Event ID: Event Source:

Event ID 7031 Source Service Control Manager

Event ID	7031
Source	Service Control Manager
Type	Error
Description	The <service name> service terminated unexpectedly. It has done this <n> time(s). The following corrective action will be taken in <no of ms> milliseconds: <action>.
English, please!	This information is only available to subscribers. An example of English, please!
Concepts to understand	What is a service? What is the role of the Service Control Manager? What is a "corrective action"?
Comments	Adrian Grigorof (Last update 3/14/2004): This error is not specific to the <service name> service but it is generated by the Service Control Manager when it detects that a specific service terminated ungracefully. In order to troubleshoot this error look for other events, logs, etc., that are specific to the service in question. - Service: "McShield" - This is caused by a bug in the McAfee software, install the latest version. - Service: "Print Spooler" - As per Microsoft, this problem may occur if a print job that contains an older version 3 DEVMODE structure that does not contain ICM information is submitted. When the spooler tries to reference this data, it causes the access violation. A post SP3 hotfix is available - see M324183. - Service: "IIS Admin Service" - See M311517. - Service: "Distributed Transaction Coordinator" - See M290637. - Service: "Microsoft ISA Server" - See M288247. - Service: "Remote Procedure Call (RPC)" - This may occur if the system is infected by the MSBlaster or LoveSAN Internet worm. See M823980 for details. See also the Symantec Security Response on how to detect it and remove it. Not a fix, but a way to work around occasional failures is to configure the "Recovery" option of the service to restart it if the service fails. I would not recommend setting all the 3 options to restart the service but only the first two "First failure" and "Second failure" - this way, you avoid an continuous failure/restart cycle. We used this for example with Adiscon MoniLog that failed occasionally. The Service Control Manager would simply restart it and the service worked fine. Miguel Cervantes (Last update 5/21/2009): Service RtcSrv - This may be caused by a bug in Office Communications Server 2007. See M961252 for an update download location (M961569). Jim Mitchell (Last update 1/8/2009): Service: Logon Session Broker - Using Vista SP1 I was unable to logon. Managed to logon in safe mode with networking and I'm still investigating. Mihai Andrei (Last update 6/27/2008): - Service: MOM - See M936161 and M949874 for hotfixes applicable to Microsoft Operations Manager (MOM) 2005. - Service: Print Spooler - See M890642 for a hotfix applicable to Microsoft Windows 2000 and Microsoft Windows Server 2003. - Service: Cluster service - See M923838 and M938615. - Service: Microsoft Firewall - See M919515 and M922440. - Service: DCOM Server Process Launcher - See M911106 for a hotfix applicable to Microsoft Windows Server 2003. - Service: AntigenService - See M928807 for a hotfix applicable to Microsoft Antigen for Exchange and Microsoft Antigen for SMTP Gateways. - Service: BizTalk Service BizTalk Group: BizTalkServerApplication - See M917848. - Service: COM+ System Application - See M916254. - Service: Remote Procedure Call (RPC) - See "Cisco Support Document ID: 44465" and "Cisco Support Document ID: 44466". - Service: MSSQLServer - See M840856. - Service: MSSQLServerOLAPService - See M328876. - Service: Symantec AntiVirus - See "Symantec Knowledge Base Document ID: 2005060211491948". - Service: DNS - See M555166. - Service: Site Server ILS Service - See M304166 and M316612. - Service: Network News Transport Protocol (NNTP) - See M304166 and M316612. - Service: Microsoft Exchange POP3 - See M304166 and M316612. - Service: Microsoft Exchange Information Store - See M926676 for a hotfix applicable to Microsoft Exchange Server 2003 and the link to "Howtonetworking case study" for additional information. - Service: Microsoft Exchange Routing Engine - See M304166 and M316612. - Service: Microsoft Exchange IMAP4 - See M304166 and M316612. - Service: Directory Synchronization Service - See M811280. - Service: Network News Transport Protocol (NNTP) - See M821749. - Service: Simple Mail Transport Protocol (SMTP) - See M304166, M821749 and the link to "Trend Micro Support Solution ID: 15065". - Service: IISService - See M899301. - Service: Message Queuing - See M842839. - Service: Internet Mail Service - See M884874 for a hotfix applicable to Microsoft Exchange Server 5.5. - Service: Windows Management Instrumentation - See M832250 for a hotfix applicable to Microsoft Windows Storage Server 2003 and Microsoft Server Appliance Kit 2.01. - Service: File Replication Service – See M896712 