Monitor Windows server services in cloud

I am still new to azure. I have already built 2 ADFS servers in our azure cloud, connected azure to the companies network. All is good. I need to know how to setup monitoring of windows services that are running on those 2 windows 2012 servers. We recently
had the ADFS service stop, and need to be alerted when this service stops again. I didn't see any way to do this in the azure portal

Try the change tracking intelligence pack in Operational Insights
http://blogs.technet.com/b/momteam/archive/2014/09/24/wish-you-knew-which-configuration-change-caused-the-issue-or-what-changed-on-a-server.aspx
I am assuming those 'servers' are Azure VM's (IaaS) ?
While we don't do real-time alerting yet (it's in our backlog - this item
http://feedback.azure.com/forums/267889-azure-operational-insights/suggestions/6519198-long-running-saved-searches-or-scheduled-that-ca ), you can compose your own tailored query in a dashboard and consume it also from mobile experience
http://blogs.technet.com/b/momteam/archive/2014/11/24/access-your-operational-insights-on-the-go.aspx or on the site.
We are in preview, let us know what you think and file ideas on the feedback forum
http://feedback.azure.com/forums/267889-azure-operational-insights
Hope that helps,

Similar Messages

WCF service application hosted in IIS for reading Windows server service bus topic/subscription

We have a WCF service application(not web application) which is deployed in IIS 8 pointing to the windows server service bus topic/subscription. We have configured the WCF service with applicationInitialization feature of IIS 8 to warm up.
But the WCF service is not reading any message from the topic/subscription.
configured in web.config file as below
<system.webServer>
<applicationInitialization>
<add initializationPage="/MyService.svc" />
</applicationInitialization>
</system.webServer>
When we run the same from visual studio its reading messages from topic/subscription.
any configuration/settings which we are missing?

You probably didn't initialize correctly the auto-start. Btw. I would recommend you to use AppFabric for this feature. It is more transparent in development and production.
Please take a look on following posts:
http://social.technet.microsoft.com/wiki/contents/articles/1284.host-wcf-services-with-service-bus-endpoints-in-iis-and-windows-server-appfabric.aspx
http://developers.de/blogs/damir_dobric/archive/2009/10/11/iis-7-5-and-always-running-web-applications.aspx
http://developers.de/blogs/damir_dobric/archive/2010/06/11/appfabric-issue-with-aoutostart.aspx
Damir Dobric
developers.de
daenet.de
daenet.eu
daenet.com

Monitor SQL Server service Broker queue status

I need to monitor SQL Server service Broker queue status. If the queue is disabled, send me an email alert.
Can you let me know what's the best way to accomplish it using SCOM?

1) create a queue for notification
2) create a service on notification queue
3)Create an event notification for broker queue disable. Associate this with the queue that you are monitoring.
4)Create a procedure that send you and email with this event happens
Example:
---- Notification
CREATE
QUEUENotify_queue
-- Service
CREATE
SERVICE[http://queue_Notify]
ONQUEUENotify_queue([http://schemas.microsoft.com/SQL/Notifications/PostEventNotification]);
--Event
CREATE
EVENTNOTIFICATION[http://queue_Notify_event]
ONQUEUETarget_queue
FORBROKER_QUEUE_DISABLED
TOSERVICE'http://queue_Notify','current
database';
GO
procedure will be something like...
WAITFOR
RECEIVETOP(1)
@RecvReqMsgName=message_type_name,
@RecvReplyMsg=message_body,
@RecvReplyDlgHandle=conversation_handle
FROMNotify_queue),TIMEOUT5000
IF(@RecvReqMsgName='http://schemas.microsoft.com/SQL/Notifications/EventNotification')
BEGIN
DECLARE@cmdNVARCHAR(MAX)
SET@cmd='dbo.sp_send_dbmail
@profile_name="Name XYZ",
@recipients="[email protected]",
@body="CAST(@RecvReplyMsg as NVARCHAR(MAX)",
@subject="Queue Disabled Detected";'
EXEC
(@cmd)
END

