Hi thereYesterday our file server experienced what I believe is called an 'event storm'.The following event started to appear in the system log:--------------------------------------------------------------------------------------Event ID: 2000Source: SrvDescription: The server's call to a system service failed unexpectedlyData: 0000: 00040000 00540001 00000000 c00007d00010: 00000000 c000010a 00000000 000000000020: 00000000 00000000 00bd0334--------------------------------------------------------------------------------------This event appears continually in the system log from mid-afternoon until the server was rebooted at 10pm.I have googled this, and haven't come up with anything firm yet. There is a Microsoft Kb article about the error http://support.microsoft.com/kb/288301/en-us but the cause listed in the article is an app (VERITAS Storage Replicator)which is not installed on our file server, so I have had to discount that. We do have Veritas Backup Exec 10.0, but the file listed in the Kb article isn't present on the server.Interestingly, this event storm appears to have over-loaded the local SCE service, which was gobbling up most of the CPU, no doubt by struggling to keep up with the alerts, which were running up to fifty times per second at times. The SCE service was disabled when the server came back up, though I am fairly certain the SCE service did not cause the fault, but was instead affected by it.There is a DAS attached to the server, a Dell PV220, which is reporting no errors.I know other people have experienced this issue, but I cannot find a definitive cause. If anyone has gotten to the bottom of this faukt, I'd be grateful to know the answer.Thanks in advanceJHH

Hi John, In order to narrow down the cause of the issue more efficiently, please us refer the following steps to reboot the computer with Clean Boot and restart the computer to perform the test on the problematic computer. Step: reboot with clean boot mode 1. Click "Start", go to "Run", and type "msconfig" in the open box to start the System Configuration Utility. 2. Click the "Services" tab, check the "Hide All Microsoft Services" box and click Disable All (if it is not gray). 3. Click the "Startup" tab, click "Disable All" and click "OK". 4. Restart your computer. When the "System Configuration Utility" window appears, please check the box and click "OK". 5. Please check if the explorer.exe can be loaded normally in this mode. As the problematic server is a Windows Server 2003 SP2, please disable TCP Chimney on the box HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Set EnableTCPChimney value to 0 Meanwhile, please also check the following KB article is helpful for you. Performance may decrease on a server that is running the 64-bit edition of Windows Server 2003 and that has Symantec Notification Server 6.0 installed http://support.microsoft.com/default.aspx/kb/951031 Hope it helps.David Shen - MSFT

Thank you for replying David, I appreciate it.Unfortunately, I cannot follow your advice, as after the server was rebootedon the day the event storm ocurred, the error went away and has not as yet returned (thankfully). What I was hoping to do is find a way of analyzing that particular event id to discover what the root cause was.Are there any tools available for download from MS which I can use to trace the root cause?ThanksJHH

Thank you again for replying DavidI hope very much to hear from the corresponding team you mentioned.I have visited the eventid.net website, alas though it explains the event, it does not explain the cause nor provide a way to diagnose the cause.Again, thanks for your support.JHH

Hi DavidYou mentioned previously that you would 'forward my request to the corresponding team'. Did you get a response? Cheers for now JHH

I'm having exactly same problem. Please help us. Thanks !MCSA 2000+2003 | MCSE 2000+2003

add me to your list of solution seekers. happened a few times. in the past 3 months. no help on ms website

Hi all,Please see whether the following solution will be helpful.http://support.microsoft.com/kb/136150Thanks and regards,ScorprioMCTS: Windows Vista | Exchange Server 2007 MCITP: Enterpise Support Technician | Server & Enterprise Admin

nope, does not apply as mine does not match exactly. here is my event properties 0000: 00040000 00540001 00000000 c00007d0 0010: 00000000 c000010a 00000000 00000000 0020: 00000000 00000000 00bd0334 thx for your response

Any luck with this? Seeing the same exact error.

Sigh - add me to the me too list. This time I'm getting the following - 0000: 00040000 00580001 00000000 c00007d0 0010: 00000000 c000010a 00000000 00000000 0020: 00000000 00000000 00bd0334 Windows 2003sp2, 64bit. Currently unable to logmein to the server or rdp. Rdp gives me a login prompt as usual and then just sits at a grey screen. logmein does something similar but it's the blue logmein screen. I'm getting hundreds of these in 1 second according to the event log.

Hi, we are getting the same error with same event ID properties. Server is getting very slow. Please help!!!

Hi, we are getting the same error with same event ID properties. Server is getting very slow. Please help!!! Hi, I am faced the same error. Please help & alert me....

I have recently encountered this issue with the following error code:0000: 00040000 00580001 00000000 c00007d00010: 00000000 c000009a 00000000 000000000020: 00000000 00000000 05950339 I noticed that on the Application Log, Symantec update ran at the same time when I got the error. I have W2K3 R2 x64 SP2 environment.I've been able to search to come up with this MS KB: http://support.microsoft.com/kb/951031 which states "This problem occurs because of a handle leak in the Altiris Client Agent Service (AeXNSAgent)." and that Symantec should be notified. I don't have AeXNSAgent installed.

And we have also exactly the same problem since yesterday. We did this (before the things we did we had no error): remove exchange 2003 demoted the dc to member The we got the error: Eventid: 2000 Source SRV The server's call to a system service failed unexpectedly. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. 0000: 00040000 00540001 00000000 c00007d0 0010: 00000000 c000010a 00000000 00000000 0020: 00000000 00000000 00bd0334 --- Today I did the following: - remove IIS - remove DHCP - remove DNS ---- Rebooted and the error was away for 3 hours orso. Now it came back so I rebooted again... But I am afraid it will come back!? I see lots of people have this problem. So please o please help me!

