"Unable to open the Server service performance object."

Question

I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log:

Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

The first four bytes are 34 00 00 C0. Event ID is 2004.

Googling for this always leads to this document on the Microsoft site:

http://technet.microsoft.com/en-us/library/cc727117(WS.10).aspx

However, it claims that to resolve the issue one has to "Restart the Server service".

The "Server" service is always running and to my knowledge has never ever not worked on any of those servers.

Any ideas?

What is the output of *net statistics server* and *net statistics workstation*? — ErikE, Nov 28 '13 at 21:13
1 sessions ccepted, everything else 0. Statistics since the event last happened. Apparently the Server service restarted at that exact time. — Andrew J. Brehm, Nov 29 '13 at 08:08
I'd suspect a 3rd party app/service that's not using/reporting performance counters properly. Is it possible to boot one server with all non-builtin services disabled, and slowly adding them back one by one to isolate the issue? — strongline, Jul 07 '15 at 14:59
Is there some sort of backup/snapshot event that takes place on the server around these times? Perhaps a check for security or other updates? — Matt, Jul 14 '15 at 02:18
Nothing that I can see. But the phenomenon seems to have disappeared. Maybe it'll return. — Andrew J. Brehm, Jul 15 '15 at 15:48
Bentek, it's windows-server-2008-r2 (see tag) and not Itanium. :-) — Andrew J. Brehm, Jul 15 '15 at 15:49

score 1 · Answer 1 · answered Aug 07 '15 at 06:48

When looking into this there seem to be two different things that can cause this problem.

Your running sharepoint in which case the recommendation is to update sharepoint if possible or try and rebuild performance counters.

There is some application that need to collect network performance data. To collect this data the account running this application need to be lcoal administrator on the server or it will not get access and this error will show up in event log.

score 0 · Answer 2 · edited Oct 27 '15 at 12:55

Here's an MS hotfix: https://support.microsoft.com/en-us/kb/2733563

Are these Servers all VMs or imaged from the same one image? You may need to resolve the issue and build a new image to use moving forward if so.

I'd also run an SFC /SCANNOW on one of the machines and then look over the log afterward to see if there's anything in there that points to some fix.

https://msdn.microsoft.com/en-us/library/windows/desktop/aa382541(v=vs.85).aspx

It may be an x86/x64 issue with WMI performance counters with some application that doesn't utilize the appropriate CPU architecture the Server OS is but perhaps the hotfix resolves that issue.

"Unable to open the Server service performance object."

2 Answers2