The Svchost.exe process may end unexpectedly on a Windows Server 2003-based computer (910666)


The information in this article applies to:

  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Datacenter Edition

SYMPTOMS

You may experience one or more of the following symptoms on a Microsoft Windows Server 2003-based server:
  • Many applications and services do not work correctly because the Svchost.exe process ends unexpectedly. Errors that are similar to the following are logged in the Application event log:

    Event Type: Error
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1000

    Event Type: Information
    Event Source: Application Error
    Event Category: (100)
    Event ID: 1004
    Description:
    Faulting application svchost.exe, version 5.2.3790.0, faulting module ntdll.dll, version 5.2.3790.0, fault address 0x0000694e.
    Data Words:
    0000: 41 70 70 6c 69 63 61 74 Applicat
    0008: 69 6f 6e 20 46 61 69 6c ion Fail
    0010: 75 72 65 20 20 73 76 63 ure svc
    0018: 68 6f 73 74 2e 65 78 65 host.exe
    0020: 20 35 2e 32 2e 33 37 39 5.2.379
    0028: 30 2e 30 20 69 6e 20 6e 0.0 in n
    0030: 74 64 6c 6c 2e 64 6c 6c tdll.dll
    0038: 20 35 2e 32 2e 33 37 39 5.2.379
    0040: 30 2e 30 20 61 74 20 6f 0.0 at o
    0048: 66 66 73 65 74 20 30 30 ffset 00
    0050: 30 30 36 39 34 65 00694e
    Note The memory addresses vary, and other applications may be affected.
  • The following error message is logged in the System event log:

    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7023
    Description:
    The Server service terminated with the following error:
    Access is denied.
    Note A text-based version of the System event log contains the following error message:
    The Server service terminated with the following error: %%5
  • The Server service stops and does not restart. The following error message is logged in the System event log:

    Event Type: Information
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7036
    Description:
    The Server service entered the stopped state.

    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7023
    Description:
    The Server service terminated with the following error:
    The server is in use and cannot be unloaded.
    Note A text-based version of the System event log contains the following error message:
    The Server service terminated with the following error: %%1811
    Error 1811 maps to the "ERROR_SERVER_HAS_OPEN_HANDLES" error. The server is in use and cannot be unloaded.

    Additionally, the Windows Management Instrumentation (WMI) service stops, and the Server service ends unexpectedly. The following error message is logged in the System event log:
    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7032
    Description:
    The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error:
    An instance of the service is already running.
  • On a Windows cluster node, the cluster file server resources cannot come online. Additionally, the server may log the following error message in the System event log:
    Event Type: Error
    Event Source: ClusSvc
    Event ID: 1068
    Description:
    Cluster file share resources <ResourceName> failed to start with error 2114

    Event Type: Error
    Event Source: ClusSvc
    Event ID: 1055
    Description:
    Cluster File Share resource <ResourceName> has failed a status check.
    The error code is 2114.
  • The Srvinfo.exe tool does not work correctly. (This tool is included in the Windows Server 2003 Resource Kit.)
  • When you manually try to start the Server service by using the Computer Management snap-in or by typing net start server at the command prompt, you may receive the following error message:

    Could not start the Server service on Local Computer.
    Error 5: Access is denied.
    Notes
    • This behavior occurs even though the user account is a member of the local Administrators group and the Server service is configured to start by using local system credentials.
    • Typically, a restart of the computer temporarily fixes the issue.

CAUSE

This problem may occur if the computer experiences a low-memory condition. When the computer experiences a low-memory condition, memory corruption may occur in the private heap of a dynamic link library (.dll) file. These random heap corruptions may cause programs to crash.

Memory corruption may occur when you run memory-intensive programs on a computer that has the Intel Physical Addressing Extensions (PAE) specification enabled. PAE enables a computer to support more than 4 gigabytes (GB) of installed memory.

The Server service runs on a Windows Server 2003-based computer together with some other services in a Svchost.exe process. If the Svchost.exe process ends unexpectedly in a low-memory condition, the process cannot restart.

WORKAROUND

To work around this problem, turn off the PAE specification. You must either remove the /PAE switch or include the /NOPAE switch in the Boot.ini file.

Notes
  • When you remove the /PAE switch from the Boot.ini file, the computer cannot use all its available memory if it is equipped with more than 4 GB of RAM.
  • Some servers have a "hot plug memory" feature that enables PAE even when the /PAE switch is not set in the Boot.ini file.
To verify that the /PAE switch is enabled on the server, examine the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

Key Name: PhysicalAddressExtension
Type: DWORD
Value: 1

Note Even if you set this registry value to 0, it may automatically reset to 1 after a restart, unless the /NOPAE switch is set.

RESOLUTION

To resolve this problem, use one of the following methods:
  • Update the system to Windows Server 2003 Service Pack 1 (SP1).
  • Install hotfix 895575. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

    895575 A process that runs in the Physical Address Extension (PAE) kernel may experience memory corruption in Windows Server 2003

Note Hotfix 895575 is recommended for Windows Server 2003-based server clusters and for Microsoft SQL Server 2000 installations. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

895092 Recommended hotfixes for Windows Server 2003-based server clusters


Additionally, the following hotfixes may be required, depending on the role of the computer and on the software that you are running:
  • For more information, click the following article number to view the article in the Microsoft Knowledge Base:

    829994 Your Windows Server 2003 computer may experience an access violation in Svchost.exe when it becomes extremely low on resources

  • If the Windows Management Instrumentation (WMI) Provider Host program (Wmiprvse.exe) crashes on a heavily loaded Windows Server 2003-based computer, install hotfix 835438. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

    835438 Wmiprvse.exe crashes in low-memory conditions in Windows Server 2003

  • When a program or a service stops responding, Windows Error Reporting may not create a dump file if the computer is working under a heavy load or if many threads are open. In this case, install hotfix 837018. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

    837018 Windows Error Reporting may not create a dump file in Windows Server 2003

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

To quickly determine whether the PAE specification is currently being used on a computer, run the Winver.exe program. If this program reports that physical memory is more than 4 GB, the PAE specification is being used.

For more information about PAE, click the following article number to view the article in the Microsoft Knowledge Base:

283037 Large memory support is available in Windows Server 2003 and in Windows 2000



For more information about the parameters that can be used in the Boot.ini file, click the following article number to view the article in the Microsoft Knowledge Base:

833721 Available switch options for the Windows XP and the Windows Server 2003 Boot.ini files

For more information about hotfix versions, click the following article number to view the article in the Microsoft Knowledge Base:

824994 Description of the contents of Windows XP Service Pack 2 and Windows Server 2003 software update packages

For more information about the Package Installer for Windows and for Windows Components (Update.exe), visit the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/deployment/winupdte.mspx

REFERENCES

840987 MS04-032: Security update for Microsoft Windows

834628 Data is corrupted when PAE is enabled on a Windows Server 2003-based computer

283037 Large memory support is available in Windows Server 2003 and in Windows 2000

824994 Description of the contents of Windows XP Service Pack 2 and Windows Server 2003 software update packages

890352 A program may stop responding, and event 50 and event 26 are logged, when the program tries to write data to a volume mount point on a Windows Server 2003-based computer

Modification Type:MajorLast Reviewed:9/18/2006
Keywords:kbtshoot kbprb KB910666 kbAudDeveloper
©2004 Microsoft Corporation. All rights reserved.