Home > Event Id > Event Id 7011 Symantec Antivirus

Event Id 7011 Symantec Antivirus

Education Services Maximize your product competency and validate technical knowledge to gain the most benefit from your IT investments. The symptoms are:- When a user close his session, it show this message "Waiting for system event notification service" and the user sessions never close.- When it occurs other users CAN The problem occured after installing symantec endpoint protection. Re: Event ID 7011 Server 2008R2 in Vmware 5.1 SatyS Sep 18, 2013 1:29 AM (in response to Jon Munday) You need to Increase the service timeout period.To resolve this problem, this contact form

We are not running SEP so that should eliminate that. Maybe the  trigger for this happening is when you have a lot of concurrent users on a terminal server with smb shares open to another box. http://support.microsoft.com/kb/974030 I will keep you updated if it really fixes the issue.Thanks,Mahmoud 1359-264425-1460918 Back to top Mahmoud AbuGhazleh Members #7 Mahmoud AbuGhazleh 6 posts Posted 20 May 2010 - 11:40 PM Tryed to connect to event log from dirrent server, found 7011 and 7000 i event log. Get More Info

Translated Content This is machine translated content Login to Subscribe Please login to set up your subscription. Provide feedback on this article Request Assistance Print Article Products Subscribe to this Article Manage your Subscriptions Search Again Situation In every machine of the same Windows domain Symantec Endpoint Protection We have run a Microsoft Fixed http://support.microsoft.com/kb/2465772/en-us but the problem is not revolved!!Any ideas? 15919Views Tags: none (add) windowsContent tagged with windows, vmwareContent tagged with vmware, 5.1Content tagged with 5.1, 2008_server_r2Content From MS ->  "This issue occurs because of a deadlock between the memory manager and the Redirected Drive Buffering SubSystem (Rdbss.sys) driver." Others have suggested also KB980568 and KB956438.

  1. Not a member?
  2. Several functions may not work.
  3. It is happenig every morning wince we put the second XenApp server on our new farm.
  4. Rebooted servers and no more event 7011 or 56.
  5. About Advertising Privacy Terms Help Sitemap × Join millions of IT pros like you Log in to Spiceworks Reset community password Agree to Terms of Service Connect with Or Sign up
  6. Has anyone tried it? 1359-264425-1543018 Back to top Report abuse Page 1 of 3 1 2 3 Back to XenApp 6.0 for Windows Server 2008 R2 - General Reply to
  7. Like Show 0 Likes (0) Actions 5.
  8. Good luck! 0 Sonora OP The Rauzer Apr 20, 2012 at 9:02 UTC "toswegian" - We're talking about KB976674, KB956438, and KB980568, correct?

Re: Event ID 7011 Server 2008R2 in Vmware 5.1 LOPERA Sep 20, 2013 12:02 PM (in response to Jon Munday) Hi, thanks for you answer.All VM are configured in a Datastore Also, is the person who originally started this forum list still having the problem after the proposed resolutions? 1359-264425-1467098 Back to top Roger Pascual Members #12 Roger Pascual 12 posts Posted Re: Event ID 7011 Server 2008R2 in Vmware 5.1 Umesh Sep 24, 2013 9:03 AM (in response to LOPERA) Hi,Try installing this below hotfix and uninstall symantec antivirus if you have Client Can't connect after event id 7011 Started by Andrea Soccal , 05 May 2010 - 03:55 PM Login to Reply Page 1 of 3 1 2 3 47 replies

However the removal of said software did NOT solve the issue. Will update. 0 Pimiento OP raulmorales Mar 22, 2016 at 9:48 UTC We started experiencing this exact issue but on our Windows 7 Machines, We have no clue Tryed to remove symantec, but still a problem. 0 Pimiento OP Trish Mar 2, 2011 at 10:33 UTC After 4 months of troubleshooting and researching, found the cause Reply Subscribe RELATED TOPICS: Event ID 7011 Spam.

