Event Log Opening Problem Causes Services.exe Failure

• Microsoft Windows NT Workstation version 4.0
• Microsoft Windows NT Server version 4.0

SYMPTOMS

Windows NT server Services.exe may cause an access violation during an event log update. An "RPC Server is too busy..." message may appear, indicating that Services.exe failed. A Dr. Watson log may be written to the %SystemRoot% directory. Sessions provided by the server through NET USE may remain active. You may also be able to establish new sessions.

The following messages may be returned to client requests using RPC services:

   Error 1723: The RPC server is too busy to complete this operation.

CAUSE

The pointer to the next event is miscalculated or the beginning of the log is corrupt and causing Services.exe to have an access violation. After Services.exe exits, other service wait indefinitely.

RESOLUTION

Obtain the following fix or wait for the next Windows NT service pack.

This fix should have the following timestamp:

   11/26/97  02:18p                51,472 Eventlog.dll (Intel)
   11/25/97  05:15p                84,240 Eventlog.dll (Alpha)

STATUS

Microsoft has confirmed this to be a problem in Windows NT version 4.0. A supported fix is now available, but has not been fully regression tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information.