITP72200.
- Service: "IPSEC Services", error: "The system cannot find the file specified" - See ME870910 and ME912023.
- Service: "Intruder Alert Agent v3.6.1", error: "The network request is not supported" - See "Symantec Knowledge Base Document ID: 2004123009343753".
- Service: "Cluster Server", error: "The endpoint cannot be created" - See "JSI Tip 2420".
- Service: "Cluster Server" - See ME246784.
- Service: "Cluster Server", error: "The quorum log could not be created or mounted successfully" - See "Windows Cluster Service Troubleshooting and Maintenance" to download a white paper on the Windows Cluster Service.
- Service: "Cluster Service", error: "A security package specific error occurred" - See ME272129.
- Service: "IIS Admin Service", error: "The system cannot find the file specified" - See ME332103.
- Service: "IISservice", error: "Incorrect function" - See ME905423.
- Service: "IISservice", error: "The system can not find the file specified" - See ME905423.
- Service: "Microsoft Exchange Routing Engine", error: "Access is denied" - See ME312417.
- Service: "Microsoft Exchange Routing Engine", error: "The system cannot find the path specified" - See ME323672.
- Service: "Membership Agent", error: "The service has not been started" - See ME171331.
- Service: "FTP Publishing Service" - See ME209400.
- Service: "Netlogon", error: "Access denied" - See ME153719, ME293127 and "JSI Tip 1781".
- Service: "Microsoft DNS Server", error: "The system cannot find the file specified" - See ME171781 and ME197146.
- Service: "Microsoft DNS Server", error: "The data is invalid" - See ME168033, ME195669, ME203009 and ME256318.
- Service: "Microsoft DHCP Server", error: "No further data is available" - See ME200462.
- Service: "OSD Agent", error: "No application is associated with the specific file for this operation." - See ME899614.
- Service: "World Wide Web Publishing Service", error: "The endpoint cannot be created" - See ME217351.
- Service: "World Wide Web Publishing Service", error: "Not enough resources are available to complete this operation" - See ME234230.
- Service: "World Wide Web Publishing Server", error: "The RPC protocol sequence is not supported" - See ME317037.
- Service: "Windows Internet Name Service" - See ME205100.
- Service: "Workstation" - See WITP72260 and WITP72305.
- Service: "Remote Access Connection Manager", error: "Access is denied." - See ME329441 and ME842696.
- Service: "Remote Access Connection Manager", error: "Could not find the file specified" - See ME248639.
- Service: "Routing and Remote Access Service" - See ME238603.
- Service: "Intersite Messaging", error: "Unable to update the password. The value provided as the current password is incorrect." - See ME305837.
- Service: "SampleGateway", error: "The security account database contains an internal inconsistency." - See ME198911.
- Service: "", error: "The system can not find the file specified" - See ME197303 for information.
- Service: "Certificate Services", error: "Installation suspended, incomplete" - See ME273037 for information.
- Service: "Windows Internet Name", error: %3758096385 - See ME225346 and ME329871.
- Service: "Cluster Server", error: "The endpoint cannot be created" - See ME262832.
- Service: "Cluster Server", error: "Indicated two revision levels are incompatible" - See ME185752.
- Service: "Cluster", error: "The quorum disk could not be located by the cluster service" - See ME296594.
- Service: "Cluster" - See ME169414.
- Service: "Microsoft Firewall", error: "The server is not operational" - See ME311011 and ME317413.
- Service: "Boot Information Negotiation Layer", error: " The specified domain either does not exit or could not be contacted" - See ME281929.