The serveres just hang and when we try to log in to the server we get welcome screen. Join the community Back I agree Powerful tools you need, all for free. Error from Debug.log --- snip --- 03/20 10:43:53.228 [2764:760] Failed to query Registry key smc_exit_test! 03/20 10:43:53.228 [2764:760] SMC_CMD_STOP_EVENT open failed. This is followed by a flood of Service Control Manager Errors (7011).  It ALWAYS starts with NlaSvc, followed by CryptSvc.  These two alternate for a while, then other services start to

My money's on KB976674 which I just applied. http://www.symantec.com/connect/forums/event-id-7011 Error code=2 190)Browser Address Error Redirector 03/20 10:45:43.609 [760:2804] [DoHeartbeat] Failed to get hardware ID at startup. Finally replacing network cards solved the problem. The message does not mean that Symantec AntiVirus is disabled.

These servers are using a standard mode PVS image so nothing has changed, just time. weblink I analyzed the event logs, I saw a lot of logs that have 7011 event ID. Submit a Threat Submit a suspected infected fileto Symantec. There is a farm of 6 2008R2 terminal servers.  They will grind to a halt with 7011 messages.  They can be hard booted - will boot - then error will return

The users also notice the following: - We first see the 7011 nlssvc events, then the 56 events. (nlsvc errors then slowness) - When logged into the TS, users find it This would help us more! 1359-264425-1538474 Back to top Farzad Mirzai Members #20 Farzad Mirzai 4 posts Posted 25 March 2011 - 06:26 PM Hi,I have used some monthes on this For further information, check the Symantec Support Web site at http://www.symantec.com/techsupp/servlet/ProductMessages 10:48:02.037604[_2024][_344]|WSC Alerting Control (enable av): Error 0x80070002 occured enabling AV alerts. --- snip --- from Windows Events Log Type: navigate here I believe the patch KB976674 has helped as as we haven't seen the hang since.

which is a long stretch..  Usually we'd get hit every 2 weeks or so. Specifically the KB976674 hotfix? Terms of use for this information are found in Legal Notices.

No issues.  Next time it occurred, caused by Quickbooks Pro running automatic backup from Windows 7 PC.  Resolved by moving QB Pro to XP PC.  Was not a Symantec Issue. 0

Might solve your problem.http://support.microsoft.com/kb/974030 Like Show 0 Likes (0) Actions 8. However I want to give it a few more weeks until I know for sure. We are still seing the 7011 and 56 events but noone has reported the systems slowness (hang) changed E1000 networks cards to vmxnet3, cloned MAC address of old card to new card which has license server role on it. The problem will "magically" go away after a few hrs of pain and we have yet to figure out why.  I'm suspecting there is a network buffer or something like that

I have now uninstalled Symatnec so I'll see how it goes over the next couple of weeks. 1359-264425-1464391 Back to top Ray Hall Members #10 Ray Hall 72 posts Posted 07 Supported Products A-Z Get support for your product, with downloads, knowledge base articles, documentation, and more. Discussion Filed Under: Security, Endpoint Protection (AntiVirus) - 12.x, Endpoint Protection (AntiVirus) Comments RSS Feed Comments 3 Comments • Jump to latest comment ℬrίαη Trusted Advisor Event ID 7011 - Comment:16 his comment is here No Yes logo-symantec-dark-source Loading Your Community Experience Symantec Connect You will need to enable Javascript in your browser to access this site. © 2017 logo-symantec-dark-source Loading Your Community Experience Symantec Connect

I have been unable to find any references to this particular series of events. Help Desk » Inventory » Monitor » Community » There is not a consistent time window for this to occur.  The first two times were almost exactly 24 hours apart.  The third occurrence was 3 days later.  Fourth was 2 In our case all the users login to terminal services then map drive S: to another server and open an access database on S:.  Good luck! 0 Sonora

Submit a False Positive Report a suspected erroneous detection (false positive).

Information for: Enterprise Small Business Consumer (Norton) Partners Our Offerings: Products Products A-Z Services Solutions Connect with us: Support we suspected some windows updates but after uninstalling all relevant windows updates during the last month the problem persist! 0 Sonora OP Joe5236 Mar 22, Create a SymAccount now!' Event ID 7011: "Timeout (30000ms) waiting for a transaction response from the SAV service" TECH101855 January 27th, 2007 http://www.symantec.com/docs/TECH101855 Support / Event ID 7011: "Timeout (30000ms) waiting