for a hotfix applicable to Microsoft Windows 2000. - Service: IIS Admin Service - See M899472 for a hotfix applicable to Microsoft IIS 5.0, M910618 for a hotfix applicable to Microsoft Exchange Server 2003, and the links to M919789, M919790, M925038 and "Trend Micro Support Solution ID: 15065" for additional information about this event. - Service: FTP Publishing Service - See M899472 for a hotfix applicable to Microsoft IIS 5.0. Also check M304166, M316612, M821749 and the link to "Trend Micro Support Solution ID: 15065" for additional information on this event. - Service: World Wide Web Publishing Service - See M899472 for a hotfix applicable to Microsoft IIS 5.0. Also check M304166, M821749, M919789 and the link to "Trend Micro Support Solution ID: 15065" for additional information on this event. Lee Davis (Last update 8/1/2007): - Service: Pop3 Connector - First thing to try if the service is continually stopping, is to go to the folder "C:\Program Files\Microsoft BackOffice\Connectivity\Incoming" and delete or move any of the mail in there. More often than not, a corrupt email is causing this issue. This can save a lot of time. Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! LHI (Last update 6/14/2007): - Service: GFI virusdef updater - See the link to "GFI Support KBID002282". Siddesh Onkari (Last update 6/10/2007): - Service: Backup Exec Remote Agent for Windows Servers - See "Veritas Support Document ID: 284155". Anonymous (Last update 6/4/2007): - Service: Archive Manager - This is a problem with Quest Archive Manager. Quest support has said that the August update will contain a fix for this problem. Massimo Artini (Last update 4/22/2007): - Service: "Microsoft Shared Fax" - Under Windows 2000 SBS (maybe also work under Windows 2003 SBS) the serviced crashed with an access violation error. I solved it by deleting all files in the fax queue: C:\Document & Settings\All User\Application Data\Microsoft\Shared Fax\Queue. Hoang Tan (Last update 1/4/2007): - Service: "Windows Management Instrumentation" - The service would crash every time it attempted to start. I cleared the repository (C:\winnt\system32\wbem\repository) and restarted the service as suggested to resolve the problem. Anonymous (Last update 12/17/2006): IISAdmin service kept stopping randomly. I called Microsoft support, just to find out that Symantec Mail Security form Microsoft Exchange 5.0 is the culprit. See “Symantec Knowledge Base Document ID: 2006120116344254” to resolve the problem. Ionut Marin (Last update 11/9/2006): - Service: Print Spooler - This problem occurs if an access violation occurs in the Print Spooler service. This occurs if the size of the print buffer is not sufficient, therefore it must be reallocated, however, in the call to reallocate the buffer, the GetPrinterInfo function allocates a 0 byte buffer and an access violation occurs. Check M820550, M888191, M888196, and M888206 to fix the problem. - Service: Remote Procedure Call (RPC) - See M327148. - Service: Microsoft Exchange Information Store - See M317482, M814924, M822949, M824467, M831276, M835437, M842000, M891005, and M892208. - Service: Microsoft Exchange System Attendant - See M301364. - Service: World Wide Web Publishing Service - See M308600. - Service: Cluster - See M258469, M272129, M295091, M321531, and the link to "Trend Micro Support Solution ID: 21441". - Service: Windows Installer - See M329819. - Service: Message Queuing - See M826820 and M830639. - Service: File Replication Service - See M255759. - Service: Information Store - See M329817. - Service: DNS Server - See M258073. - Service: Remote Registry Service - See M833777. - Service: IIS Admin Service - See M819865, M821749, M827214, M836177, M885264, and the link to "Symantec Support Document ID:2004040209303954". - Service: Telnet - See M832459 for a hotfix applicable to Microsoft Windows 2000. - Service: OfficeScan Master - See the link to "Trend Micro Support Solution ID: 19462". - Service: NAI ePolicy Orchestrator Agent - See "Network Associates Support Solution ID: NAI29545". - Service: Diagnostic Facility COM Server - See "Citrix Support Document ID: CTX104533". - Service: Quota Advisor - See "Veritas Support Document ID: 270419". - Service: Symantec AntiVirus - See the link to "Symantec Support Document ID:2004093011032448". - Service: NAIMAS32.EXE - See the link to "McAfee Support Solution ID: nai21726". - Service: Backup Exec Remote Agent - See the link to "Veritas Support Document ID: 242153". - Service: BlackBerry Mobile Data Server - See "BlackBerry Support Article Number: KB-02041". - Service: RightFax Connector - See "Captaris Support Answer ID 1277". - Service: Trend Micro Anti-Spyware for Enterprise (ASEE) 3.0 Server Agent - See "Trend Micro Support Solution ID: 