Event Log Write Problem Causes SERVICES.EXE Failure

• Microsoft Windows NT Workstation version 3.5
• Microsoft Windows NT Server version 3.5

SYMPTOMS

Windows NT server SERVICES.EXE may cause an access violation during an event log update. An "RPC Server is too busy..." message may appear, indicating that SERVICES.EXE failed. A Dr. Watson log may be written to the %SYSTEMROOT% directory. Sessions provided by the server through NET USE may remain active. You may also be able to establish new sessions.

The following messages may be returned to client requests using RPC services:

   Error 1723:  The RPC server is too busy to complete this operation.

CAUSE

The last read position, an offset relative from the start of the log, is stored in the event log handle. If the offset is abnormally large, the next read attempt may read beyond the end of log.

RESOLUTION

To resolve this problem, install the fix mentioned below.

After you install the fix mentioned below, the event log will return an error in this case, instead of generating a fault.

STATUS

Microsoft has confirmed this to be a problem in Windows NT version 3.5. This problem was corrected in the latest U.S. Service Pack for Windows NT Workstation or Server version 3.5. For information on obtaining this update, query on the following word in the Microsoft Knowledge Base (without the spaces):

   S E R V P A C K