Event Id 7011 Symantec Antivirus
Education Services Maximize your product competency and validate technical knowledge to gain the most benefit from your IT investments. The symptoms are:- When a user close his session, it show this message "Waiting for system event notification service" and the user sessions never close.- When it occurs other users CAN The problem occured after installing symantec endpoint protection. Re: Event ID 7011 Server 2008R2 in Vmware 5.1 SatyS Sep 18, 2013 1:29 AM (in response to Jon Munday) You need to Increase the service timeout period.To resolve this problem, this contact form
We are not running SEP so that should eliminate that. Maybe the trigger for this happening is when you have a lot of concurrent users on a terminal server with smb shares open to another box. http://support.microsoft.com/kb/974030 I will keep you updated if it really fixes the issue.Thanks,Mahmoud 1359-264425-1460918 Back to top Mahmoud AbuGhazleh Members #7 Mahmoud AbuGhazleh 6 posts Posted 20 May 2010 - 11:40 PM Tryed to connect to event log from dirrent server, found 7011 and 7000 i event log. Get More Info
Translated Content This is machine translated content Login to Subscribe Please login to set up your subscription. Provide feedback on this article Request Assistance Print Article Products Subscribe to this Article Manage your Subscriptions Search Again Situation In every machine of the same Windows domain Symantec Endpoint Protection We have run a Microsoft Fixed http://support.microsoft.com/kb/2465772/en-us but the problem is not revolved!!Any ideas? 15919Views Tags: none (add) windowsContent tagged with windows, vmwareContent tagged with vmware, 5.1Content tagged with 5.1, 2008_server_r2Content From MS -> "This issue occurs because of a deadlock between the memory manager and the Redirected Drive Buffering SubSystem (Rdbss.sys) driver." Others have suggested also KB980568 and KB956438.
- Not a member?
- Several functions may not work.
- It is happenig every morning wince we put the second XenApp server on our new farm.
- Rebooted servers and no more event 7011 or 56.
- About Advertising Privacy Terms Help Sitemap × Join millions of IT pros like you Log in to Spiceworks Reset community password Agree to Terms of Service Connect with Or Sign up
- Has anyone tried it? 1359-264425-1543018 Back to top Report abuse Page 1 of 3 1 2 3 Back to XenApp 6.0 for Windows Server 2008 R2 - General Reply to
- Like Show 0 Likes (0) Actions 5.
- Good luck! 0 Sonora OP The Rauzer Apr 20, 2012 at 9:02 UTC "toswegian" - We're talking about KB976674, KB956438, and KB980568, correct?
Re: Event ID 7011 Server 2008R2 in Vmware 5.1 LOPERA Sep 20, 2013 12:02 PM (in response to Jon Munday) Hi, thanks for you answer.All VM are configured in a Datastore Also, is the person who originally started this forum list still having the problem after the proposed resolutions? 1359-264425-1467098 Back to top Roger Pascual Members #12 Roger Pascual 12 posts Posted Re: Event ID 7011 Server 2008R2 in Vmware 5.1 Umesh Sep 24, 2013 9:03 AM (in response to LOPERA) Hi,Try installing this below hotfix and uninstall symantec antivirus if you have Client Can't connect after event id 7011 Started by Andrea Soccal , 05 May 2010 - 03:55 PM Login to Reply Page 1 of 3 1 2 3 47 replies
However the removal of said software did NOT solve the issue. Will update. 0 Pimiento OP raulmorales Mar 22, 2016 at 9:48 UTC We started experiencing this exact issue but on our Windows 7 Machines, We have no clue Tryed to remove symantec, but still a problem. 0 Pimiento OP Trish Mar 2, 2011 at 10:33 UTC After 4 months of troubleshooting and researching, found the cause Reply Subscribe RELATED TOPICS: Event ID 7011 Spam.
The serveres just hang and when we try to log in to the server we get welcome screen. Join the community Back I agree Powerful tools you need, all for free. Error from Debug.log --- snip --- 03/20 10:43:53.228 [2764:760] Failed to query Registry key smc_exit_test! 03/20 10:43:53.228 [2764:760] SMC_CMD_STOP_EVENT open failed. This is followed by a flood of Service Control Manager Errors (7011). It ALWAYS starts with NlaSvc, followed by CryptSvc. These two alternate for a while, then other services start to
My money's on KB976674 which I just applied. http://www.symantec.com/connect/forums/event-id-7011 Error code=2 190)Browser Address Error Redirector 03/20 10:45:43.609 [760:2804]
These servers are using a standard mode PVS image so nothing has changed, just time. weblink I analyzed the event logs, I saw a lot of logs that have 7011 event ID. Submit a Threat Submit a suspected infected fileto Symantec. There is a farm of 6 2008R2 terminal servers. They will grind to a halt with 7011 messages. They can be hard booted - will boot - then error will return
The users also notice the following: - We first see the 7011 nlssvc events, then the 56 events. (nlsvc errors then slowness) - When logged into the TS, users find it This would help us more! 1359-264425-1538474 Back to top Farzad Mirzai Members #20 Farzad Mirzai 4 posts Posted 25 March 2011 - 06:26 PM Hi,I have used some monthes on this For further information, check the Symantec Support Web site at http://www.symantec.com/techsupp/servlet/ProductMessages 10:48:02.037604[_2024][_344]|WSC Alerting Control (enable av): Error 0x80070002 occured enabling AV alerts. --- snip --- from Windows Events Log Type: navigate here I believe the patch KB976674 has helped as as we haven't seen the hang since.
No issues. Next time it occurred, caused by Quickbooks Pro running automatic backup from Windows 7 PC. Resolved by moving QB Pro to XP PC. Was not a Symantec Issue. 0
Might solve your problem.http://support.microsoft.com/kb/974030 Like Show 0 Likes (0) Actions 8. However I want to give it a few more weeks until I know for sure. We are still seing the 7011 and 56 events but noone has reported the systems slowness (hang) changed E1000 networks cards to vmxnet3, cloned MAC address of old card to new card which has license server role on it. The problem will "magically" go away after a few hrs of pain and we have yet to figure out why. I'm suspecting there is a network buffer or something like that
I have been unable to find any references to this particular series of events. Help Desk » Inventory » Monitor » Community » There is not a consistent time window for this to occur. The first two times were almost exactly 24 hours apart. The third occurrence was 3 days later. Fourth was 2 In our case all the users login to terminal services then map drive S: to another server and open an access database on S:. Good luck! 0 Sonora
Submit a False Positive Report a suspected erroneous detection (false positive).