Perfmon/Remote Registry Service Problem
I'm having a problem remotely monitoring one of my servers with perfmon. The server is a 2008 R2 Enterprise x64 and every time I try to connect to it using perfmon on my 2003 R2 SP2 x64 server, perfmon shows an error saying "Unable to connect to the machine", the Remote Registry service crashes on the 2008 system and in the system event log on the 2008 system there is this error: Log Name: System Source: Service Control Manager Date: 2/3/2011 4:12:33 PM Event ID: 7034 Task Category: None Level: Error Keywords: Classic User: N/A Computer: DBSERVER.domain.com Description: The Remote Registry service terminated unexpectedly. It has done this 5 time(s). Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" /> <EventID Qualifiers="49152">7034</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x8080000000000000</Keywords> <TimeCreated SystemTime="2011-02-03T21:12:33.165070200Z" /> <EventRecordID>9865</EventRecordID> <Correlation /> <Execution ProcessID="656" ThreadID="5272" /> <Channel>System</Channel> <Computer>DBSERVER.domain.com</Computer> <Security /> </System> <EventData> <Data Name="param1">Remote Registry</Data> <Data Name="param2">5</Data> </EventData> </Event>
February 3rd, 2011 4:13pm

Hi, To resolve this issue, change the recovery actions that the Service Control Manager (SCM) will take when a service fails. To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority. To change the recovery actions for a service: Open the Services snap-in by clicking the Start button, Control Panel, and Administrative Tools, then double-clicking Services. Note: For Windows Vista, use the Classic View display option in Control Panel to see the Administration Tools. In the details pane of the Services snap-in, right-click on the name of the service you want to stop and select Properties. Click the Recovery tab and specify the recovery actions for the service (for example, restart the service or the computer, take no action, or run a program). For more information, please refer to the following Microsoft TechNet article: Event ID 7034 — Service Stop Operations http://technet.microsoft.com/en-us/library/dd349369(WS.10).aspx Regards, Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2011 3:18am

All thats going to do is restart the service after it crashes though. I need to fix whatever is making it crash in the first place because it prevents perfmon from connecting to the machine.
February 4th, 2011 9:55am

Bump
Free Windows Admin Tool Kit Click here and download it now
February 7th, 2011 10:00am

What other errors are in system event log? Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]
February 7th, 2011 10:20am

There are no other errors in the system log related to to this. The only other errors are the server complaining about printer drivers from people RDP-ing in. Is there any way to turn on some advanced logging that would give me more insight?
Free Windows Admin Tool Kit Click here and download it now
February 7th, 2011 3:39pm

Do the errors stop if you stop the perfmon? Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]
February 7th, 2011 3:53pm

Well the error only occurs one time - as soon as I try to connect to that server using perfmon. Perfmon never connects and never gathers any data because I'm assuming it uses the Remote Registry service to monitor. Since that service crashes the second perfmon tries to connect, nothing ever happens. I have no problem starting that service back up and it never crashes again unless i try to connect with perfmon again from another box.
Free Windows Admin Tool Kit Click here and download it now
February 7th, 2011 4:50pm

Does it crash for other remote mmc connections? Does RRS logon as Local Service? You might try adding the user that runs perfmon to local admin group on target server as a test. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]
February 7th, 2011 7:02pm

Dave, The service does not crash when I use MMC to remotely do Computer Management or Services. RRS is set to use "Local Service" as a logon. The account I'm trying to use to do perfmon is a domain admin account and so already has local admin rights. Thanks
Free Windows Admin Tool Kit Click here and download it now
February 9th, 2011 9:46am

Does Performance Logs and Alerts service on 2003 server start with account that has local admin rights on 2008? (you might have just answered but just making sure the bases are covered) Also not sure if required but does same user have logon as service rights on 2008? Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]
February 9th, 2011 11:00pm

I tried starting performance logs and alerts service on the 2003 perfmon server and it gave me the familiar, "The Performance Logs and Alerts service on Local Computer started and then stopped. Some services stop..." yada yada Right now we have a couple service accounts and NETWORK SERVICE having logon as a service rights. I don't think this is required, however, because we have other servers that we can monitor remotely without problems and they have the same logon as service rights. Thanks
Free Windows Admin Tool Kit Click here and download it now
February 10th, 2011 2:56pm

