Unable to Change the Startup Parameter When a Service Hangs (158995)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0
This article was previously published under Q158995
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

A service stops responding during startup on a computer running Windows and you are unable to change the Startup parameter to manual, either locally or remotely, through the Server Manager Service.

For example, the Event Log Service locks the system locally after a pop-up message appears saying the Event Log is full.

CAUSE

This problem can happen because Overwrite Events Older than seven days is the default setting for Event Viewer logging.

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To change the startup parameter of a service in this condition, you can modify the registry by performing the following steps:
  1. Start Registry Editor (Regedt32.exe).
  2. From the Registry menu, click Select Computer. Type in the name of the computer that is not responding, and then click OK.
  3. Locate the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \EventLog

  4. Edit the following entries:

    Value Name: Start
    Data Type: REG_DWORD
    Data: 3 (Default: 2)

    (Data values are 0 = Boot, 1 = System, 2 = Automatic, 3 = Manual, 4 = Disabled)
After the value for Start has been set to Manual, you can remotely shut down the computer using Shutdown.exe or Shutgui.exe from the Windows Resource Kit.

In the case of the event logs being full, after you restart, you can now rename or delete the event files located in the %SystemRoot%\System32\Config folder as needed.

MORE INFORMATION

This method of changing the Start parameter is useful in trouble-shooting other services also, such as Exchange and SQL services. After you have control of the computer, the service can be started manually from the DOS prompt by typing "net start <service name>". If an error occurs, you will get the error message in the DOS box or by Control Panel Services Start and you can check the event log to determine if an error occurs.
Modification Type:MajorLast Reviewed:6/3/2003
Keywords:kbenv KB158995
©2002 Microsoft Corporation. All rights reserved.