A customer is facing this error on all DCs.
There are 3 DCs in 2 AD sites. The error is constant and remains after a migration of the two DCs of the main site to Windows 2102 R2. The same error existed in the old Win 2008 R2 DCs too.
Log Name: System
Source: <g class=»gr_ gr_80 gr-alert gr_spell gr_run_anim ContextualSpelling ins-del multiReplace» data-gr-id=»80″ id=»80″>srv</g>
Date: 12/09/2016 10:30:30
Event ID: 2000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: srvdc2.sorelleramonda.local
Description:
The server’s call to a system service failed unexpectedly.
Event Xml:
<Event xmlns=»http://schemas.microsoft.com/win/2004/08/events/event»>
<System>
<Provider Name=»srv» />
<EventID Qualifiers=»49152″>2000</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=»2016-09-12T08:30:30.226906400Z» />
<EventRecordID>241555</EventRecordID>
<Channel>System</Channel>
<Computer>srvdc2.sorelleramonda.local</Computer>
<Security />
</System>
<EventData>
<Data>DeviceLanmanServer</Data>
<Binary>0000040001002C0000000000D00700C00000000002030980000000000000000000000000000000002C03C516</Binary>
</EventData>
</Event>
Binary data:
In Words
0000: 00040000 002C0001 00000000 C00007D0
0010: 00000000 80090302 00000000 00000000
0020: 00000000 00000000 16C5032C
In Bytes
0000: 00 00 04 00 01 00 2C 00 ……,.
0008: 00 00 00 00 D0 07 00 C0 ….Ð..À
0010: 00 00 00 00 02 03 09 80 …….€
0018: 00 00 00 00 00 00 00 00 ……..
0020: 00 00 00 00 00 00 00 00 ……..
0028: 2C 03 C5 16 ,.Å.
I have tried to uninstall AV and a monitoring tool. I also try to troubleshoot the issue using Process Monitor, but I did not find anything relevant.
Your help to this matter will be high appreciated. Thanks a lot,
Enrico Giacomin
Tert писал(а):Timur
Телепаты ушли в отпуск.
Опишите хотя бы конфигурацию машины, установленную ОС, задачи, которые выполняет компьютер.
И дайте полный лог ошибки.
Даю:
1. ОС: Windows 2003 Server Enterprise, MUI, SP1.
2. Задачи:
-Terminal Server
-File Server
-DNS Server (w/o domain)
-RRAS
-DHCP Server (for RemoteBoot with ThinStation)
-Server DrWebES
-Стройконсультант
-Кодекс
3. PC:
-Intel XEON (2)/1Gb RAM/4x74Gbx2RAID (забыл 
который зеркало)/DVD-RW/3xLAN (2х1Gb+1х100Mb)
4. Запись в логе:
——
Тип события: Ошибка
Источник события: Srv
Категория события: Отсутствует
Код события: 2000
Дата: 19.03.2007
Время: 18:28:24
Пользователь: Н/Д
Компьютер: SERVER
Описание:
Неожиданный сбой при вызове системной службы сервером.
Дополнительные сведения можно найти в центре справки и поддержки, в «http://go.microsoft.com/fwlink/events.asp».
Данные:
0000: 00 00 04 00 01 00 54 00 ……T.
0008: 00 00 00 00 d0 07 00 c0 ….Ð..À
0010: 00 00 00 00 0a 01 00 c0 …….À
0018: 00 00 00 00 00 00 00 00 ……..
0020: 00 00 00 00 00 00 00 00 ……..
0028: 34 03 bd 00 4.½.
——
Вот еще другие:
Тип события: Уведомление
Источник события: DNS
Категория события: Отсутствует
Код события: 2502
Дата: 13.03.2007
Время: 8:50:34
Пользователь: Н/Д
Компьютер: SERVER
Описание:
DNS-сервер завершил цикл очистки без просмотра узлов. Возможные причины:
1) Не настроены зоны, очищаемые данным сервером.
2) Цикл очистки начат не ранее 60 минут назад.
3) Ошибка во время очистки.
Следующий цикл очистки запланирован через 168 часов.
Если при выполнении цикла очистки произошла ошибка, код ошибки содержится в данных события.
Дополнительные сведения можно найти в центре справки и поддержки, в «http://go.microsoft.com/fwlink/events.asp».
——
И вот эта на последок:
Тип события: Предупреждение
Источник события: Userenv
Категория события: Отсутствует
Код события: 1517
Дата: 15.03.2007
Время: 13:50:36
Пользователь: NT AUTHORITYSYSTEM
Компьютер: SERVER
Описание:
Реестр пользователя SERVERПользователь был сохранен в то время, как приложение или служба продолжали использовать его во время выхода из системы. Используемая реестром пользователя память не была освобождена. Реестр будет выгружен, когда он не будет использоваться.
