Hello all, Recently a Windows 2008 server is displaying the following message when users (admins) try to log off from RDP sessions "please wait for the system Event Notification service" This issues occurs this morning, A user will go and log off and he will get "Please wait for the System Event Notification Service..." on his screen. Then it seems it starts to affect others during the course of a few hours. I try and manually log the user out from task manager and even tried to reset the connection from Remote DesktopServices Manager. Basically the only way to get everything working again is to reboot the system. Anyone have any ideas on this screen? and why it is freezing at this point?

Anyone? Really need help on this.... it is also affect our Citrix servers, when users are logging off, it is halting on this screen....

I am getting the same message. I dont know if any of the applications is using SENS. The server does not even take a soft boot. It has to be hard booted as it continues to display this message. Should I disable SENS? What are the ramifications of doing that?

Getting the same thing here. Win2008 R2 (64bit).

Hi Sainath,My customer is having the same problem on his Win SBS Std 2008...when we log off an RDP session he gets:"Please wait for the System Event Notification Service..."It just hangs there. He's running Exchange. It seems like the only option is to power off. Is that the only solution?Thanks,Kim

Hello,Getting this Same Error on a Brand new Windows 2008 SBS installation. However it is blocking log in currently. When I get onsite later today I will try and find any errors in the log and update this forum.Thanks,Brad

I am also experiencing the same issue as below: Please wait for the system Event Notification service message displays intermittently on a Remote Desktop client upon logging off. This message freezes the client's computer as well as prohibits any other users from logging into Server 2008 RDC. This following System Event occurs several hours prior to the "please wait for the system Event Notification service" message hanging the computer. The COM+ Event System detected a bad return code during its internal processing. HRESULT was 80070005 from line 147 of d:\longhorn\com\complus\src\events\tier2\security.cpp. Please contact Microsoft Product Support Services to report this error. The 2008 physical server will also hang at the please wait for the system Event Notification service message upon logging off. The only way to reset the system is a hard reboot. In the Terminal Services connection manager, all users, even those with disconnected sessions will still be displayed. It looks like an issue occurs when one of the users logs off. It has occurred 4 or 5 times since we started this. There is always a COM+ event notification a few hours before the total system locks.

Same issue here as well, Server 2008 x64. It has happened several times. Any word from Microsoft on this?

Well, we ended up finding a work around that eventually worked. It wasn't too great of a process. We used the services.msc to connect to the server and stop the System Event Notification Service (after it had been stuck for an hour or longer). It got stuck in the stop_pending (3) -- Stopping state. We then did a remote desktop session to it (same user that caused the "Waiting for the System Event Notification Service..." message), and it went to a black screen. On the actual server, the Waiting for the System Even Notification Service went away and let us log in as a different user. From there, we did a: sc queryex sens This allowed us to find the PID. Then, we did a taskkill /PID <PID#> /F and stopped it. Then we had to reboot the server completely, but at least it let us reboot. Hopefully Microsoft comes up with a fix for this issue.

Also having this annoying bug on 2008 R2 x64 with XenApp 6.0 final and also waiting for a solution, sigh, this thread is started 4 months ago, and still no solution ?

I am having this same issue too. The Please Wait identifiable if I RDC into the server, and the black screen. Windows 2008 R2 x64. Latest drivers all updated.

could it be Office Communicator Client related ? http://forums.citrix.com/thread.jspa?threadID=261933

Hi Guys, Same issue here. our diagnosis so far is: we had a Memory leak, caused by McAfee Virusscan 8.7, droppped this down to 8.5 and that has corrected it on all servers, apart from 1. we get COM+ errors in th logs in quite a few, but this seems to have no relevance on the SENS issue. we have 1 SBS2008 server now that seems to hang on reboot, (Reboot because the performance has dropped off, and we have users that cannot access files) hangs on the SENS warning when rebooted. have to hard reboot. we are only running exchange.