Windows Server Service Provider Registry fails to start - error 1067 The process terminated unexpectedly

Hello experts,
I have a SBS 2011 Essentials installation that suddenly has an empty dashboard.
Event viewer:
APPLICATION LOG - Event ID: 1000 Source: Application Error
General Description:
Faulting application name: ProviderRegistryService.exe, version: 6.1.1840.0, time stamp: 0x4d6dafda
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0x80131623
Fault offset: 0x000007fe958b0717
Faulting process id: 0xff8
Faulting application start time: 0x01cf340bce30552f
Faulting application path: C:\Program Files\Windows Server\Bin\ProviderRegistryService.exe
Faulting module path: unknown
Report Id: 0befeb0f-9fff-11e3-852b-d4ae52c1faae
APPLICATION LOG - Event ID: 1025 Source: .Net Runtime
General Description:
Application: ProviderRegistryService.exe
Framework Version: v4.0.30319
Description: The application requested process termination through System.Environment.FailFast(string message).
Message: Unhandled exception in OnStart: System.ArgumentOutOfRangeException: Not a valid Win32 FileTime.
Parameter name: fileTime at System.DateTime.FromFileTimeUtc(Int64 fileTime)
SYSTEM LOG -Event ID: 7031 Source: Service Control Manager General Description:
The Windows Server Service Provider Registry service terminated unexpectedly. It has done this xx0 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
When I try to start this service I get 'error 1067 - The process terminated unexpectedly'. I have checked all dependencies of this particular service and they are all running properly. I've restarted these dependencies, disabled Kaspersky
protection, restarted the Server a few times to no avail.
Any ideas? Thank you!

I had this exact same problem! Thank you so much Robert for posting a link to that script! That is truly an amazing Powershell script.
I had all the same errors that AK772 mentioned, but I chose to zoom in on a different issue that the script pointed out. When I ran the "Test CA Infrastructure" step it found several errors. When I looked at what the script was doing there it was
comparing the server certificate thumbprint in the registry (HKLM:\Software\Microsoft\Windows Server\Identity) with the personal certificates (Personal Certificates in the Certificate snap-in using MMC). When I looked through them individually, sure enough
the thumbprint in the registry didn't exist in my certificate store. I have NO idea how this could have happened!
However, from there, I changed my Google search criteria and found the following excellent article:
http://titlerequired.com/2013/04/29/windows-server-2012-essentials-an-error-prevented-the-dashboard-from-opening/
This told more about that error and showed how to regenerate the certificate identity in the registry. This totally saved me! Once I ran through the steps that he outlines, even though I got a timeout error towards the end, I could see that the certificate
thumbprint had changed in the registry and now existed in my personal certificate store.
Once I saw this, I tried going into services and manually starting the stopped "Windows Server Service Provider Registry" service. Sure enough it started right up, no error this time. Finally, I restarted the server so that all of the other dependent
services would come back up and re-ran the linked script above and everything was perfect.
Thanks so much for the breadcrumbs in this post and all of your contributions. I hope that this post will equally be able to help someone else through this very troublesome and evasive error!

CiscoWorks: Windows server, service-Task Manager has any role in CW application.

Hi,
Our CiscoWorks is residing on a windows server, and this server Task Manager Services are turned off. Does the Task Manager have any role in CiscoWorks application?

no i don't think so,
the LMS services start with CW or ciscoWorks

Dynamics CRM and Windows Server Service Bus

Hi,
https://msdn.microsoft.com/en-us/library/gg309276.aspx
Here it is described how you can connect Dynamics CRM with Azure Service Bus.
As far as I know it is not possible to connect Dynamics CRM to a Service Bus which is hosted on Windows Server.
Is this correct? If so, why not and do you plan to allow this in the future?

