Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 7000 Source: Service Control Manager

Level
Description
The <service or device name> service failed to start due to the following error: <error description>
Comments
 
- Service: SQL Server Agent, error: "The service did not respond to the start or control request in a timely fashion" - See ME948907 and ME955801.
- Service: The Microsoft Exchange Transport Log, error: "The service did not respond to the start or control request in a timely fashion" - See ME944752.
- Service: Microsoft Exchange EdgeSync, error: "The service did not respond to the start or control request in a timely fashion" - See ME944752.
- Service: Office Communications Server Access Edge, error: "The service did not respond to the start or control request in a timely fashion" - See ME941724.
- Service: <service name>, error: "The service did not respond to the start or control request in a timely fashion" - See ME922918.
- Service: Parallel port driver, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it" - See ME935497.
- Service: IIS Admin Service, error: "The executable program that this service is configured to run in does not implement the service" - See ME922729.
- Service: InterBase Guardian, error: "The system cannot find the path specified" - See "Borland Support Document 2153".
- Service: InterBase Guardian, error: "%1 is not a valid Windows NT application" - See "Borland Support Document 2153".
- Service: InterBase Server, error: "%1 is not a valid Windows NT application" - See "Borland Support Document 2153".
- Service: SSIS, error: "The service did not respond to the start or control request in a timely fashion" - See ME918644.
- Service: CMDIDE, error: "The specified service is invalid or since the effective device is not associated, it can not be started" - See "IBM Support Document id: MIGR-54383".
- Service: SQLSERVERAGENT, error: "The service did not respond to the start or control request in a timely fashion" - See "Dell Support Document Number: TT1061850".
- Service: COM+ System Application, error: "The service did not respond to the start or control request in a timely fashion" - See ME910383.
- Service: Network Load Balancing, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. Network Load Balancing is not installed on the system" - See WITP80070 and WITP73999.
- Service: ASCTRM, error: "The specified driver is invalid" - See WITP78144.
- Service: IBM Tivoli Storage Resource Manager server, error: "%1 is not a valid Win32 application" - See "IBM Support Reference #21160652".
- Service: SnaBase, error: "The service did not respond to the start or control request in a timely fashion" - See ME170072.
- Service: pcAnywhere Host - See the link to "Symantec Knowledge Base Document ID: 2005053108133212".
- Service: Symantec Host IDS Agent - See the link to "Symantec Knowledge Base Document ID: 2004040806484453".
- Service: SnaServer, error: "The service did not start due to a logon failure" - See ME262377.
- Service: SharePoint Portal Server, error: "SharePoint Portal Server is not a valid Win32 application" - See ME325680.
- Service: Microsoft Exchange Information Store, error: "%Microsoft Exchange Information Store053" - See ME926204.
- Service: Microsoft Exchange Information Store, error: "Microsoft Exchange Information Store is not a valid Win32 application" - See ME325680.
- Service: MUP, error: "An instance of the service is already running" - See ME136934.
- Service: NetBEUI Protocol, error: "The system cannot find the file specified" - See ME193840 and WITP72137.
- Service: BizTalk Adapter for MQSeries, error: "The service did not respond to the start or control request in a timely fashion" - See ME319221 for a hotfix applicable to Microsoft BizTalk Adapter for MQSeries 1.0.
- Service: SMS_INVENTORY_AGENT_NT, error: "The service did not start due to a logon failure" - See ME191328.
- Service: SMS_PACKAGE_COMMAND_MANAGER_NT, error: "The service did not start due to a logon failure" - See ME191328.
- Service: SMS Remote Control Keyboard Driver, error: "Cannot create a file when that file already exists" - See ME156745.
- Service: SMS Remote Control Keyboard Driver, error: "Not enough storage is available to process this command" - See ME156745.
- Service: Microsoft Message Queue Service, error: "The service did not respond to the start or control request in a timely fashion" - See ME234372.
- Service: Microsoft Exchange Mailbox Cleanup Agent, error: "The service did not start due to a logon failure" - See ME188641.
- Service: Cdralw2k, error: "The system cannot find the file specified" - See ME317224.
- Service: WINS Client(TCP/IP), error "A device attached to the system is not functioning" - See ME170135 and ME183901.
- Service: MSSQLSERVER, error "The service did not respond to the start or control request in a timely fashion" - See ME558119.
- Service: MSSQLSERVER - See ME306034.
- Service: Messenger, error: "The pipe state is invalid" - See ME823830 for a hotfix applicable to Microsoft Windows XP.
- Service: World Wide Web Publishing Service, error: "The account specified for this service is different from the account specified for other services running in the same process" - See ME304201.
- Service: Windows Media Station Service, error: "The service did not start due to a logon failure" - See ME282456.
- Service: Microsoft Exchange MTA Stacks, error: "The service did not respond to the start or control request in a timely fashion" - See ME325907.
- Service: Microsoft Exchange Message Transfer Agent, error: "The service did not respond to the start or control request in a timely fashion" - See ME246762.
- Service: Microsoft Fax Server, error: "The service did not start due to a logon failure" - See ME241587.
- Service: Microsoft Exchange System Attendant, error: "Access is denied" - See ME312417.
- Service: Microsoft Exchange System Attendant, error: "The service did not start due to a logon failure" - See ME272981, ME241587 and ME260338.
- Service: Windows Trace Session Manager, error: "The service did not respond to the start or control request in a timely fashion" - See ME839803.
- Service: Directory Replicator, error: "Access is denied" - See ME172362.
- Service: Spooler, error: "The system cannot find the file specified" - See ME177785.
- Service: IBM Token Ring Adapter, error: " A Device attached to the system is not functioning" - See ME171332.
- Service: RIP for Nwlink IPX, error: "The parameter is incorrect" - See ME165941.
- Service: DriverLINX Port I/O Driver, error: "The system cannot find the file specified" - From a newsgroup post: "In my case, a reinstall of FreshDiagnose (from Fresh Devices) solved this problem. The needed driver is from Scientific Software Tools, and others with similar problems may look to other software that may need to access I/O ports".
- Service: MSDTC, error: "The filename, directory name, or volume label syntax is incorrect" - This event occurs if you install MSDTC in an incorrect path. See ME223397 for more information.
- Service: Microsoft ISA Server Storage, error: "The service did not respond to the start or control request in a timely fashion" - See ME884495.
- Service: Microsoft ISA Server Control, error: "The service did not respond to the start or control request in a timely fashion" - See ME838857.
- Service: Microsoft Exchange POP3, error: "The executable program that this service is configured to run in does not implement the service" - See ME296765.
- Service: NfsRdr, error: "The system cannot find the file specified" - See ME288237.
- Service: OrangeWare USB Enhanced Host Controller Service, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it" - From a newsgroup post: "The only way I could find this device is by getting into Device Manager, and then viewing hidden files. The device had the yellow exclamation point. I uninstalled it, scanned for hardware changes and it did not find it. So looks like the problem is fixed".
- Service: ASInsHelp, error: "The system cannot find the file specified" - This issue apparently occurs after removing the ASUS Cool&Quiet software. From a newsgroup post: "To turn off this service, which does not seem to be uninstalled after removing the ASUS Cool&Quiet software or drivers, go to device manager -> view -> show hidden devices -> look under Non-Plug and Play Drivers and you will see it right at the top. It will probably have the yellow exclamtion point on it since the file is apparently missing (And cannot be found when searching the Asus CD). Access it, and on the driver tab, change the startup type to disabled".
- Service: Hardlock, error: "The request could not be performed because of an I/O device error" - A newsgroup post suggests reinstalling the Hardlock drivers.
- Service: Microsoft Exchange Routing Engine, error: "The executable program that this service is configured to run in does not implement the service" - This error occurs during uninstallation / installation of IIS when Exchange Server is installed on the same machine.