A non-responsive ISensLogon subscriber can cause a hang at logoff time. A 3-minute timeout has been added per-subscription for Win7/R2, but if there are multiple subscriptions, it wouldn't necessarily help. Persistent subscribers on the system can be found here: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions Can someone take a look and report what they are seeing? Thank you! (there are also transient subscribers which can be discovered by running a script - we'll try to post one soon)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions\{F98C5003-16F4-4E33-BCA4-E92F4742AD27}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000} Have put Image of Key and contents on our website here: http://www.af-it.com/wp-content/uploads/2010/03/Registry-Details-for-Technet-Forum.jpg

Hello, Two images of the key. I don't have the "Subscriptions" on a Windows 2008 standard, only on a Windows 2008 R2. The problem happens on both versions. Screenshot of both versions: http://www.coltdlln.be/Win2k8_DC.jpghttp://www.coltdlln.be/Win2k8R2_Exchange2010.jpg Hope this helps somebody... Thomas

Hello In my Case, it was the McAfee VSE 8.7 SP3 Virusscanner After Reinstall McAfee the problem was solved. Cheers MasterB

Hello, We are running TMG on a fresh Windows 2008 R2 installation. - Unfortunately no McAfee VSE where reinstallation would solve the problem. As I read in this postings, it happens to Windows 2008 R2 with Applications like: TMG, Exchange 2K10, OCS, McAfee ... Any new Ideas for this problem? Kind regards ChristophSysadmin

We are having the same Issue here, We are running 2 server with Windows 2008 R2 and Citrix Xenapp6 under a IBM Bladeserve r HS21 XM with BootFromSAN. We don't have any NIC Teaming actived and we have installed McAfee Virusscan 8.7 in one server, and no antivirus in the other to test it, and we are having the same issue in both of them. We are using MS Communicator 2007 R2, but we have applied the last hotfixes and patches in the server and client side: http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=515d6dba-4c6a-48bb-a06a-d99c5742676d It is happenig every morning wince we put the second XenApp6 server on our new farm. The symptoms are: One user get his session hang, so when we try to force close it we get the message "Waiting for system event notification service" and the user sessions never close. When it occurs other users CAN log in, but any user that try log off get this message. The users that have active sessions CAN work. The remote desktop and citrix management console show the user as Active, but it can close the session. If trying to restart the System Event Notification Service (SENS) the service get stuck on Stoping There is a link to a Citrix forum talking about the same problem: http://forums.citrix.com/thread.jspa?threadID=261933&tstart=0

Just hit the same error messaage. I had to use prcess monitor to kill the svchost.exe process running the event manager process and reboot the box.

Having this on a Windows 7 user logging in just today, this is in there with a huge wait 1 hour for Group Policy Printers processing to complete then a huge wait of so far more than 2 hours waiting for the SENS before able to complete logon. While the system is still displaying this message and seems to be stuck on it I am able to open the Event Viewer remotely from another computer with some stuff in the event log such as: The winlogon notification subscriber <GPClient> took 3593 second(s) to handle the notification event (Logon). (We get this randomly. A system will be fine then for no apparent reason it will take an exceptional length of time to process some part of the logon) The last three events in the Applications event log over a 2 hour period are the same: License Activation Scheduler (sppuinotify.dll) was not able to automatically activate. Error code: 0x8007232B Basically the timeframe for getting this computer up today is: Turned on at 12:47 pm. The system started up normally and was idled until 13:55 when a user logged on with Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege At 14:55 get an error as above, the winlogon notification subscriber took 3593 seconds. Then after that, more or less randomly through to 16:47 there are three events all the same as above, License Activation Scheduler (sppuinotify.dll) etc. In the System log looks more or less normal except for five errors from Service Control Manager all 14:55 - 14:57 A timeout (30000 milliseconds) was reached while waiting for a transaction response from the BITS service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the CertPropSvc service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Schedule service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SessionEnv service. A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wuauserv service. Can't see anything else in any other event log.

Some more digging and apparently this is SPP Notification Service Something to do with software activation / authentication This is a fully licensed activated installation of Windows that was activated with our MAK (I see the error sometimes come up on KMS servers, this computer is a desktop, it is not running KMS server)

Well after waiting for a long time till 18:01 I logged into the services remotely and tried to stop the SENS service. As it could not stop I reset the system. Note that all of the above was experienced on a Remote login rather than directly logging in at the computer (before resetting I went to the computer and it displays Press Ctrl Alt Delete to login but the remote window is still displaying Please wait for the SENS etc. The next try is a direct login, at this point we are told the system is not activated. Activation was carried out successful but there was never any indiciation with remote logging in there was an activation problem. Pretty sure all the other systems eventing random login delays and please wait for blah blah blah are fully activated.

