… or Event Log Message + Unrelated KB Article = Fix

When troubleshooting a problem, it has become a fairly safe bet that:

  1. You’re not the only person to have the problem.
  2. You’re not the first person to have the problem.
  3. Someone else has, in fact, already solved the problem.
  4. Someone who has solved the problem has also shared the solution.
  5. Your friend Google will help you find the solution.

The above is especially true when you have an exact error message.

I encountered a problem recently, however, that did not follow this model.  Perhaps not too many other people had the problem.  Perhaps not many of those people experienced and solved the problem shared their experience online.  Whatever the case I feel compelled to share the problem and solution, if only to seed Google and help some other poor techie who runs into this issue.

Scenario:

The file server for a largish department hangs at random intervals.  When this happens, the server still responds to ping requests.  At the console, a blank desktop (solid blue background, in my case) with a mouse cursor appears.  The mouse moves, but other input doesn’t seem to do anything.  The server service appears to be stopped, as network shares are unavailable.  Remote restart commands (shutdown -r -m \\SERVERNAME) have no affect.  The only successful course of action is to power cycle the server.  After doing this, the server works fine for a while.  There does not appear to be a pattern to the timing of the event, as it would occur in the middle of the day or the middle of the night.

Instances of this problem are characterized by the following event log entry:

Event Type:        Error
Event Source:    Application Error
Event Category:                (100)
Event ID:              1000
Date:                     MM/DD/YYYY
Time:                     HH:MM:SS PM
User:                     N/A
Computer:          <OMITTED>
Description:
Faulting application svchost.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.3959, fault address 0x00010a5b.

For weeks, I racked my brain, consulted peers, and scoured the web (see points 1-5 above) to no avail.  I ran tons of diagnostics, swapped out memory, updated drivers.  I even tried daily preemptive rebooting.  No luck

Finally, I stumbled upon a Microsoft knowledgebase article entitled
“The Service Host process may stop unexpectedly in Windows Server 2003″ (http://support.microsoft.com/kb/932762).  The article does not mention the event log entry above, but the hotfix does appear to have corrected the problem.  The server has been up for months now without unexpected reboots.

Good luck to any of you dealing with this issue, and I hope that I was able to help!