Check: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters

DispatchEntries should contain the following:

SMTPSVC
NNTPSVC
IMAP4Svc
POP3Svc
RESvc

- Service: Novell NetWare Resource Manager, error: "The system cannot find the file specified" - From a newsgroup post: "It looks like I may have resolved this problem. I found the following information in the registry:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RESMGR]
"ImagePath"="System32\NetWare\resmgr.sys"
"DisplayName"="Novell NetWare Resource Manager"
"Group"="NetWare Services"

The file specified in the ImagePath value did not exist in that folder, but I found it elsewhere on the drive. I compared the version number, size, date, and time on the file that I found with the same file from a working machine, and it was a match. So I copied the file into the C:\Windows\System32\NetWare folder, and now the machine logs in to the network without any problems. The registry information above actually appears in 3 or 4 places throughout the registry, but in each case, the ImagePath value was the same".
- Service: Security Center, error: "The executable program that this service is configured to run in does not implement the service." - From a newsgroup post: "There are two registry entries you should check in order to ensure that they have the correct values.

Navigate to HKEY_LOCAL_MACHINE/ SYSTEM/CurrentControlSet/Services. Scroll to locate and single-click on wscsvc, look in the right-hand panel for the value named ImagePath. Under the Data column, it should read:  %SystemRoot%\System32\svchost.exe -k netsvcs

Now, double-click on or click the + sign beside wscsvc, single-click on Parameters and look in the right-hand panel for the value named ServiceDll. Under the Data column, it should read: %SYSTEMROOT%\system32\wscsvc.dll.

If the above values are correct, then the wscsvc.dll file may be corrupted. There is a copy of this file in the Windows\System32\dllcache folder (the dllcache folder is a hidden system folder, so you'll need to set your folder options to Show hidden files and folders and uncheck the checkbox next to Hide protected operating system files). Copy the wscsvc.dll file from this folder into the Windows\System32 folder".
Service: splknetdrv, Error: The system cannot find the file specified. - This was recorded on a server with Splunk 6.5 installed with the "Local Windows network monitoring" input enabled. No networking data was being collected. A restart of the server fixed the problem and the Splunk network driver started to collect the data.
Service: Parallel port driver, Error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. - According to ME933757, this problem may occur if a device is not connected to the computer but the driver service of the device is enabled. The article provides a description of registry keys that can be updated to fix it.
Error ".. not a valid Win32 application." - In many cases, this is caused by the presence of a file or a folder called "C:\Program". Removing or deleting it fixed the problem.
Service: Diagnostic - See EV100600 (Event ID 7000 The Diagnostic Service Host service failed to start) for suggestions on how to add the required users to ability to profile system performance (using group policy).