Hi Guys, havent posted for a while on this, so the issues you are having may be slightly different to mine, or things may have changed. We have found the answer to the issue we are having: our issue was - Server hangs, as if it were a memory leak. SENS etc. Server stops working. hit the button etc. Cause (Confirmed)- McAfee Viruscan, 8.5 or 8.7 at any patch level, causes the issues discussed here, when there are clients accessing the machine, and you change the USB drive used for backup. There is no option but to reboot the machine, and then the process starts all over again. Fix, there isnt one, we have, and are still, discussing this with McAfee, aparently, its virtually all the Antivirus products that are having this issue, there is no fix as of yet, but we are running several test machines and working with them to find one. Recommendations - (bad i know, but never the less, needs to be done) Run the server without antivirus software for the time being. This is not ideal, but due to this issue we have had t do full restores on 2 customers systems, as they have become damaged during the hard reboot process. as soon as we get the fix delivered, i will post it up here.

i was very surprised that during the year Microsoft do not propose any solution or fix.... As i understand hanging process is using SENS service and do not give possibility to others to log off..

I'm have the same problem, and found a cause, if not the reason: MS Messenger. Every time a Remote Desktop session log-off hangs with "please wait for the system Event Notification service", some user´s Messenger is "eating" an unusual amount of processor time. I just kill the Messenger task and immediately every hung sessions closes. I have Windows 2008 R2, but my ant-ivirus is Kaspersky, not McAffe.

I just ran into this today on one of our customer managed Windows 2008 Servers. Unwilling to accept "Do steps 1-10 and then restart server" as an answer, I poked around a bit and was able to work-around the issue. First, to confirm for others, how this issue presented itself. Upon logout of an RDP session, logout hung at "Please wait for the System Event Notification Service...". I was able to establish additional RDP sessions, but each session was faced with the same result. Eventually I logged on to the /admin (previously /console) session with an alternate Administrator account. Using Server Manager or services.msc I located the "System Event Notification Service" and told it to restart. The restart failed on "stopping", having never stopped, it couldn't restart. Running "Task Manager" I selected the "Services" tab and located "SENS". Performing a right-click on the SENS service, I selected the "Go to process" option. This changed to the "Processes" tab and automatically highlighted the "svchost.exe" process which was running the SENS service. I again right-clicked this process and selected the "End process" option. It took close to a minute, but eventually the process ended and the "System Event Notification Service" changed from "stopping" to "stopped" in Windows Services. At this point, I reviewed the "Users" tab in Task Manager and noticed that my previously stuck Terminal Sessions had finally reset. Back in the services control, I started "System Event Notification Service", which started without issue. Now, this has only seemed to be a work-around, as upon my next RDP logout, the "Please wait fro the System Event Notifications Service..." message returned, however, if you have gotten all of your Terminal sessions stuck, this should help to clear them out. ~Ninet4

don't have live essentials or any messenger software, but i do have the symptoms. The 4627 event pointed to explorer.exe. I do have mcAfee 8.7 and Progress OpenEdge 10.2B.. I don't know what it all has in common with the new live messenger. Anyone?

BUMP!!! still having this annoying problem (@*#)(!* seems like Lync 2010 (RTM) communicator.exe (which I cannot kill) is causing the problem, tried everything, but when I kill svchost.exe (which the SENS service pointed to), it kills a lot of services and my session gives me a blank screen (the one telling me "please wait for the event notification service" before). SIGH

I am having the same problem. Other uses are able to login fine, it just my TS session is stuck at "please wait for the system event notification service" message. Any word from Microsoft on this thread?

I started seeing the same issues with several of my 2K8 R2 64-bit servers. Found this link on a citrix forum. http://support.microsoft.com/kb/2383928 After I did the install all of the RDP sessions are logging out correctly. Hope this helps.

We have the exact same symptoms on an SBS 2008 box. Can anyone else confirm the same? The 2383928 hotfix won't install saying "the update does not apply to your system". Have been on the phone to Microsoft to see if the hotfix is avail for SBS 2008 but was given the run around and left on hold for too long. Will have another attempt later. Daz

Anyone found a fix for WIndows 2008 (not R2) x64? The hotfix suggested above is for R2...? Ced418

Same issue on Server 2008 SP2, anyone know of a fix?

The same issue with SBS 2008 :( It looks like the problem is not solved for the server 2008 and SBS2008?

Sames issues on SBS 2008. Only way I can get the server to restart is to do a taskkill for the PID of sens.

Any news on this anyone ? Getting this on a new SBS2008 install and also getting it on a 2008 DC installed about 18 months ago One RDP account sems to be stuck logging onto the SBS2008. And another administrative account is stuck seemingly logging off waiting for SENS.. Anyone know of a fix from Microsoft yet ?