I'd try setting the service to start with an account that has local admin rights on 2008. I was just doing some perfmon from XP to some 03 R2 and non R2 servers. On XP the Performance Logs and Alerts service starts with Network Service account and a no-go on all 8 of them until I changed the service to start with my domain account. Log Is Not Started When You Try to Start a Log with Remote Counters in System Monitor http://support.microsoft.com/kb/240389 Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]
February 10th, 2011 10:54pm

Dave - That actually worked for some strange reason. When I changed the Remote Registry service to log on with my domain admin rights, i was able to remotely monitor it with perfmon. I can't leave it this way, so the question is why does it do that? I have other servers running the same specs, same OS and getting the same group policy that do not behave this way.
Free Windows Admin Tool Kit Click here and download it now
February 11th, 2011 10:13am

I think we got our wires crossed. You should be able to put the Remote Registry service logon credentials back to Local Service on 2008 and set Performance Logs and Alerts service on 2003 to an account that has local admin rights on 2008. Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]
February 11th, 2011 11:14pm

Dave, That didn't work - also, in case I hadn't mentioned it, the server 2003 system is running Performance Logs and Alerts as Network Service and it is able to connect to other Server 2008 R2 systems with no problems. So far the only thing that has worked is changing the Remote Registry service on the 2008 R2 box to a domain admin account. There is some screwy permissions thing going on here. Thanks
Free Windows Admin Tool Kit Click here and download it now
February 16th, 2011 9:49am

I agree something is amiss. Maybe the tools here will turn up the difference. http://technet.microsoft.com/en-us/library/dd996675(WS.10).aspx Regards, Dave Patrick .... Microsoft Certified Professional Microsoft MVP [Windows]
February 16th, 2011 11:26pm

I am having this problem as well on several of my servers and it started around the time that the first post was made. Was there a recent windows update that broke something?
Free Windows Admin Tool Kit Click here and download it now
March 4th, 2011 9:41am

I have a similar problem. I'm running a third-party performance monitoring tool called PerfMan on Windows Server 2008 SP1 (x64), and when it attempts to collect performance data from several servers running Windows Server 2008 SP2 (x64), the Remote Registry service terminates unexpectedly on the SP2 server. This problem has been on and off since we installed a round of Microsoft updates in March. I don't know if I should consider contacting Microsoft to find out why Remote Registry crashes or contact the PerfMan vendor to see if they can offer support. It seems to me that the Remote Registry service has a flaw.
December 9th, 2011 2:49pm

Try this: Performance Logs and Alerts service terminated with service-specific error 2003 http://winplat.net/post/2011/09/19/Performance-Logs-and-Alerts-service-terminated-with-service-specific-error-2003.aspx
Free Windows Admin Tool Kit Click here and download it now
December 10th, 2011 4:12pm

The problem is not with the Performance Logs and Alerts service crashing. It is the Remote Registry service on the target system that crashes. I actually have four target systems that are experiencing Remote Registry service issues. All four are running Windows Server 2008 x64 SP2. The system from which I am attempting to monitor them is running Windows Server 2008 x64 SP1, and runs a third-party performance counter collector utility called PerfMan. Two of the target systems have had the Remote Registry service crash when the attempt is made to connect and collect performance data. On the other two, the Remote Registry service has lost its mind and decided to use 100% of the system CPU. We collect performance data on hundreds of servers, and only these four have the issue. Besides running 2008 SP2, one thing they also all have in common is that they all run Microsoft Search Server 2010.
February 29th, 2012 2:46pm

I have a client experiencing a similar issue, and this KB (http://support.microsoft.com/kb/2159286) appears to identify a known issue with the same scenario: Windows 2003 Server connecting remotely to Server 2008 for monitoring of performance counters causes Remote Registry service on target machine to crash.
Free Windows Admin Tool Kit Click here and download it now
July 17th, 2012 1:34pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics