I have a Windows 2008 SP2 (not R2) server which has the terminal service role installed. Twice now this month, the server has kicked users off late at night, and services start failing (logged as event 7011- A timeout (30000 milliseconds) was reached while waiting for a transaction response from the xxx service.). The last time this happened, it started with event 1074. What's odd is the user who initiated the shutdown and the process which shut it down. Only, the server didn't shut down - it was hung with 7011 events all through the night until someone was able to respond to the situation. Here is the 1074 event. The process LogonUI.exe has initiated the shutdown of computer SEA-TS on behalf of user NT AUTHORITY\SYSTEM for the following reason: Other (Planned) Reason Code: 0x85000000 Shutdown Type: shutdown Comment: s How do I begin to try to figure out what is going on here? I have since performed a restart of the server and the restart happened without issue.

Hello, I have a Windows 2008 SP2 (not R2) server which has the terminal service role installed. Twice now this month, the server has kicked users off late at night, and services start failing (logged as event 7011- A timeout (30000 milliseconds) was reached while waiting for a transaction response from the xxx service.). You can increase the timeout value: http://smallvoid.com/article/winnt-service-timeout.html For the shutdown issue, check that there is no scheduled task that runs a shutdown script and that there is no application that initiated that. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

I don't see any scheduled tasks set to shutdown or restart the server. I don't see that a service is set to restart the server as a recovery action. Increasing the timeout on services sounds like it would just increase the timeout - not prevent whatever is happening from happening.

Hi, As I can see that there are someone manually shutdown the server, because there was a comment "s" for the shutdown reason. Please check out whether there was someone run a script and shutdown the server. In addition, please scan the server using antivirus programs. Best Regards, Yan LiYan Li TechNet Community Support

So you have users who have access to shutdown the server,you might want to start by correcting that...Regards zizebra http://auction.joyoustimes.net

I can assure you, my end users do not have access to do a shutdown. With a normal shutdown, it shows domain\user for the user who initiated the shutdown. This was performed by NT Authority\System. I don't have any scripts set to run. This server did it again over night. So that's 3 times in the last two weeks. Only once did it give me a event 1074, shutdown event, so I think it's safe to say I can't focus on that. What I can see, each time, event 7011 starts. The first is always "NlaSvc". "A timeout (30000 milliseconds) was reached while waiting for a transaction response from NlaSvc service." After NlaSvc, this event is logged several times with other services: CryptSvc, Schedule, seclogon, ShellHWDetection, Symantec AntiVirus, wuauserv, BITS, CertPropSvc, EapHost, RasMan, UmRdpService, UxSms, AudioEndpointBuilder, dot3svc, Netman. It then repeats these events numerous times until someone responds to the situation and power cycles the server. When an end user tries to RDP to the server, they just get a "Welcome" screen and it never loads the desktop. The first time this happend, it was shortly after 10 PM, the second was shortly after 1 AM and this time, it was after 6 AM. This randomness would also dismiss a scheduled task. Running an AV scan right now. It does do a weekly scan, but am running a full now. The only real issue I see with the server is the fact that it's a 32 bit server and memory gets spread thin. As soon as our core app is supported on 64 bit, I plan on building a replacement terminal server. I don't want to have to rebuild this server with 32 bit right now! Still, this isn't happening during peak usage.

I started searching for event id 7011 and NlaSvc, and am finding a lot of people describing the same symptoms. In each case, the solution is unique. Some say it's a hotfix that fixes it, others say it's a combination of hotfix and removal of Symantec Endpoint Protection. Most of the hits are on Citrix forums, but they are Windows issues by nature. Seems this can happen to both Server 2008 and 2008 R2, though the fixes are different for both OS's. Trouble with the MS "hotfixes" is the file versions in the hotfixes are mostly older than what's currently on the server. http://support.microsoft.com/kb/976674 http://support.microsoft.com/kb/980380 http://option9.blogspot.com/2010/01/windows-server-2008-freezes-finally.html http://community.spiceworks.com/topic/76115-termdd-56-flood-of-service-timeouts-7011-brings-down-terminal-server-win2k

It happened again this morning. After the server came back up, I applied two hotfixes. I'm hopeful that either one of these will correct this situation. http://support.microsoft.com/kb/976674 http://support.microsoft.com/kb/980568