Simple answer is because of CRM Online. How do you see the connection between something that is hosted OnLine and something that is hosted OnPremices.
In case you anyway want to have this feature you can leave your suggestion on
Connect and recheck that your feature is really needed.
Dynamics CRM MVP/ Technical Evangelist at
SlickData LLC
My blog

How can Monitor Windows Servies on OEM

Hi,
I want to monitor some specific Windows services using OEM, How can i do this.
Please help on this, Is available any plug-in or scripts....
Thanks in advance
YJR

Hi YJR,
I hope I'm understanding you correctly - you want to monitor only one specific service?
You could use the command Shant provided to you and just do a findstr for the name. Example:
nmefwmi "wbem_classname= win32_service" "wbem_properties=name, pathname, processid, Started, startmode, state, status" "wbem_namespace=root\cimv2" | findstr name=W32Time
this results in following on my example host:
name=W32Time|pathname=C:\WINDOWS\System32\svchost.exe -k LocalService|processid=1352|started=True|startmode=Auto|state=Running|status=OK
So now you'd have a lot of useful information on your service - and only your service - already in a pipe separated line, easy to get into an own metric.
Please tell me if I'm going in the wrong direction here.
Btw: Thanks Shant for showing that possibility, never knew the agent had a tool for that.
Best regards,
Robert

SCOM 2012 Monitoring of windows based service

Hi,
Here my requiremt is to monitoring windows based service in scom 2012. The agent server is a windows based machine and I need to monitor these service, once they are in stopped state or in starting state. The server state is ahowing healthy.
Could someone pls guide me or share me the details for configure a wondows based service in scom for monitoring.
Below is the service i want to monitor through scom 2012
Thanks
Regards, Rajeev Parambil

Hi,
Please follow the steps below:
1. Under Authoring console, right click Monitors, then choose create a Monitor, select Unit monitor.
2. With the Create a Unit Monitor Wizard, we select Basic Service Monitor under Windows Services.
3. Choose the destinaton management pack to store the monitor. Click Next.
4. Specify the monitor name, and choose Monitor target class, such as Windows Operation System. Click Next.
5. Then select Service that you want to monitor, we can specify the computer name, and then find the service under the computer. Click Next.
6. Configure Health and Configure Alert.
Regards,
Yan Li
Regards, Yan Li

SQL Server services having stop

We're using SQL server 2008 r2 but having lot of issues. My application running on SQL server but it stop everyday. SQL services stop then my application automatic hang then i restart the server then after my application work.

Hi harigaurav,
If SQL Server Services stop regularly every day, then you can check the Start Mode for the services in SQL Server Configuration Manager, check the Windows Scheduler or use some monitor tools to monitor SQL Server services status.
If SQL Server Services always stop unexpectedly, we can configure SQL Server Agent to restart the SQL Server and SQL Server Agent services automatically. To configure automatic service restart:
Open the SQL Server Management Studio Management folder, right-click the SQL Server Agent entry, and select Properties.
On the General page, select the Auto Restart SQL Server If It Stops Unexpectedly check box.
Here, you should also select the Auto Restart SQL Server Agent If It Stops Unexpectedly check box.
Click OK.
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support

Windows Server 2012 Logical Disk Free Space (%) Low

I enabled the monitor "Windows Server 2012 Logical Disk Free Space (%) Low" and configured a low threshold to test. I started to get a bunch of warnings from servers, for example:
The disk \\?\Volume{ee0222ed-16de-40a5-af89-f95db3fdf5a4} on computer PC is running out of disk space. The value that exceeded the threshold is 11% free space.
Now I checked on the server, and all the disks have more than 11% free space. Additionally, I don't see any disks with such a name/guid.
When looking at the additional knowledge of the monitor, I see that it is using the following information:
Object Name: Logical Disk
Counter Name: PercentFree
My question is where is this disk coming from, and how can I avoid these disks from creating false alarms? When looking in the Windows Server
From my analyzing the DB, I see that these are the partitions on the server without a volume letter. Any way to avoid getting these discovered and/or alerts, without overriding each one?

Hi,
These "strange" disks are called mount points.
They get discovered by the "Mount Point Discovery Rule".
Go to your authoring => rules => search for the rule above and disable it.
If you want to remove all the instances in your environment you need to use Remove-SCOMDisabledClassInstance
powershell cmdlet.
More info on the cmdlet can be found here: http://technet.microsoft.com/en-us/library/hh920257%28v=sc.20%29.aspx
If you have any more questions please do not hesitate to ask
It's doing common things uncommonly well that brings succes. Check out my SCOM link blog:
SCOM link blog

Windows update KB2964444 broke Event Logging Service and SQL Agent Service on Windows Server 2008 R2

I got the following problem:
I discovered that on my Windows Server 2008R2 machine the event logging stopped working on 04/May/2014 at 03:15.
Also, SQL Agent Service won't run
The only change that day was security
update KB2964444 - Security
Update for Internet Explorer 11 for Windows Server 2008 R2for x64-based Systems, that was installed exactly 04/May/2014 at 03:00. Apparently, that's what broke my machine...
When I try to start Windows Event Log via net
start eventlog or via Services
panel, I get an error:
C:\Users\Administrator>net start eventlog
The Windows Event Log service is starting.
The Windows Event Log service could not be started.
A system error has occurred.
System error 2 has occurred.
The system cannot find the file specified.
I tried:
restarted the OS (virtual on the host's VMWare).
re-checked the settings in services menu -they are like in the link.
checked the identity in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog -
the identity is NT
AUTHORITY\LocalService
gave all Authenticated Users full access to C:\Windows\System32\winevt\Logs
ran fc /scannow - Windows Resource Protection did not find any integrity violations.
went to the file %windir%\logs\cbs\cbs.log -
all clean, [SR] Repairing 0 components
EDIT: Uninstalled the recent system updates and rebooted - didn't help
EDIT: Sysinternals Process Monitor results when running start service from services panel (procmon in elevated mode):
filters:
process name is svchost.exe : include
operation contains TCP : exclude
the events captured are:
21:50:33.8105780 svchost.exe 772 Thread Create SUCCESS Thread ID: 6088
21:50:33.8108848 svchost.exe 772 RegOpenKey HKLM SUCCESS Desired Access: Maximum Allowed, Granted Access: Read
21:50:33.8109134 svchost.exe 772 RegQueryKey HKLM SUCCESS Query: HandleTags, HandleTags: 0x0
21:50:33.8109302 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\Services REPARSE Desired Access: Read
21:50:33.8109497 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\Services SUCCESS Desired Access: Read
21:50:33.8110051 svchost.exe 772 RegCloseKey HKLM SUCCESS
21:50:33.8110423 svchost.exe 772 RegQueryKey HKLM\System\CurrentControlSet\services SUCCESS Query: HandleTags, HandleTags: 0x0
21:50:33.8110705 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS Desired Access: Read
21:50:33.8110923 svchost.exe 772 RegQueryKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS Query: HandleTags, HandleTags: 0x0
21:50:33.8111257 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\services\eventlog\Parameters SUCCESS Desired Access: Read
21:50:33.8111547 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services SUCCESS
21:50:33.8111752 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS
21:50:33.8111901 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
21:50:33.8112148 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services\eventlog\Parameters SUCCESS
21:50:33.8116552 svchost.exe 772 Thread Exit SUCCESS Thread ID: 6088, User Time: 0.0000000, Kernel Time: 0.0000000
NOTE: previoulsy, for
21:46:31.6130476 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
I also got NAME
NOT FOUND error ,so I created the new string value for the Parameters with
the name ServiceDll and
data %SystemRoot%\System32\wevtsvc.dll (copied
from the upper HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog key)
and this event now is
21:46:31.6130476 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
I also checked for the presence of wevtsvc.dll in
the place and it's there.
Also, I tried to capture all events with path containing 'event' and
got following events firing every several seconds:
21:38:38.9185226 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\Tag NAME NOT FOUND Length: 16
21:38:38.9185513 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\DependOnGroup NAME NOT FOUND Length: 268
21:38:38.9185938 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\Group NAME NOT FOUND Length: 268
Also, I tried to capture all the events containing 'file',
excluding w3wp.exe,
chrome.exe, wmiprvse.exe, wmtoolsd.exe, System and it shows NO attempts to access any file ih the time I try to start
the event logger (if run from cmd - there are several hits by net executable,
not present if run from the panel).
What can be done?

Hi,
I don’t found the similar issue, if you have the IE 11 please try to update system automatic or install the MS14-029 update.
The related KB:
MS14-029: Security update for Internet Explorer 11 for systems that do not have update 2919355 (for Windows 8.1 or Windows Server 2012 R2) or update 2929437 (for Windows 7
SP1 or Windows Server 2008 R2 SP1) installed: May 13, 2014
http://support.microsoft.com/kb/2961851/en-us
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Microsoft Windows Server DNS Monitoring v7.1.10100.0 High CPU Usage on Windows Server 2012 R2

Hello!
I've a big problem with this MP. When the zone monitoring is enabled (by default) the MonitoringHost.exe takes up all the CPU. I've put the zones in Maintenance mode.
I've got this problem only with a new Windows 2012 R2 server. Other Windows Servers (2003 R2, 2008 & 2008 R2) with DNS Server Role they don't have this problem.
Any ideas?
Thank you!
The configuration is:
SCOM 2012 R2
Microsoft Windows Server DNS Monitoring v7.1.10100.0 Management Pack
DNS Management Pack Action Account has been configured
"Act as proxy..." is enabled
The monitored server config:
Windows Server 2012 R2 (standalone)
DNS Server Role installed
DNS Management Pack Action Account is a member of the "Administrators" group
The only events I've are the following but I'm not sure if they're related (because of the ...DNSSEC...):
Log Name:      Operations Manager
Source:        Health Service Modules
Date:          8/11/2013 11:16:21
Event ID:      11903
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      NS2...
Description:
The Microsoft Operations Manager Expression Filter Module could not convert the received value to the requested type.
Property Expression: Property[@Name='QueriesResponded']
Property Value: Property[@Name='QueriesResponded']
Conversion Type: DataItemElementTypeInteger(5)
Original Error: 0x80FF005A
One or more workflows were affected by this.
Workflow name: Microsoft.Windows.Server.DNS.2012R2.Monitor.DNSSEC.NameResolutionQueries
Instance name: <zone-name> on NS2...
Instance ID: {4BCB4738-1287-2E6F-E0AA-1FF8D66DDB0B}
Management group: <grp-name>
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Health Service Modules" />
    <EventID Qualifiers="49152">11903</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-08T09:16:21.000000000Z" />
    <EventRecordID>9602</EventRecordID>
    <Channel>Operations Manager</Channel>
    <Computer>NS2...</Computer>
    <Security />
</System>
<EventData>
    <Data><grp-name></Data>
    <Data>Microsoft.Windows.Server.DNS.2012R2.Monitor.DNSSEC.NameResolutionQueries</Data>
    <Data><zone name> on NS2...</Data>
    <Data>{4BCB4738-1287-2E6F-E0AA-1FF8D66DDB0B}</Data>
    <Data>Property[@Name='QueriesResponded']</Data>
    <Data>Property[@Name='QueriesResponded']</Data>
    <Data>DataItemElementTypeInteger(5)</Data>
    <Data>0x80FF005A</Data>
</EventData>
</Event>

Glad to see you found the solution and thanks for your sharing.
Niki Han
TechNet Community Support

You cannot shadow a session with multiple monitors enabled in Windows Server 2008 R2

Searching through the forums (and according to KB2484290) it appears that there is no solution to this problem. We are rolling out thin clients that are using dual monitors exclusively and we were very surprised to find out that we couldn't shadow
sessions with dual monitors (which to us means that we can't shadow ANY sessions). This now completely changes our approach to managing these devices.
We are running Windows Server 2008 R2 SP1 with Remote Desktop Services installed. The thin clients are running Windows Embedded Standard 7 with the latest updates / RDP client. All steps have been followed to ensure that the apropriate settings and
permissions have been set up to allow access into the session.
We tested by unchecking the RDP setting “use all my monitors for the remote session”, with that setting disabled shadowing worked
Questions:
1. KB2484290 is from Dec 2010 - It's now April 2012, is there a workaround / hotfix for this issue that will allow us to shadow sessions using the native Microsoft tools?
2. Are there any recommended alternatives (software)? Free/Paid - doesn't matter we just need something that will work. I'm sure there are a few options out there but I am looking for suggestions for what people have used in the past that worked
best for them to help us narrow down the choices.

Hi,
In my experience, so far, the workaround is Remote Assistance, Remote Assistance supports multiple monitors, and is the presently recommended solution if you need this functionality. Remote Assistance is a Windows Server Feature that must be explicitly installed
on Windows Server 2008 R2; it is already installed with the client versions of the operating system.
More information:
Remote Assistance Overview
http://technet.microsoft.com/en-us/library/cc753881.aspx
Remote Assistance and Resulting Internet Communication in Windows Server 2008
http://technet.microsoft.com/en-us/library/cc770456(v=ws.10).aspx
As far as I know, there are some third-party tools can be used as the solution, such as Teamviewer, ISL Online, etc.
Please Note: The third-party products discussed here are manufactured by companies that are independent of Microsoft. We make no warranty, implied or otherwise, regarding
these products' performance or reliability.
Regards,
Dollar Wang
Forum Support
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Technology changes life……

Is there a way to change the Windows Update service startup type on Windows Server 2012 R2?

We have a number of newly built 2012 R2 servers that we have HP Operations Manager agent running on that monitors the status of several services and reports if they are "stopped". One of these services is Windows Update. Every day we
get at least one alert saying:
"Service "Windows Update" is not started. Current state is stopped"
Checking the event logs shows that the Windows Update service stops, then a while later it just starts again. Not an error, just an information event.
In Windows 2012 R2 the Windows Update service is set to "Automatic (Trigger Start)", where in previous versions we run (2012/2008R2) it would be set to just "Automatic" or "Automatic (Delayed Start)"
I have come to understand that this behaviour is normal for Windows 2012 R2, and that Trigger Start services by design stop themselves after a period of inactivity. I was unable to find any info on how this works. Our client would like this to
be changed and the Windows Update service stay running all the time, understanding that this impacts performance.
Is there a way to change the Windows Update service in Server 2012 R2 to the old Automatic startup behaviour so that it stays running all the time instead of stopping and starting periodicall? There is no option to do this via the services mmc
gui.
So far I have tried:
Removing the Triggers using the command: sc triggerinfo wuauserv delete
This works temporarily, the service then shows as just Automatic in the services console, however if you restart the server or restart the service it goes right back to being Automatic (Trigger Start).
Any kind of help would be appreciated.

This one might help.
Allow configuration of Automatic Updates in Windows 8 and Windows Server 2012
Regards, Dave Patrick ....
Microsoft Certified Professional
Microsoft MVP [Windows]
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Error the service FWSRV of TMG 2010 on Windows server 2008 R2 Enterprise

Please help me about a issue of TMG 2010:
My company installed TMG 2010 on Windows server 2008 R2 Enterprise but it happen error " Due to an unexpected error, the service fwsrv stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and
then start it again. Check for related error messages."
and " The Firewall service stopped because an application filter module C:\Windows\SYSTEM32\ntdll.dll generated an exception code C0000005 in address 0000000077A72F86 when function CompleteAsyncIO was called. To resolve this error, remove recently
installed application filters and restart the service."
I have reinstall but there error also appear again. My company use about 2000 clients access through TMG 2010.
i have try update windows and TMG latest but can not solved this issue.
i hope everyone help me as soon as. thank you so much.

HI Luis,
Not sure whether this will fix your issues however give it a try and let us know so that other can also provide suggestion.
Disable
Antivirus
Monitoring Tools / Hardware Diagnostics tools which comes with Server vendor
Try -
http://support.microsoft.com/kb/2649961
http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=2649961&kbln=en-us
Ensure you have enough space for Log to be stored

Monitor Windows server services in cloud

Similar Messages

Maybe you are looking for