- Service: "Microsoft DHCP Server" - See ME194028.
- Service: "DHCP" - See ME888193.
- Service: "DHCP server", error: "The system cannot find the path specified" - See ME173040.
- Service: DHCP Client, error: "Access is denied" - See ME895149.
- Service: "Workstation", error: "A duplicate name exists on the network" - See ME197157, ME248057 and ME317140.
- Service: "Messenger" - See ME325646.
- Service: "Sap Agent", error: "The service has not been started" - See ME158520.
- Service: "Server", error: "A device attached to the system is not functioning" - See ME234636 and ME250262.
- Service: "Server", error: "Not enough server storage is available to process this command" - See ME180140.
- Service: "Commerce Server Direct Mailer", error: "Catastrophic failure" - See ME307940.
- Service: "FTP Publishing Service", error: "The system cannot find the path specified" - See ME311625.
- Service: "FTP Publishing Service", error: "Not enough resources are available to complete this operation" - See ME327649.
- Service: "FTP Publishing Service", error: "The parameter is incorrect" - See ME327649.
- Service: "SESA AgentStart Service", error: "Cannot create a file when that file already exits" - See Symantec Knowledge Base ID: 2003010314414054.
- Service: "Symantec AntiVirus Server", error: "The environment is incorrect" - Symantec Knowledge Base ID: 2000121000555348 and Symantec Knowledge Base ID: 1999063010361948 might help you to solve this problem.
- Service: "Microsoft Exchange Routing Engine", error: "The system cannot find the path specified" - See ME841576.
- Service: Directory Replicator, error: " The data is invalid" - See ME133475.
- Service: World Wide Web Publishing Service, error: "Object already exists" - See ME295162.
- Service: World Wide Web Publishing Service, error: "Not enough resources are available to complete this operation" - See ME327649.
- Service: World Wide Web Publishing Service, error: "The parameter is incorrect" - See ME327649.
- Service: World Wide Web Publishing Service, error: "The system cannot find the path specified" - See ME884872.
- Service: Microsoft ISA Server Control, error: "The handle is invalid" - See ME300215.
- Service: Simple Mail Transport Protocol (SMTP), error: "Not enough resources are available to complete this operation" - See ME327649.
- Service: Simple Mail Transport Protocol (SMTP), error: "The parameter is incorrect" - See ME327649.
- Service: Backup Exec Device and Media Service, error: "The database specified does not exist" - See "Veritas Support Document ID: 267799", "Veritas Support Document ID: 241971", and "Veritas Support Document ID: 190986" to fix this problem.
- Service: VERITAS VCSComm Startup - See the link to "Veritas Support Document ID: 251934".
- Service: Kerberos Key Distribution Center, error: "The security account manager (SAM) or local security authority (LSA) server was in the wrong state to perform the security operation" - See ME837513.
- Service: Windows Firewall/Internet Connection Sharing (ICS) - See ME892199.
- Service: Computer Browser - See ME889320 for a hotfix applicable to Microsoft Windows XP SP2.
- Service: Windows Time - See ME892501.
- Service: Windows Installer - See ME897027.
- Service: IIS Admin Service - See ME903072.
- SErvice: Client Network - Read Citrix Support Document ID: CTX103330.
- Service: DNS - See ME236460 and ME194194.
- Service: WINS - See ME191775.
- Service: Citrix Virtual Memory Optimization - Read "Citrix Support Document ID: CTX110302".
- Service: IPSEC Services, error: "Only one usage of each socket address (protocol/network address/port) is normally permitted" - See ME956189 from Microsoft.

- Service: Print Spooler - See the link to "How to clean up printer drivers" for information on printer drivers problems.
- Service: Windows installer - Try installing the latest version of Windows installer. See the link to "Windows Installer Redistribuable".

- Service: "Human Interface Device Access" - From a newsgroup post: "The following error will occur if any of the following three files are missing, namely: “hidserv.dll”, “mouhid.sys”, and “mouclass.sys”. Error description: “Could not start the Human Interface Device Access service on Local Computer. Error 126: the specified module could not be found”. To fix this problem extract “hidserv.dll”“, mouhid.sys” and “mouclass.sys” from the file “drivers.cab”, located on the Windows XP Setup CD to "<SystemRoot>\windows\system32\".
1. Insert Windows XP Setup CD.
2. Browse to <CDROM drive letter>:\i386\drivers.cab
3. Double click the “drivers.cab” file. The compressed files in the “.cab” file will be listed.
4. Copy the three files to “<SystemRoot>\windows\system32\”. Reboot the computer".

- Service: "File and Print Services for NetWare" - From a newsgroup post: "I uninstalled the service, re-installed it from the console and now it appears to be working fine".

- Service: "Internet Authentication Service" - From a newsgroup post: "I put in a support call to MS on this and received the following which got IAS started:
Since the system's language is English, the knowledge base article ME269228 would not help at all. Even if I obtained the hotfix, it cannot be installed because of the language difference.
Perform the following to try to resolve the problem:
1. Click Start -> Run. Type the command below and click OK.
regsvr32 c:\winnt\system32\vbscript.dll
Here, I assume that Windows is installed in the C:\Winnt folder. If it is not, please modify the command.
2. Then, test to see if the IAS service can be started". See ME956189 for more details on this service and event.

See ME871236 for some of the changes that have been made to the Cluster service-related event log messages in Microsoft Windows Server 2003 Service Pack 1 (SP1).

See MSW2KDB for more details on this event.
- Service: Remote Access Connection Manager, error: "The specified module could not be found" - See the link to "Symantec Support Document ID: 2008020203163548"
- Service: "Internet Authentication Service", error: "Internet Authentication Service is not a valid Win32 application" – This event appeared on the 64-bit version of Windows 2003 Server. I noticed that the IASJet service was running from "C:\WINDOWS\SysWOW64\svchost.exe" yet the IAS service was running from "C:\WINDOWS\System32\svchost.exe". To fix the problem, I made sure that the service was stopped and ran the following from the command line to change the binPath of the service:

sc config IAS binpath= "C:\WINDOWS\SysWOW64\svchost.exe -k netsvcs".

After this, I started the service and the problem was solved.
- Service: "Remote Installation", error: "The specified procedure could not be found" - This happens when installing SP2 on a Windows Server 2003 with RIS role as the Remote Installation Services are being replaced by Windows Deployment Services. But the BINLSVC services are not removed. To fix this problem, first go to administrative tools where you will find 2 new icons: Windows Deployment Services & Windows Deployment Services Legacy (RIS). You can control (start/stop, add images etc) WDS & RIS through these 2 consoles. Click the Windows Deployment Services icon and run the wizard (for me, it was just "Next, Next..."). Change startup of "Remote Installation" (BINLSVC) service from Automatic to Manual. This did it for me. WDS is running in Mixed mode RIS + WDS, and our clients can use the "old" RIS GUI.
- Service: Windows Time - I had to reset the security descriptors on the Netlogon and Windows Time services using sc:
1. sc sdset w32time D:(A;;CCLCSWLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO;;;IU)(A;;CCLCSWRPLO;;;BU)
S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

2. sc sdset Netlogon D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)
S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD).
- Service: "Microsoft Search", error: "The system cannot find the file specified" - This instance occurred every time I restarted my server. It appeared after I had removed SQL Server from the server. For whatever reason it left the search attributes out there. I followed Microsoft’s article ME827449 for removal of the Microsoft Search component, rebooted, and the error disappeared.