Service: "PDIHWCTL", Error: "The system cannot find the file specified." - The error appears after installing X-Rite i1Match on a x64 operating system. The driver fails to install correctly. To get rid of the error remove:

HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > PDIHWCTL
Service: "PDIHWCTL", Error: "The system cannot find the file specified." - The error appears after installing X-Rite i1Match on a x64 operating system. The driver fails to install correctly. To get rid of the error remove:

HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Services > PDIHWCTL
In my case I found the HTTP non-plug & play driver disabled (from Device Manager - View - Show Hidden Devices - Non-Plug & Play Drivers - right click and Enable). The system must be restarted.
Service: ASInsHelp - This error has occurred for me because I had installed the RAM disk from Asus. On my Dell system, the RAM disk but did not work, so I uninstalled it immediately. There were but not all files and registry entries removed.
This event may be get triggered if you use the .Net Framework program InstallUtil to register a service and the binary you are trying to register is in a place inaccessible to the system. Check permissions on files and folders.
Service: "SessionLauncher" - This was caused by Sonic/Roxio software. I no longer required this software so I disabled the "SessionLauncher" service.
- Service: SQL Server Agent, error: "The service did not respond to the start or control request in a timely fashion" - See ME948907 and ME955801.
- Service: The Microsoft Exchange Transport Log, error: "The service did not respond to the start or control request in a timely fashion" - See ME944752.
- Service: Microsoft Exchange EdgeSync, error: "The service did not respond to the start or control request in a timely fashion" - See ME944752.
- Service: Office Communications Server Access Edge, error: "The service did not respond to the start or control request in a timely fashion" - See ME941724.
- Service: <service name>, error: "The service did not respond to the start or control request in a timely fashion" - See ME922918.
- Service: Parallel port driver, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it" - See ME935497.
- Service: IIS Admin Service, error: "The executable program that this service is configured to run in does not implement the service" - See ME922729.
- Service: InterBase Guardian, error: "The system cannot find the path specified" - See "Borland Support Document 2153".
- Service: InterBase Guardian, error: "%1 is not a valid Windows NT application" - See "Borland Support Document 2153".
- Service: InterBase Server, error: "%1 is not a valid Windows NT application" - See "Borland Support Document 2153".
- Service: SSIS, error: "The service did not respond to the start or control request in a timely fashion" - See ME918644.
- Service: CMDIDE, error: "The specified service is invalid or since the effective device is not associated, it can not be started" - See "IBM Support Document id: MIGR-54383".
- Service: SQLSERVERAGENT, error: "The service did not respond to the start or control request in a timely fashion" - See "Dell Support Document Number: TT1061850".
- Service: COM+ System Application, error: "The service did not respond to the start or control request in a timely fashion" - See ME910383.
- Service: Network Load Balancing, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. Network Load Balancing is not installed on the system" - See "JSI Tip 7640" and "JSI Tip 2679".
- Service: ASCTRM, error: "The specified driver is invalid" - See WITP78144.
- Service: IBM Tivoli Storage Resource Manager server, error: "%1 is not a valid Win32 application" - See "IBM Support Reference #21160652".
- Service: SnaBase, error: "The service did not respond to the start or control request in a timely fashion" - See ME170072.
- Service: pcAnywhere Host - See the link to "Symantec Knowledge Base Document ID: 2005053108133212".
- Service: Symantec Host IDS Agent - See the link to "Symantec Knowledge Base Document ID: 2004040806484453".
- Service: SnaServer, error: "The service did not start due to a logon failure" - See ME262377.
- Service: SharePoint Portal Server, error: "SharePoint Portal Server is not a valid Win32 application" - See ME325680.
- Service: Microsoft Exchange Information Store, error: "%Microsoft Exchange Information Store053" - See ME926204.
- Service: Microsoft Exchange Information Store, error: "Microsoft Exchange Information Store is not a valid Win32 application" - See ME325680.
- Service: MUP, error: "An instance of the service is already running" - See ME136934.
- Service: NetBEUI Protocol, error: "The system cannot find the file specified" - See ME193840 and "JSI Tip 0813".
- Service: BizTalk Adapter for MQSeries, error: "The service did not respond to the start or control request in a timely fashion" - See ME319221 for a hotfix applicable to Microsoft BizTalk Adapter for MQSeries 1.0.
- Service: SMS_INVENTORY_AGENT_NT, error: "The service did not start due to a logon failure" - See ME191328.
- Service: SMS_PACKAGE_COMMAND_MANAGER_NT, error: "The service did not start due to a logon failure" - See ME191328.
- Service: SMS Remote Control Keyboard Driver, error: "Cannot create a file when that file already exists" - See ME156745.
- Service: SMS Remote Control Keyboard Driver, error: "Not enough storage is available to process this command" - See ME156745.
- Service: Microsoft Message Queue Service, error: "The service did not respond to the start or control request in a timely fashion" - See ME234372.
- Service: Microsoft Exchange Mailbox Cleanup Agent, error: "The service did not start due to a logon failure" - See ME188641.
- Service: Cdralw2k, error: "The system cannot find the file specified" - See ME317224.
- Service: WINS Client(TCP/IP), error "A device attached to the system is not functioning" - See ME170135 and ME183901.
- Service: MSSQLSERVER, error "The service did not respond to the start or control request in a timely fashion" - See ME558119.
- Service: MSSQLSERVER - See ME306034.
- Service: Messenger, error: "The pipe state is invalid" - See ME823830 for a hotfix applicable to Microsoft Windows XP.
- Service: World Wide Web Publishing Service, error: "The account specified for this service is different from the account specified for other services running in the same process" - See ME304201.
- Service: Windows Media Station Service, error: "The service did not start due to a logon failure" - See ME282456.
- Service: Microsoft Exchange MTA Stacks, error: "The service did not respond to the start or control request in a timely fashion" - See ME325907.
- Service: Microsoft Exchange Message Transfer Agent, error: "The service did not respond to the start or control request in a timely fashion" - See ME246762.
- Service: Microsoft Fax Server, error: "The service did not start due to a logon failure" - See ME241587.
- Service: Microsoft Exchange System Attendant, error: "Access is denied" - See ME312417.
- Service: Microsoft Exchange System Attendant, error: "The service did not start due to a logon failure" - See ME272981, ME241587 and ME260338.
- Service: Windows Trace Session Manager, error: "The service did not respond to the start or control request in a timely fashion" - See ME839803.
- Service: Directory Replicator, error: "Access is denied" - See ME172362.
- Service: Spooler, error: "The system cannot find the file specified" - See ME177785.
- Service: IBM Token Ring Adapter, error: " A Device attached to the system is not functioning" - See ME171332.
- Service: RIP for Nwlink IPX, error: "The parameter is incorrect" - See ME165941.
- Service: DriverLINX Port I/O Driver, error: "The system cannot find the file specified" - From a newsgroup post: "In my case, a reinstall of FreshDiagnose (from Fresh Devices) solved this problem. The needed driver is from Scientific Software Tools, and others with similar problems may look to other software that may need to access I/O ports".
- Service: MSDTC, error: "The filename, directory name, or volume label syntax is incorrect" - This event occurs if you install MSDTC in an incorrect path. See ME223397 for more information.
- Service: Microsoft ISA Server Storage, error: "The service did not respond to the start or control request in a timely fashion" - See ME884495.
- Service: Microsoft ISA Server Control, error: "The service did not respond to the start or control request in a timely fashion" - See ME838857.
- Service: Microsoft Exchange POP3, error: "The executable program that this service is configured to run in does not implement the service" - See ME296765.
- Service: NfsRdr, error: "The system cannot find the file specified" - See ME288237.
- Service: OrangeWare USB Enhanced Host Controller Service, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it" - From a newsgroup post: "The only way I could find this device is by getting into Device Manager, and then viewing hidden files. The device had the yellow exclamation point. I uninstalled it, scanned for hardware changes and it did not find it. So looks like the problem is fixed".
- Service: ASInsHelp, error: "The system cannot find the file specified" - This issue apparently occurs after removing the ASUS Cool&Quiet software. From a newsgroup post: "To turn off this service, which does not seem to be uninstalled after removing the ASUS Cool&Quiet software or drivers, go to device manager -> view -> show hidden devices -> look under Non-Plug and Play Drivers and you will see it right at the top. It will probably have the yellow exclamtion point on it since the file is apparently missing (And cannot be found when searching the Asus CD). Access it, and on the driver tab, change the startup type to disabled".
- Service: Hardlock, error: "The request could not be performed because of an I/O device error" - A newsgroup post suggests reinstalling the Hardlock drivers.
- Service: Microsoft Exchange Routing Engine, error: "The executable program that this service is configured to run in does not implement the service" - This error occurs during uninstallation / installation of IIS when Exchange Server is installed on the same machine.