I have a very basic appearance of this issue as follows: Dell R300 with latest bios and other. 2k8R2 with all updates No Anti-Virus software, no office software, no SBS etc (hotfix above would not apply) AutoAdminLogon of console user (administrator) First RDP conection and shadow console works just fine. After closing shadow session, when I try to reopen shadow session, get black screen and system freezes locally. Remotely can do stuf on RDP session and can kill shadow.exe but can't touch any processes in console user session. I've been doing this with W2k8 (non-R2, 32-bit) for years with no issues and I'm really NOT happy that this issue is still not addressed! ANY help would be appreciated! Ed

All, I found and use the steps in this link I found: http://mikefrobbins.com/2010/11/04/please-wait-for-the-system-event-notification-service/ I don't ever see what he has in step 2. I just use steps 3 - 8. I usually put the server in Drain Mode. Then wait till all users log off and reboot the server. I have been unable to determine the root cause.

We've had the same issue and have found a different way to resolve the issue which does not require a server reboot. Start Remote Desktop Services Manager Identify the user ID in the Users tab In the Processes tab sort by ID Go down to the user ID and end the winlogon.exe process the user session will be logged off A server reboot will probably be beneficial at the end of the day

This issue will occour in my environment on a random server every few months. I perform the same steps to get the users off by killing their winlogon.exe process and reboot the server at nite. After reboot the server will be fine for a few months and a different server will get the dreaded "please wait for system event notification service" msg. I'm currently running windows 2008 x86 with Xenapp 5.0. I've installed all proposed service packs and hotfixes recommended from Citrix and Microsoft. From my stand point this is a Microsoft bug as I can repoduce this error when I RDP in a server. GEEEZ MICROSOFT thanks for the headache !

I wanted to follow up with what I've found to be a more stable workaround than killing the svchost process tied to SENS. We use Symantec Endpoint Protection and Altiris (Notification Server). Both of those agents use the SENS service to send alerts back to their respective management consoles. I noticed every 3 or 4 days our 2008 boxes would stop polling to the Altiris console and the agent on the box would not respond (but the process was still running). When this happens, it was a sure bet the next RDP session would get the SENS error on logoff. When I tried to kill anything associated with SENS or Altiris, I would get an access denied message. What I believe was happening was A. The Altiris agent somehow kludged up the SENS service. B. The Endpoint Protection agent was preventing me from ending the Altiris process. C. I never got a notification that SEP was blocking my taskkill attempts because it was using the SENS service to send those events. Now all I have to do, if I notice the box has stopped responding to the Altiris console, is disable the SEP agent and kill the Altiris agent process. The agent will restart itself and resume polling. At this point I don't get the SENS message at logoff, and it continues to work for another 3 or 4 days. It also allows the server to shutdown or restart. This beats having to hard reboot, or find the svchost of the SENS service and kill it EVERY TIME a user locks their RDP session. This may not help anyone other than those using both SEP and Altiris, but maybe someone more experienced than I can use this to figure out the real problem :D

Thanks You!!! Its really helped me..

I'm having the same issue Orgswami mentioned, hope for a solution. A periodic boot it not a suitable option!

I was able to force the server past the "please wait for the system Event Notification service" message by logging into the server on the same username through an iLO2 console. After reading this thread I noticed someone saying removing Windows Live fixed the problem. While I didn't have Live installed, I did have Lync Client installed. Upon removing this program I have not had the error since.

I noticed this problem with my RDS servers. I have folder redirection enabled and those redirected folders are going to folders with windows compression enabled. I disabled the compression for the profile and things have been pretty stable. When the user logged in, I noticed in the file server a whole bunch of files open for the user trying to log in which were basically stuck. I closes all of those files from the file server and disabled the compression on the folder that holds the redirected files and that did it for me. I know that this error can mean a lot of things, but in this case, this solution worked for me. -Ron

This issue for me seemed to be related ISCSI target using domain authenication and CSV. After removing the CSV from the cluster and testing the volume was indeed intact. Added the CSV back and Hyper-V and Failover Clustering starting behaving correctly. And lastly the system event notification service event hang went away. Haven't gone through the logs yet but just FYI for any Hyper-V ISCSI Failover Clusters seeing similar results.

Just to add my experience, I have been having backup issues so to get a copy of the data we connected a USB HDD to a Windows 2008 server. Once the driver had loaded I would see the server begin to struggle. The sessions would not log out due to the Event Notification service and after reboots the server would spend a long time applying group policy Removed the USB drive (via disabling the USB ports as the server is remote) and the server is good again.

@RJ-45: Thanks, this appears to have done the trick in our case. XenApp 5 on Windows 2008 SP2, users couldn't log off and killing sessions would not work. Two instances of communicator.exe existed on the system (both happened to be for disconnected users). Once gone, the stuck sessions cleared themselves.