Microsoft KB Archive/910666

= The Svchost.exe process may end unexpectedly on a Windows Server 2003-based computer =

Article ID: 910666

Article Last Modified on 9/18/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows 2000 Server

-





SYMPTOMS
You may experience one or more of the following symptoms on a Microsoft Windows Server 2003-based server:  Many applications and services do not work correctly because the Svchost.exe process ends unexpectedly. Errors that are similar to the following are logged in the Application event log:

Event Type: Error

Event Source: Application Error

Event Category: (100)

Event ID: 1000

Event Type: Information

Event Source: Application Error

Event Category: (100)

Event ID: 1004

Description:

Faulting application svchost.exe, version 5.2.3790.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x0000694e.

Data Words:

0000: 41 70 70 6c 69 63 61 74 Applicat

0008: 69 6f 6e 20 46 61 69 6c ion Fail

0010: 75 72 65 20 20 73 76 63 ure svc

0018: 68 6f 73 74 2e 65 78 65 host.exe

0020: 20 35 2e 32 2e 33 37 39 5.2.379

0028: 30 2e 30 20 69 6e 20 6e 0.0 in n

0030: 74 64 6c 6c 2e 64 6c 6c tdll.dll

0038: 20 35 2e 32 2e 33 37 39 5.2.379

0040: 30 2e 30 20 61 74 20 6f 0.0 at o

0048: 66 66 73 65 74 20 30 30 ffset 00

0050: 30 30 36 39 34 65 00694e

Note The memory addresses vary, and other applications may be affected. The following error message is logged in the System event log:

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7023

Description:

The Server service terminated with the following error:

Access is denied.

Note A text-based version of the System event log contains the following error message:

The Server service terminated with the following error: %%5

 The Server service stops and does not restart. The following error message is logged in the System event log:

Event Type: Information

Event Source: Service Control Manager

Event Category: None

Event ID: 7036

Description:

The Server service entered the stopped state.

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7023

Description:

The Server service terminated with the following error:

The server is in use and cannot be unloaded.

Note A text-based version of the System event log contains the following error message:

The Server service terminated with the following error: %%1811

Error 1811 maps to the &quot;ERROR_SERVER_HAS_OPEN_HANDLES&quot; error. The server is in use and cannot be unloaded.

Additionally, the Windows Management Instrumentation (WMI) service stops, and the Server service ends unexpectedly. The following error message is logged in the System event log:

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7032

Description:

The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error:

An instance of the service is already running.

 On a Windows cluster node, the cluster file server resources cannot come online. Additionally, the server may log the following error message in the System event log:

Event Type: Error

Event Source: ClusSvc

Event ID: 1068

Description:

Cluster file share resources < > failed to start with error 2114

Event Type: Error

Event Source: ClusSvc

Event ID: 1055

Description:

Cluster File Share resource < > has failed a status check.

The error code is 2114.

 The Srvinfo.exe tool does not work correctly. (This tool is included in the Windows Server 2003 Resource Kit.) When you manually try to start the Server service by using the Computer Management snap-in or by typing net start server at the command prompt, you may receive the following error message:

Could not start the Server service on Local Computer.

Error 5: Access is denied.

Notes  This behavior occurs even though the user account is a member of the local Administrators group and the Server service is configured to start by using local system credentials.</li> Typically, a restart of the computer temporarily fixes the issue.</li></ul> </li></ul>

<div class="cause_section">

CAUSE
This problem may occur if the computer experiences a low-memory condition. When the computer experiences a low-memory condition, memory corruption may occur in the private heap of a dynamic link library (.dll) file. These random heap corruptions may cause programs to crash.

Memory corruption may occur when you run memory-intensive programs on a computer that has the Intel Physical Addressing Extensions (PAE) specification enabled. PAE enables a computer to support more than 4 gigabytes (GB) of installed memory.

The Server service runs on a Windows Server 2003-based computer together with some other services in a Svchost.exe process. If the Svchost.exe process ends unexpectedly in a low-memory condition, the process cannot restart.

<div class="workaround_section">

WORKAROUND
To work around this problem, turn off the PAE specification. You must either remove the /PAE switch or include the /NOPAE switch in the Boot.ini file.

Notes
 * When you remove the /PAE switch from the Boot.ini file, the computer cannot use all its available memory if it is equipped with more than 4 GB of RAM.
 * Some servers have a &quot;hot plug memory&quot; feature that enables PAE even when the /PAE switch is not set in the Boot.ini file.

To verify that the /PAE switch is enabled on the server, examine the following registry subkey:

Key Name: PhysicalAddressExtension

Type: DWORD

Value: 1

Note Even if you set this registry value to 0, it may automatically reset to 1 after a restart, unless the /NOPAE switch is set.

<div class="resolution_section">

RESOLUTION
To resolve this problem, use one of the following methods: <ul> Update the system to Windows Server 2003 Service Pack 1 (SP1).</li> Install hotfix 895575. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

895575 A process that runs in the Physical Address Extension (PAE) kernel may experience memory corruption in Windows Server 2003

</li></ul>

Note Hotfix 895575 is recommended for Windows Server 2003-based server clusters and for Microsoft SQL Server 2000 installations. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

895092 Recommended hotfixes for Windows Server 2003-based server clusters

Additionally, the following hotfixes may be required, depending on the role of the computer and on the software that you are running: <ul> For more information, click the following article number to view the article in the Microsoft Knowledge Base:

829994 Your Windows Server 2003 computer may experience an access violation in Svchost.exe when it becomes extremely low on resources

</li> If the Windows Management Instrumentation (WMI) Provider Host program (Wmiprvse.exe) crashes on a heavily loaded Windows Server 2003-based computer, install hotfix 835438. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

835438 Wmiprvse.exe crashes in low-memory conditions in Windows Server 2003

</li> When a program or a service stops responding, Windows Error Reporting may not create a dump file if the computer is working under a heavy load or if many threads are open. In this case, install hotfix 837018. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

837018 Windows Error Reporting may not create a dump file in Windows Server 2003

</li></ul>

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section.

<div class="moreinformation_section">

MORE INFORMATION
To quickly determine whether the PAE specification is currently being used on a computer, run the Winver.exe program. If this program reports that physical memory is more than 4 GB, the PAE specification is being used.

For more information about PAE, click the following article number to view the article in the Microsoft Knowledge Base:

283037 Large memory support is available in Windows Server 2003 and in Windows 2000

For more information about the parameters that can be used in the Boot.ini file, click the following article number to view the article in the Microsoft Knowledge Base:

833721 Available switch options for the Windows XP and the Windows Server 2003 Boot.ini files

For more information about hotfix versions, click the following article number to view the article in the Microsoft Knowledge Base:

824994 Description of the contents of Windows XP Service Pack 2 and Windows Server 2003 software update packages

For more information about the Package Installer for Windows and for Windows Components (Update.exe), visit the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/deployment/winupdte.mspx

<div class="references_section">