Check: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\InetInfo\Parameters

DispatchEntries should contain the following:

SMTPSVC
NNTPSVC
IMAP4Svc
POP3Svc
RESvc

- Service: Novell NetWare Resource Manager, error: "The system cannot find the file specified" - From a newsgroup post: "It looks like I may have resolved this problem. I found the following information in the registry:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RESMGR]
"ImagePath"="System32\NetWare\resmgr.sys"
"DisplayName"="Novell NetWare Resource Manager"
"Group"="NetWare Services"

The file specified in the ImagePath value did not exist in that folder, but I found it elsewhere on the drive. I compared the version number, size, date, and time on the file that I found with the same file from a working machine, and it was a match. So I copied the file into the C:\Windows\System32\NetWare folder, and now the machine logs in to the network without any problems. The registry information above actually appears in 3 or 4 places throughout the registry, but in each case, the ImagePath value was the same".
- Service: Security Center, error: "The executable program that this service is configured to run in does not implement the service." - From a newsgroup post: "There are two registry entries you should check in order to ensure that they have the correct values.

Navigate to HKEY_LOCAL_MACHINE/ SYSTEM/CurrentControlSet/Services. Scroll to locate and single-click on wscsvc, look in the right-hand panel for the value named ImagePath. Under the Data column, it should read:  %SystemRoot%\System32\svchost.exe -k netsvcs

Now, double-click on or click the + sign beside wscsvc, single-click on Parameters and look in the right-hand panel for the value named ServiceDll. Under the Data column, it should read: %SYSTEMROOT%\system32\wscsvc.dll.

If the above values are correct, then the wscsvc.dll file may be corrupted. There is a copy of this file in the Windows\System32\dllcache folder (the dllcache folder is a hidden system folder, so you'll need to set your folder options to Show hidden files and folders and uncheck the checkbox next to Hide protected operating system files). Copy the wscsvc.dll file from this folder into the Windows\System32 folder".
- Service: Windows SharePoint Services Administration - The problem appeared after applying M934525 (Cumulative Security Update for Windows SharePoint Services 3.0) on a server running Microsoft Office Project Server 2007. Project Web Access also stopped working after applying this fix.

To correct the problem follow these steps:

1. Run "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\bin\psconfig –cmd upgrade –inplace b2b –wait –force".
2. In registry editor add/modify the following values on "HKLM\System\CurrentControlSet\Control":
a) ServicesPipeTimeout   DWORD   60000  (decimal).
b) WaitToKillServiceTimeout changed to “120000”.
3. Reboot the server.
- Service: DS1410D - In my case, this error came up on a Windows XP Professional system after uninstalling the driver for an Aladdin or HASP Dongle (Hardware Lock) which came with a special Wind turbine management program. After uninstalling the program, the file SYSTEM32\drivers\DS1410D.SYS has been deleted, but in the registry, there still was an entry to start this service while booting, namely HKLM/System/CurrentControlSet/services/DS1410D. After deleting the registry entry, the error was gone.


- Service: EntDrv52, error: "The system cannot find the file specified" - See the link to "McAfee Support KB48208" for details on solving this issue.
Service: SMINFSYS, error: ervice failed to start due to blocking to load. - This event was in my case generated due to driver SMINFSYS which is used by RADIA system and on x64 bit servers is normally not installed, so then it could not be also loaded. This could be fixed by a new update from RADIA System. Other potential causes:
- Driver signed policy could be set to blocked
- Driver blocked in the device manager to load or in the group policy
- Service: MSSQLServer, error: "The service did not start due to a logon failure" - In our case, we are running under a users account, "SQLSvc". This account must be a member of the "Builtin\Administrators" or the "Local Administrators" group. Adding the user resolved the problem.
- Service: Portable Media Serial Number Service, error: "The executable program that this service is configured to run in does not implement the service" - A corrupt registry entry was found in the value named "netsvcs" (REG_MULTI_SZ) at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost. One of the entries for this value was misspelled "WmdmPmSp" instead of "WmdmPmSN". The former spelling is used in W2k and XP. The latter spelling is used in W2K3. Typing "Net Start WmdmPmSp" at a command prompt gives the message "The service name is invalid". A reboot was required after correcting the mistake to allow the service to start.
- Service: UMAXDRV, error: "The system cannot find the file specified" - After uninstalling your Umax scanner, sometimes, the associated service does not get removed correctly. Run regedit and remove the following keys to stop this error:
HKey_local_machine\System\CurrentControlSet\Services\Umaxdrv
HKey_local_machine\System\ControlSet003\Services\Umaxdrv.
"The service did not respond to the start or control request in a timely fashion" or on a Win2k3 server "The account specified for this service is different from the account specified for other services running in the same process" – See ME155814 and ME315194.
- Service: ASCTRM, error: "The specified driver is invalid" - See ME817194. Also check ME318746 for additional information.
- Service: WINS Client(TCP/IP), error: "A device attached to the system is not functioning" - See ME250262.
- Service: Microsoft SMTP, error: "the system cannot find the file specified" - See ME245208.
- Service: Microsoft Exchange Management, error: "The service did not respond to the start or control request in a timely fashion" - See ME309511.
- Service: Microsoft Exchange Information Store, error: "The service did not respond to the start or control request in a timely fashion" - See ME184205 and ME288952.
- Service: Cluster Server, error: "The service did not respond to the start or control request in a timely fashion" - See ME262962.
- Service: Cluster, error: "The service did not start due to a logon failure" - See ME171390 and ME247720.
- Service: Cdralw2k, error: "This driver has been blocked from loading" - See ME315345.
- Service: Protected Storage, error: "The system cannot find the path specified" - See ME189649 and ME249023.
- Service: Intel 82557-based PRO Adapter Driver, error: "A device attached to the system is not functioning" - See ME224984.
- Service: <service>, error: The service did not start due to a logon failure - See ME259733.
- Service: Microsoft Exchange Directory, error: "The service did not start due to a logon failure" - See ME327545.
- Service: Navap, error: "The system cannot find message for message number 0x%1 in message file for %2" appears in event log when restarting" - See Symantec Knowledge Base ID: 2000060809203648.
- Service: Network Load Balancing, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. Network Load Balancing is not installed on the system" - See ME833375.
- Service: IP Filter Driver, error: "The system cannot find the file specified" - See ME178272.
- Service: Certificate Authority, error: "The service did not respond to the start or control request in a timely fashion" - See ME217339.
- Service: SNABase, error: "The service did not start due to a logon failure" - See ME262377.
- Service: Messenger, error: "The pipe state is invalid" - See ME823830 for a hotfix applicable to Microsoft Windows XP.
- Service: ATM Emulated LAN - The following Q articles provide information on LAN emulation: ME231278, ME231713, ME284912, and ME282179.
- Service: BlackBerry Server BLACKBERRY - See "BlackBerry Support Article Number: KB-02642".
- Service: MUP - See the link to "Citrix Support Document ID: CTX835777".
- Service: Backup Exec - See the link to "Veritas Support Document ID: 268749".
- Service: Backup Exec 8.x Device & Media Service - See "Veritas Support Document ID: 242522".
- Service: Microsoft Exchange Internet Mail Service - See ME888031.
- Service: VERITAS VSS Provider - See the link to "Veritas Support Document ID: 272751".
- Service: Spooler - See ME317218.
- Service: MSSQLServer - See ME188685.
- Service: DS1410D - See the link to "Citrix Support Document ID: CTX106399".
- Service: NVIDIA NDIS IO Control Driver - See the link to "Nvidia Support Answer ID 262".
- Service: OnePointAuxiliary - See ME300323.
- Service: SAVRT - See the link to "Symantec Support Document ID: 2004072905471148".
- Service: Microsoft Proxy Server Administration, error: "Access is denied" - See ME812077.
- Service: InterBase Guardian - Read "IBPhoenix KnowledgeBase Id: 466".
- Service: Diagnostic Facility COM Server - See "Citrix Support Document ID: CTX108839".
- Service: OfficeScanNT Listener - See "Trend Micro Support Solution ID: 1029585".