- Service: Automatic Updates - On a migration to a new network, I had this issue where not all desktop clients were obtaining windows updates from WSUS. Running two commands as per ME555336, then updating with the "wuauclt.exe /detectnow" command solved the problem.
- Service: "Citrix WMI Service", error: "Access is denied" - Set the startup type of the "Windows Management Instrumentation Driver Extensions" service to Automatic instead of Manual. The Citrix WMI Service is dependent on the Indendent Management Architecture service which is itself dependent on the Windows Management Instrumentation Driver Extensions service. I assume the problem occurs due to a time-out, because the Windows Management Instrumentation Driver Extensions service is not started timely.
- Service: Cluster Service, error: "A required privilege is not held by the client" - When you see this event for cluster service, look for EventID 1234 from source ClusSvc, which tells about the exact privilege that is missing, and grant that privilege manually. The cluster service requires the following privileges as below:
Act as part of the OS.
Adjust memory quotas for process.
Backup files & directories.
Increase scheduling priority.
Log on as service.
Restore files and directories.
Replace a process-level token.
- Service: "Automatic Updates", error: "The class is configured to run as a security id different from the caller" - In may case, I updated the service security descriptors with "sc sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)" command.
- Service: Windows Firewall/Internet Connection Sharing (ICS), error: "An address incompatible with the requested protocol was used" - See the link to "www.techspot.com - Could not start the Windows Firewall" for some resolution steps.
- Service: Computer Browser - In a Windows XP SP2 environment, if you have disabled Windows Firewall/ICS service trough services manager this behavior is normal. Just enable this service and turn the firewall off from Control Panel -> Windows Firewall. That is if you need the Computer Browser service at all.
- Service: "BackupExec Device & Media Service", error: "The database specified does not exist" - After upgrading the backup server from Windows 2000 Server to Windows Server 2003, the Veritas Device & Media Service terminated on starting with this error message. Re-installing MDAC Rev. 2.7 or 2.8 did not fix the problem. Therefore, I extracted the file “OLEDB32.DLL” manually from the MDAC 2.8 Installer (MDAC_TYP.EXE) and copied it to C:\Program Files\Common Files\System\Ole DB. After restarting the system, everything worked fine for me.
- Service: "Security Center", error: "Windows cannot open this program because it has been prevented by a software restriction policy. For more information open Event Viewer or contact your system administrator" - The "Security Center" service is a new service for WinXP SP2. In my case, setting the policy "Turn on Security Center (Domain PCs only)" to "Enable" resolved the problem. To do this go to Start -> Run -> “gpedit.msc” -> Computer Configuration -> Administrative Templates -> Windows Components -> Security Center.
Service: World Wide Web Publishing Service, Error: "The authentication service is unknown." - This error occurs when Client For Microsoft Networks is not installed.


In Win NT4, if you have installed SP6 and configured a NIC for the first time, reinstall SP6.
Service: "Microsoft ISA Server Control" - Location of log files should be same on all servers in array. I added one server in array and change log files location to "F:" drive. I did not have "F:" drive on first server and ISA server services failed to start with this error. After relocation of log files to original location, everything was OK.
- Service: Veritas Backup Exec - I have resolved this error by updating the MDAC and re-applying the SP.
When this event is accompanied by event ids: 3870, 7001 and 7002, it is most likely a WINS problem. Shut down the system with the errors, stop your WINS Service on the WINS Server, dump the WINS database, and restart the WINS service. After WINS is up and running, start the system with the errors.
Service: Spooler, Error: “The access code is invalid”. This event can occur when attempting to start the Print Spooler service through a Terminal Service or a Citrix connection. On the actual console, run “net start spooler” in a command window instead.
Service: Workstation, Error: A duplicate name exists on the network. - Rogue Wins entry in the Wins Database. Fix: Clear the rogue static entry as per ME166184.
Service: "Kerberos Key Distribution Center" - error: "The security account manager (SAM) or local security authority (LSA) server was in the wrong state to perform the security operation." - Can appear on member server. As per Microsoft Kerberos KDC service must be disabled and this service must be set to Automatic only if server is an Active Directory domain controller. See ME295381.

Here are few symptoms related to Kerberos Key Distribution Center service: First I've got the event ID 3034, source MRxSmb and then the event ID 5719, source NETLOGON with the error: "There are currently no logon servers available to service the logon request." Third event ID was 8021, source BROWSER and then within two minutes the event ID 8033 (source MRxSmb) appeared. Later I found the solution: According to ME303330, Microsoft relates this problem to missing or damaged Rsaenh.dll (it's Microsoft Enhanced Cryptographic Provider) file after upgrading to Windows 2000 SP2. That's interesting, because I'm running W2K SP3!. Anyway Microsoft recommends to add or replace Rsaenh.dll fill with a known-good copy of this file from another computer. The correct version of the Rsaenh.dll file is 5.00.2195.2228, and it should be 133, 904 bytes in size. Also be sure that all domain controllers are online.
Service: "Server" - error: "Not enough server storage is available to process this command." See ME151427.
Service: "Server" - error: "A device attached to the system is not functioning." See ME231604.
Service: "Microsoft Firewall" - error: "The server is not operational." See ME282035.
Service: "Application Management" - error: "The specified module could not be found." See ME328213.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...