Возможная причина — службы, выполняемые от имени пользователя. Попробуйте изменить настройку служб и задать их выполнение с учетными записями LocalService или NetworkService.
Дополнительные сведения можно найти в центре справки и поддержки, в «http://go.microsoft.com/fwlink/events.asp».
——
- Remove From My Forums
-
Question
-
We receive repeated system errors through the day when we have heavy use. The error in the event log is «The server’s call to a system service failed unexpectedly».
The Source is «srv», Event ID is «2000»
All replies
-
Looked at that feed and the conditions don’t match our server version. Thanks
-
Hello Kerry,
What AV and Backup software are you running on this
machine? Would it be possible to post the output from one of these event log entries
so we can see more detail?Thanks! Joe
-
Hi,
The error message is common, so it will be difficult to find out the accurate cause.
Whether it will cause a crash/BSOD when the error occurs? If so, you can try to collect dump file for further analysis.
TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.
-
- EventData DeviceLanmanServer 0000040001002C0000000000D00700C0000000000D0000C00000000000000000000000000000000020031302
Binary data: In Words 0000: 00040000 002C0001 00000000 C00007D0 0008: 00000000 C000000D 00000000 00000000 0010: 00000000 00000000 02130320
In Bytes 0000: 00 00 04 00 01 00 2C 00 ……,. 0008: 00 00 00 00 D0 07 00 C0 ….Ð..À 0010: 00 00 00 00 0D 00 00 C0 …….À 0018: 00 00 00 00 00 00 00 00 …….. 0020: 00 00 00 00 00 00 00 00 …….. 0028: 20 03 13 02 …
-
There is McAfee for AV, EndPoint Security Manager by N-Able, and Carbonite backup. We also run a daily Server2008 backup routine.
Thanks
-
See subsequent post for Event Log detail.
Thanks
Articles > Windows 2003
Last Updated: 10/10/08
If you get this error:
Event Type: Error Event Source: Srv Event Category: None Event ID: 2000 Date: 10/8/2008 Time: 4:48:03 PM User: N/A Computer: (server-name) Description: The server's call to a system service failed unexpectedly. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00040000 00540001 00000000 c00007d0 0010: 00000000 c000010a 00000000 00000000 0020: 00000000 00000000 00bd0334
Then you should Install SP1 for Windows 2003. You can also get relief from this problem by uninstalling this update:
http://support.microsoft.com/default.aspx?kbid=896422
Basically Installing SP1 for Windows 2003 and then running windows updates should fix the problem. This message can also come up if you have the RC (Release Candidate) version of SP1 and not the RTM (Retail)
Keywords: event id 2000 srv source error system call failed c00007d0 00bd0334
Dear Experts,
I’m having a very strange problem regarding a client-server application i’ve wrote. Let me explain the purpose of the program first:
The program is designed to show different stats of a remote server. At the moment, free disk space, cpu speed, nic speed, fan speed and server temperature are supported.
The server side uses wmi to get values for the Free disk space, Fan speed and server temperature. For the cpu and nic speed I use performance counters that can be defined in the servers settings pane.
The stats are beeing read when the server gets a command from a client (at the moment i’m using only one client) e.g., every 15min the free disk space is beeing read through WMI, every 10 sec fan speed, … Those timers are configurable on the client side.
So basicly, the server listens for a command, gets a command $FREE from the client, executes the FreeSpace() method and sends the result back to the client who processes it further.
In total, I have two servers. One domaincontroller and one software server (SMS). On the SMS server, the server application is running stable without any problems. Thou, on my DC, the application runs fine untill after a while (read a bunch of hours) the event log is beeing spammed with following error:
Event Type: Error
Event Source: Srv
Event Category: None
Event ID: 2000
Date: 05/11/2008
Time: 9:48:04
User: N/A
Computer: <domaincontroller name>
Description:
The server’s call to a system service failed unexpectedly.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00040000 00540001 00000000 c00007d0
0010: 00000000 c000010a 00000000 00000000
0020: 00000000 00000000 00bd0334
This results in my domaincontroller locking up (printers not reachable, roaming profiles not reachable, …). Not one of my client computers can connect to my DC… Does anyone has an idea what could be the source of this problem? I just find it very strange that on my software server, it works perfectly as it should.
If you need more detailed information about the program just let me know and I will reply 
This is not a top of the top quality program, it is used for personal use.
I hope someone can point me in the right direction here. Thanks in advance!
Best regards,
Steven Bruneel