1031154". - Service: Microsoft Connector for POP3 Mailboxes - From a newsgroup post: "The cause of this event could be due to a junk mail message with a long string, which could bring down POP3. The solution is to delete the pop connector and reinstall it. If you wish to try this, then go to Control Panel -> Add Remove Programs -> Microsoft SBS. Find the pop connector and uninstall it. Then delete or move the folder for the pop3 installation, C:\Program Files\Microsoft BackOffice\connectivity. After this, re-install the pop3 connector". According to Microsoft: "The specified service could not continue. This service is configured to report the number of failures and, after a specific number of failures are reported, the Service Control Manager will perform the recovery action configured for the specified service". See MSW2KDB for more details on this event. If you are using McAfee GroupShield 5.2 for Exchange, then see the link to "McAfee Support Solution ID: NAI31469" for information regarding this event. See M286350 to find out how to use the ADPlus tool to troubleshoot "Hangs" and "Crashes". Christoph Suter (Last update 7/17/2005): - Service: Print Spooler - After a long and intense search, I found the cause of the problem in the PC-Duo Remote Control Client version 8.6. After uninstalling this software, everything was fine. Version 9.0 from PC-Duo Remote Control does not have the issue anymore. Anonymous (Last update 4/12/2005): - Service: Print Spooler - One of our printers had a corrupt driver and every time someone printed to this printer, it would stop the spooler service and generate EventID 7031. Because the spooler was stopped now one could print. I found that one of the printers was giving an error when I tried to open the properties page. I deleted this printer from the server. I restarted the spooler and everyone was able to print. I then reinstalled the printer that I had removed using the latest print drivers and that resolved the problem. Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! Anonymous (Last update 4/7/2005): - Service: "COM+ System Application" - See M895200 for a hotfix applicable to Microsoft Windows XP. Anonymous (Last update 1/17/2005): - Service: Omni-NFS - I fixed this problem by installing the latest patch for Omni-NFS. See the link to "XLink Technical Support" to download the latest patch. Roland Hausin (Last update 9/18/2004): - Service: IISAdmin - On a Windows 2003 / Exchange 2003 server, the IISAdmin crashed and shut down a number of other services. All but the SMTP service could be manually restarted. The “C:\Program Files\Exchsrvr\MailRoot\vsi 1\BadMail” directory contained far more than 1.000.000 entries. After deleting all (using the command prompt), applying SP1, and rebooting the server, the problem was solved. J. Sjone (Last update 9/16/2004): - Service: Print Spooler - I fixed this problem by stopping the spooler services and then removing the “.spl” and “.shd” files from "<drive>:\<windows directory>\system32\spool\printers". Anonymous (Last update 7/14/2004): - Service: "Lotus Domino server" - It appears the Lotus Domino service hung up. A reboot followed by a reinstall of the transaction DB fixed the issue. Roland Hausin (Last update 4/25/2004): - Service: Microsoft Exchange Information Store - In our case, this problem appeared after we changed the user credentials for the service (i.e. switched from LocalSystem account to Administrator). We switched back and everything was back in order. Khabat (Last update 3/14/2004): Service: "Print Spooler" on Windows 2000 SP3. After installing M329170 the service won't start. I solved it by restoring the C:\WINNT\system32\LOCALSPL.DLL file from backup. Michael (Last update 3/14/2004): Service: "Print Spooler" - If you are using Terminal Server (i.e. Citrix) and you leave the server in "install" mode (change user /install) your print spooler will continue to stop every 3 (three) minutes. Go to Start/Run and type: change user /execute. This will allow the service to continue to run without interruption. Matthew Lohr (Last update 3/14/2004): Service: "Print Spooler" - I had this error occur when a user had connected to the server remotely. The default printer got changed to their printer somehow and all print jobs were essentially being routed back to them and then to the printer. When their machine was down it obviuosly would not connect. Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! Anonymous (Last update 11/8/2003): We recently experienced a problem where IIS, WWW, POP, SMTP, and IMAP4 services were restarting repeatedly with this message. At the same time, our server’s Adaptec 39320D-R SCSI RAID controller was verifying 2 of its mirrors. Once the mirrors were verified, the problem with the restarts went away. Gavin U. (Last update 10/13/2003): I experienced this error with the Backup Exec 9 Remote Agent service on my Exchange 5.5 server when running a mailbox backup. The problem was caused by different versions of Mapi32.dll. The issue was resolved by copying the Mapi32.dll file from my Exchange server to the Backup exec server. Prabhakar Rao (Last update 9/27/2003): I was running a Win2K server SP3 installed. My computer was consistently crashing when I tried to look at printer properties or when I tried to add a new printer. I resolved the problem by reapplying the Service Pack, in my case SP3. Dennis Balogh (Last update 9/27/2003): From a newsgroup post: "It appears that the Print Spooler has failed, and was unable to (or not configured to) restart itself. When the Print Spooler is not running, printers will not be visible in the Printers folder, and you will be unable to add any new printers. Any number of things could cause the Print Spooler to fail. These include corrupt print jobs, incompatible or problematic printer drivers or port monitors, file or disk corruption, and even other applications or processes interfering with the spooler in memory. If you attempt the restart the Print Spooler manually and it immediately fails, it may be trying to process a corrupt print job after starting. This is one common cause for Print Spooler failures that occur immediately. If the Print Spooler starts and printing functionality returns for some time before failing again, then a driver or port monitor is likely the cause of the problem. To remove spooled print jobs that could be causing this problem, simply remove (or delete) files with extensions of ".spl" or ".shd" from the Spool location while the Print Spooler is stopped. This location is generally "c:\<windows directory>\system32\spool\printers" (it could have been manually changed). Once any existing spool files have been removed, try restarting the Print Spooler again to see if it runs normally. If there are no spooled print jobs (.spl or .shd files), or if removing existing spooled print jobs does not change the behavior, then a driver or port monitor may be to blame. M260142 provides more in-depth information that will be helpful while troubleshooting further". Steve Vilk (Last update 9/27/2003): - Service: "Print Spooler" - It also happens when you have Microsoft Publisher XP running on terminal server, with Win2k Terminal server. You get Print spooler crashing and you can not restart it until you kill all Publisher sessions. Stephen Mann (Last update 9/27/2003): I found that a new site and ip address was added to one of the interface cards for Exchange. They were not in the Active Directory sites and services linking it to the main site. Exchange did not know which site it was supposed to belong to. Milind Rahate (Last update 9/27/2003): If you are running Win Xp and after you connect to the internet in 5 minutes you receive the system shutdown message, here is what you should do: Go to system services and applications, go to services, then select remote procedure call locator (RPC), right click, go to properties, go to logon, select logon as local system account and apply. Restart the machine. Then it doesn’t give any message for shut down when you connect to internet. NOTE: "This is most likely caused by MSBlaster worm. You should run an antivirus on your system, or see the Symantec Security Response on how to detect it and remove it". Martin Latteier (Last update 9/27/2003): Service: "Print Spooler" - Immediately after a system reboot the service terminated with error 7031. Deleting the content of the folder “%windir%\system32\spool\printers" solved the problem for me. It seems that some too big print jobs prevented the service to start correctly. Franco Fassio (Last update 9/10/2003): Service: ServeRAID Manager Agent - As per IBM tip H03520, this means that you have an IBM server and you are using ServeRAID software. This message does not indicate any failure in ServeRAID function or data. This event and message can be safely ignored. On Windows shutdown, all programs are given three seconds to close. Should the service still be resident in memory after three seconds, Event ID 7031 and the message described in the Symptom section will be generated. The message can not be disabled, nor can the three second limit be extended. It has been determined that this event is non-detrimental and is not related to any data I/O. This is only a "minor annoyance" problem. Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! Yuval Sinat (Last update 9/10/2003): Service: Print Spooler - There is a common problem that Microsoft kb and others forums couldnt find. Some third party products uninstall themselves (usually print/fax software) and then you may receive this error. The common "fix" is M820550. The solution is typically to restore Localspl.dll file from a backup. This suggestion should be used only if the Localspl.dll resides on your system. Yiannis Papadopoulos (Last update 6/30/2003): - Service: IISAdmin, IMAP4, NNTP, POP3, MSE Routing Engine, SMTP, WWW. Appeared after installing an SMTP event sink for MS Exchange 2000. Resolution: unregister the sink. If this fails unregister the DLL of the sink and restart Windows. See M313404 on how to register an SMTP event sink. Woodrow Wayne Collins (Last update 5/21/2003): - Service: "Backup Exec 8.x Job Engine" - From the Veritas Newsgroups: - "This event started occurring immediately after BRICK-LEVEL backups of the Exchange 2000 server (running on another server) were added to the backup selections. Prior to that change, only server-level backups were being performed without the error. Unfortunately, while the 7031 error is resolved, and the backups are again running, brick-level backups of the Exchange 2000 Server are still elusive." Peter Appel (Last update 5/15/2003): - Service: "Print Spooler" - I fixed this problem on a W2K station by reinstalling service pack 3. David Ross - Service: "Proxy Client" - I had received this error after updating DNS info on my proxy server and the Windows 2000 DC. I reinstalled the WSP client and this resolved the issue. Marco Zucchi - Services: IIS, Exchange. Exchange Databases are not mounted and event logs contain 7031 errors. See M304166. Ajay Kulshrestha Service: "Microsoft Exchange Information Store". - If Exchange 2000 Information Store does not start after you apply SP1 or SP2 or SP3 on a server that runs Symantec Norton AntiVirus see M312428. Ted Barrow Service: "Microsoft Firewall Service" - The Internet Security and Acceleration (ISA) Server Firewall service may not start if you add more than 85 IP addresses to the external network adapter. See M318005. Daniel Sund - Service: "Cluster Service". See Microsoft M296594. Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here! Nick Fuller - Service: "Print Spooler" In my case the solution was to update HPDCMON.dll to version 4.20. This was done in C:\WINNT\System32 and in C:\WINNT\System32\spool\drivers\w32x86. Chris - Services: IIS, WWW, SMTP, see Microsoft M316612. Possibly caused by Code Red Worm. Dennis Annfeldt - Service "CA ArcServe". We needed a license for the Windows NT/200 Client Agent. Joseph 'Radar' Mann I found this Article as it relates to Systems Management Server 2.0 - M283472. Greg Trzaska Service: "Print Spooler" - We have a Datamax XL Printer with a MPS 100 (Micro Printer Server) attached. The power cable to the MPS has been damaged and is loose. The event occurs when the power is knocked out and back in quickly. Mario Enrique Santoyo - Service: "DNS" - This problem may occur if a parenthesis appears in a hostname that is contained in the DNS zone file. Contact Microsoft Product Support Services to obtain the fix. See M813425. BM - Service: "RPC" - See M326964.
Links	M255759, M258073, M258469, M260142, M272129, M283472, M286350, M288247, M290637, M295091, M296594, M301364, M304166, M308600, M311517, M312428, M313404, M316612, M317482, M318005, M321531, M324183, M326964, M327148, M328876, M329817, M329819, M555166, M811280, M813425, M814924, M819865, M820550, M821749, M822949, M823980, M824467, M826820, M827214, M830639, M831276, M832250, M832459, M833777, M835437, M836177, M840856, M842000, M842839, M884874, M885264, M888191, M888196, M888206, M890642, M891005, M892208, M895200, M896712, M899301, M899472, M910618, M911106, M916254, M917848, M919515, M919789, M919790, M922440, M923838, M925038, M926676, M928807, M936161, M938615, M949874, Symantec Security Response, Symantec Knowledge Base Document ID: 2005060211491948, Symantec Knowledge Base Document ID: 2006120116344254, IBM tip H03520, McAfee Support Solution ID: NAI31469, Trend Micro Support Solution ID: 19462, Trend Micro Support Solution ID: 1031154, Network Associates Support Solution ID: NAI29545, Citrix Support Document ID: CTX104533, Veritas Support Document ID: 284155, Veritas Support Document ID: 270419, Veritas Support Document ID: 242153, Trend Micro Support Solution ID: 15065, Trend Micro Support Solution ID: 21441, Symantec Support Document ID:2004040209303954, Symantec Support Document ID:2004093011032448, McAfee Support Solution ID: nai21726, XLink Technical Support, BlackBerry Support Article Number: KB-02041, Howtonetworking case study, Captaris Support Answer ID 1277, Cisco Support Document ID: 44465, Cisco Support Document ID: 44466, GFI Support KBID002282, MSW2KDB, M961252, M961569
Search	Google Web - Microsoft Support - Bing - EventID.Net Queue - More links...
Feedback	Send comments - Notify me when updated
	Print version