- Service: MAC Bridge Miniport, error: "The system cannot find the file specified" - From a newsgroup post: "I have had this problem when uninstalling bridging on a Windows Server 2003 server. Windows does not properly handle the uninstall process, and some registry keys remain in place. What you need to do is to delete these registry keys (export them before doing so, just to be sure, so you can also import them when needed):
HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Bridge

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/BridgeMP

and if you also have the load balancing error in your event log also delete the following key:

HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/WLBS".

- Service: rxpdn - From a newsgroup post: "From some initial web searches, this appears to be caused by a variant of the Agobot worm/backdoor".

- Service: hpdj - From s news group post: "I think I have fixed the problem. I recalled that I tested a Hewlett Packard Desk Jet for my nephew a few months ago and only recently, I uninstalled the drivers. It looks like the uninstall process was not 100% successful. I have now manually removed the remaining files, and this appears to have cured the problem".

If you cannot log on or you experience a long delay on a domain controller, or on a member computer that is running Windows 2000, Windows XP, or Windows Server 2003, then see ME883268.

See the ME157913 and MSW2KDB for additional information about this event.
- Service: Navapel, error: "System cannot find the file specified" - You may see this event after you upgrade to Symantec AntiVirus Corporate Edition 9.x. Navapel is a service used by Symantec AntiVirus 8.x and earlier, and it is not used by Symantec AntiVirus 9.x. To solve the problem remove the registry key that loads the Navapel service. The key is found at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NAVAPEL. See The link to "Symantec Knowledge Base Document ID: 2004070611591448" for details.
- Service: mrtRate, error: "The system cannot find the file specified" - See ME810905 for information on the Mrtrate.sys driver.
- Service: ISA Server Packet Filter Extension Driver, error: "This driver has been blocked from loading" - This event is seen along with Event ID 876. When you install ISA 2000 on Windows Server 2003, it automatically blocks this driver from loading. To resolve this, install ISA SP2 along with "ISA Server 2000: Required Updates for Windows Server 2003". See ME555427 for more details.


- Service: SharePoint Portal Server, error: "The service did not respond to the start or control request in a timely fashion" - See ME316267 to resolve this problem.
- Service: ASP.NET State service, error "The service did not start due to a logon failure" - In one case, on Windows 2003 SP1, this service could no longer be started on any computer in the domain that was not a domain controller, after changes were made to the Default Domain Policy. It was accompanied by EventID 534 from source Security and EventID 7041 from source Service Control Manager, Service aspnet_state.
The "Default Domain Policy" policy setting named "Log on as a service" had been empty, but when entries were added for some groups, this Event ID appeared when I tried to start the "ASP.NET State service".
To resolve this, the "Default Domain Policy" policy setting named "Log on as a service" had "ASPNET" added to its list. When Group Policy was refreshed on the computer that had the problem, the service could be started without problem.
- Service: IMAPI CD-Burning COM, error: "IMAPI CD-Burning COM Service is not a valid Win32 application" - I resolved this problem by replacing “C:\windows\system32\imapi.exe” from the original install CD. This was also the solution for the error "there is no disc in the drive" when attempting to burn CDs in the Windows XP Explorer.
- Service: Network Load Balancing - I have seen this many times lately on Windows 2003, after Backup Exec has been installed. It seems Backup Exec will add registry settings for Windows Load Balance service even if the OS does not support it like SBS. You just need to remove the following registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\WLBS
and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WLBS.
Be sure to make a backup of the registry before.
Instantly returned failure to start service, but no additional details logged. Trying to start SMSEXEC.EXE from the command prompt caused a popup message saying that a dll was not found. Replacing the dll indicated still more missing dll files. I ran “setup.exe” from the CD and performed a site reset to replace the missing files and the problem was fixed. The cause of the missing files I believe is related to a power failure.
- Service: EXIFS, error: "The system cannot find the file specified" - I received this error when I upgraded Exchange 2000 to 2003. I had run the ifsdrive script listed in Microsoft Knowledge Base Article ME305145 and assigned the ifsdrive to the letter N from the original M. Re-running the script and assigning the drive to "none" cured the problem.
- Service: IIS Admin Service, error: The executable program that this service is configured to run in does not implement the service. - no info
- Error: Not a valid Win32 application. - no info
- Service: Security Accounts Manager, error: The account specified for this service is different from the account specified for other services running in the same process.  - no info
- Service: FUTUREX, error: The specified network password is not correct. - no info
- Service: Crypkey License, error: The system cannot find the file specified. - no info
- Service: Netbeui Protocol, error: The system could not find the file specified - no info
- Service: RET35 Protocol Driver, error: The system cannot find the path specified. - no info
- Service: Cardex, error: Cannot create file when that file already exists - no info
- Service: .NET Framework Service, error: "The system cannot find the file specified" - No info.
- Service: General Purpose USB Driver, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it" - No info.

For generic information about the "The system cannot find the file specified" error see the link Error code 2.
Service "mrtRate", Error: "The system cannot find the file specified." - Received this error on Windows Server 2003 after installing Quicken 2004 Deluxe. Followed the procedure to disable Quicken Background Download Manager driver (Edit->Preferences->Customize Online Updates, Connection Tab, ALT+SHIFT+4) but did not work at all. Found registry entry of HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\mrtRate with DWORD:Start = 2 (hex). Based on information provided at end of Microsoft ME245835 (although unrelated article), I changed WORD:Start to 4 (hex), restarted, and no sign of Event ID 7000 (mrtRate).
- Service: BASFND, error: The system cannot find the file specified - See HP threadId 192205.


- Service: QoS Packet Scheduler, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it" - After Uninstalling QoS Packet scheduler, this error started to fill up the system event log. Getting rid of every registry entry of the following subkeys: “PSched” and “RSVP”, in every instance of “HKLM\System\ControlSet” solved the problem for me.
- Service: Network Load Balancing, error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it" - See Veritas TechNote ID: 263037.
- Service: naifiltr - Copy the "naifiltr.sys" file from a machine that does not experience this problem to the same subfolder on the target machine. Launch the Services applet of the Control Panel and make sure that the McShield service is running, that it is running under the Local System account, and that it is set to start automatically.
- Error: "The system cannot find the device specified" - I encountered this error on several machines of a customer. Apparently, the "aspi32.sys" file was not present on the systems. I downloaded the "aspi_v470.exe" from Adaptec and the problem was gone.
In my case, the event was caused by NetBEUI. Anyway, you should be able to install NetBEUI by selecting Install from the properties of a NIC and browsing to the appropriate folder in the ValueAdd folder on your Windows XP CD. However, when you use this method, the "nbf.sys" file is copied into "%system32%\Drivers", but the accompanying ".inf" file doesn’t go into the "%systemroot%\Inf" folder. Copy it manually, and NetBEUI works the next time you reboot.
- Service: Cdralw2k - ME315378 might be able to help you.
Service: IPSEC driver, error: Insufficient system resources exist to complete the requested service. -  This would be followed by a 4281 IPSEC: Unable to allocate required resources. Initialization failed. Due to program MFL Pro, installed along with Brother Multifunction Printer (in my case an MFC 5100). Brother have released a registry fix which basically seems to remove any dependances the BR Serial service has on any other service. The patch can be downloaded from the link below - Brother Solutions Center FAQ, id prfaq0788.

For a generic description of the "Insufficient system resources exist to complete the requested service" error, see the link to Error code 1450.
- Service: Network Load Balancing - Got this after an upgrade from 2000 Server Enterprise to 2003 Enterprise. It is caused by the fact that even if Network Load Balancing (NLB) is not currently installed, some NLB registry keys may be present in the registry. See ME268437 for registry fix.
- Service: CDRALW2K - I came across this error on a laptop with a modular CD-RW and Easy CD Creator 5 installed. If the CD-RW drive is not in its modular bay, this error occurs.


- Service:  Banyan VINES IP Transport Protocol, error: The request could not be performed because of an I/O device error - This was caused by the Banyan VINES Windows 2000 client still being bound to an adapter which I had disabled. I had to enter the VINES Setup and change the Network properties to point at the adapter I was now using. After a reboot, it worked fine.
- Service: Exchange 2000 System Attendant, error: 1053 - Removed the Msvcp60.dll file from the %System32% folder on the Exchange 2000 server. Beginning with Exchange 2000 SP2, the System Attendant service depends on this file, and does not start successfully if it is missing.
To fix it:
Reinstall Exchange 2000 SP2 or later.
-or-
Copy the Msvcp60.dll file from the Exchange 2000 SP2 CD or file share to the %System32% folder on the affected Exchange 2000 server, and then restart the server.
See ME325511.
- Service: SYMTDI, error: The filename, directory name, or volume label syntax is incorrect. - This happened when I installed Norton AntiVirus and I could not remove it by using uninstall. It stuck like glue until I edited my registry. SYMTDI is in the current control set under HKLM\System\Current Control Set\Services. (It may also be listed under DHCP Depend - please see Microsoft Knowledge Base Article - ME812335). It depeneds on the TCP/IP stack, so for it to stop loading I changed the Start DWORD value from 2 to 4, so it will not start.
Service "WrKPoET2000", error: "A device attached to the system is not functioning". I have this event after restarting the computer. I believe that this error comes from WinPPoverEthernet Service. For some reason this service can start, but cannot be restarted. The event occurred after attempts to restart this service. To fix this according to ME314357 there are three methods:

Method 1: Configure User Rights
If the user is on a stand-alone Windows XP-based computer, follow these steps:
Log on to the computer as administrator or as a member of the Administrators group.Start the Local Computer Policy snap-in. Expand Local Computer Policy, expand Computer Configuration, expand Windows Settings, and then expand Security Settings. Expand Local Policies, and then click User Rights Assignment. In the right pane, right-click Log on as a service, and then click Properties. Click Add User or Group, add the user that you want to the policy, and then click OK twice. Close the Local Computer Policy snap-in.

Method 2:Configure Logon Information for the Service
If the password is changed on the user account that the service uses to log on, configure the password to match the current password for that user. To do this, follow these steps: Click Start, click Control Panel, click Performance and Maintenance, and then click Administrative Tools. Double-click Services. In the right pane, right-click the appropriate service, and then click Properties. Click the Log On tab, type the correct password in the Password and Confirm Password boxes, and then click OK. Right-click the service, and then click Restart. Quit the Services tool.

Method 3:Configure the Service to Use the Built-in System Account
If the service still does not work with the specified user account, configure the service to log on to the built-in system account. To do this, follow these steps: Click Start, click Control Panel, click Performance and Maintenance, and then click Administrative Tools. Double-click Services. In the right pane, right-click the appropriate service, and then click Properties. Click the Log On tab, click Local System account, and then click OK. See ME314357 for details. For generic information about the "A device attached to the system is not functioning." error see the link to Error code 31.
Service: ASPI32, error: The system cannot find the file specified. - See the link to Dell's forum (Dimension - CD/DVD Drives) - installing the ASPI layer 4.60 from Roxio's web site, solved a number of similar issues.
- Service: SMS_NT_LOGON_DISCOVERY_AGENT, error: The system cannot find the path specified. - Uninstalling SMS off the server caused this error. See also Error code 3.
- "%1 is not a valid Win32 application". - This issue occurs when there is a file named Program in your SystemDrive folder. This file should be deleted. See ME812486 and ME325680 for more details. Please note that removing the file Program from your SystemDrive folder you might cause problems to the software that created it.
Service: "Ati HotKey Poller", error: "The system cannot find the file specified." - This service is installed in the latest ATI video card drivers. It provides the ability to hot key the display settings. I disabled the service and the issue was solved.

Service: "Cluster Service", error: "The service did not start because of a logon failure." - According to Microsoft: "The service account could not be authenticated. This may be because of a failure contacting a domain controller, or because account credentials are invalid. Check the service account name and password and ensure that the account is available and that credentials are correct. You may also try running the cluster service from a command prompt (if currently logged on as an administrator) by changing to the %systemroot%\Cluster directory (or where you installed the software) and typing ClusSvc -debug. If the service starts and runs correctly, stop it by pressing CTRL+C and troubleshoot the service account problem. This error may also occur if network connectivity is disabled through the system configuration or hardware profile. Microsoft Cluster Server requires network connectivity.
Service: "IPSEC driver", error: "Insufficient system resources exist to complete the requested service." - We tracked this one down to Modem Pooling Software we use. SpartaCom MPNT causes this error and is safe to ignore. However they have a fix to prevent the error. Go to www.spartacom.com Technote # TN4937. This resolved the issue.
For a generic description of the "Insufficient system resources exist to complete the requested service" error, see the link to Error code 1450.


Error: "The system cannot find the file specified." - Windows is trying to start the "mrtRate" service at boottime. I got this error after installing Quicken XG (Canadian Version of Quicken 2003). Get rid of the error by disabling Quicken's Background Downloading Driver (you can always do manual updates, and not waste ressources):
1) In Quicken, select Edit->Preferences->Customize Online Updates.
2) Click the Connection tab, then press Alt+Shift+4 (this command is NOT indicated in the window).
3) Click OK to confirm that you do want to disable the driver.
4) Reboot.
- "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it." - In my case this (the Sentinel service) was caused by a device driver that required a specific hardware attached to the system. Also it could have been solved by obtaining the latest driver from the manufacturer.
- "The executable program that this service is configured to run in does not implement the service." - See ME277770 for an example of conditions when such error can occur. The Microsoft Exchange POP3 service was missing from services MMC. I exported/imported all POP3Svc keys from a working server to this server.
Service: "Cdralw2k", error: "The service cannot be started, either because it is disabled or because it has no enabled devices associated with it."
Cause: Windows Media Player 7.0 loads an Adaptec driver for CD burners
Solution:  removed file from registry
Search through the registry for cdralwzk and turned off manually
Start, Run, regedit
Edit, Find, cdralw2k
Start, Edit DWORD value [changed values to 0]
Changed files:
- /LocalMachine/System/ControlSet001/Service/cdralw2k
- /LocalMachine/System/ControlSet002/Service/cdralw2k
Error: "The system cannot find the file specified." - I received this error when installing SQL Server 2000 enterprise edition on a cluster (IBM hardware). The symptoms are this: after successful install of SQL 2000 on node 1 of the cluster, node 2 fails to bring the services online thus failing them all back over to node 1. It appears this is caused by missing registry entries. A fix for this can be found at ME308010.
- "The service did not respond to the start or control request in a timely fashion." - When attempting to upgrade Norton AntiVirus Corporate Edition 7.6 to 8.0 on a Windows 2000 SP2+SRP server the services that didn't respond were Network Connections, Remote Access Control Manager and Telephony.
Service: "Intel 82557-based PRO Adapter Driver", Error: - "A device attached to the system is not functioning." This event is also associated with eventid: 5007. See ME224314. For a generic description of this error see the link to Error code 31.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...