Just experience this issue as well, last Friday (10/30). We ended up powering off the server to get it to reboot, and then noticed several shares had disappeared (fun Monday putting those back into place). We are connected to a Dell Equallogic iSCSI SAN.-Brian

Same here as well:0000: 00040000 00540001 00000000 c00007d00010: 00000000 c000010a 00000000 000000000020: 00000000 00000000 00bd0334I can't reboot right now as we have hundreds of user's connected to mapped drives and also running applications, but I can't log in via RDP as I get a blank screen; and we have the usual event storm so I can't see what happened.Has ANYONE managed to find another way round this other than just rebooting?ThanksJacqui

Same here, we have the same problem on 7 Windows 2003 R2 SP2 x86 servers (running on VMware ESX 3.5 update 4) The server's call to a system service failed unexpectedly. 0000: 00040000 00540001 00000000 c00007d0 0010: 00000000 c000010a 00000000 00000000 0020: 00000000 00000000 00bd0334 thanks, Donald

One more me too....have rebooted several times and it goes away for a day or two. Any solutions?!? I will be contacting MS hope they have an answer. -Randy

Please let us know if you have any update from MS. I have the same issue on a Win2k3 Ent SP2 Server for the last one week. Server performance and health is fine till now but thousands of error being reported in system logs. 0000: 00040000 00540001 00000000 c00007d0 0010: 00000000 c000010a 00000000 00000000 0020: 00000000 00000000 00bd0334

I have the same issue on a Win2k3 Std. SP2. Any solutions for this error? Please send it tom my e-mail. -Addy

I just started getting this error today. Event viewer is just full of errors. 0000: 00040000 00540001 00000000 c00007d0 0010: 00000000 c000010a 00000000 00000000 0020: 00000000 00000000 00bd0334 Anyone figure this problem out yet?

I recently had this on a Server STD 2003-sp2 box Event Type: Error Event Source: Srv Event Category: None Event ID: 2000 Date: 1/25/2011 Time: 8:53:55 AM User: N/A Computer: Description: The server's call to a system service failed unexpectedly. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00040000 00540001 00000000 c00007d0 0010: 00000000 c000010a 00000000 00000000 0020: 00000000 00000000 00bd0334 Resolution for me on this box for this situation was to uninstall "Unlocker" This was installed a while ago and got triggered when an admin was trying to manually delete a user profile - userClass.dat was locked by Srv and Unlocker tried to unlock the hook which failed, then tried to kill the proc which failed and started spamming eventlog.

Just ran into the same error with the same error codes and I don't see Unlocker as an installed program, has there been any progress on this issue?

Posible solution - I started having the exact same issue yesterday. Any time I would reboot the server everything would seem to be ok, but after 20 or 30 minutes (with more and more users accessing the server) I would get the srv 2000 errors in the event log and everything would slow to a crawl on the network and server. It would never stay up for more than 30 minutes while users were accessing it. Overnight, the server opperated fine with no errors, but as soon as the employees would get in, it would lock up by 8:15am. I ended up replacing the NIC in the server and so far have had no issues. It's only been a couple of hours, but I'll report back later for an update.

Have you solve this issue by replacing the NIC?

Dsreyes,i have met the same question with you,but how do you solve it?

I got same problem too, I replace the NIC, but few minutes later the error back again.

All, You may wanna try this option increase the IRPstacksize value to 15 and Add the registry entry for Poolusage maximum and Pagedpool size. This worked for us on many servers with similar symptoms.. ..

As stated in the thread, Unlocker was my issue. Our off site backup software from time to time grabs hold of the file shares and does not release (users complain they can open files read only). Unlocker does unlock the off site backup software, but in the instance today, brought the server to it's knees. I needed to crash the server and brought it backup with no issues (with waiting eyes). Unlocker has since been removed...

As stated in the thread, Unlocker was my issue. Our off site backup software from time to time grabs hold of the file shares and does not release (users complain they can open files read only). Unlocker does unlock the off site backup software, but in the instance today, brought the server to it's knees. I needed to crash the server and brought it backup with no issues (with waiting eyes). Unlocker has since been removed... I have possibly caused a similar problem today on my Win2k3 server Had a PST file a user was reporting issues with (locked) as well as the PST.TMP file, so I unlocked them - 3 or 4 hours later, big trouble. Event Type: Error Event Source: Srv Event Category: None Event ID: 2000 Date: 20/06/2012 Time: 10:45:10 PM User: N/A Computer: SERVER Description: The server's call to a system service failed unexpectedly. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00 00 04 00 01 00 54 00 ......T. 0008: 00 00 00 00 d0 07 00 c0 ...... 0010: 00 00 00 00 0a 01 00 c0 ....... 0018: 00 00 00 00 00 00 00 00 ........ 0020: 00 00 00 00 00 00 00 00 ........ 0028: 34 03 bd 00 4.. Thousands of entries, hundreds per second - totally cleared out the event log. I actually use Acronis to do my backups and it failed with the following error. Event Type: Error Event Source: Acronis True Image Enterprise Server Event Category: (7) Event ID: 33 Date: 20/06/2012 Time: 6:30:12 PM User: N/A Computer: SERVER Description: The description for Event ID ( 33 ) in Source ( Acronis True Image Enterprise Server ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Cannot access drive. Cannot create the image of the logical drive C: because it is currently in use by running applications or the logical drive contains bad sectors.: None. I thought I had a faulty disk but it actually seems possible that's not the case now.