Messages about services failing to start

Networking failing to connect (or even startup)

Specific messages about the "workstation service" failing to start

Sometimes you will even get BSOD's

If you check your event viewer you will need to check all the event logs (System, Application, and Security). You may get a message from your event viewer program that the log is corrupt and it may ask you if you want to purge the log file to fix this. You should always try this first. If after purging the file the event viewer still fails to purge the log and it repeats this message about the log being corrupt; you will have to purge this file manually.

Due to the nature of NT's eventlog service being tied to other system related services, you cannot stop the eventlog from functioning and therefore cannot manipulate the eventlog files (located in \winnt\system32\config). These files are being used by the eventlog service and will not allow you to delete or rename the files while NT is running.

To get around this problem you can use NT's internal function to move files during the bootup process. These files to be moved are listed in the registry under: HKLM\current control set\control\session manager\pendingfilerenameoperations. You can change the values in here but it is not a user friendly interface and editing the registry is not the best way to do this especially in a remote troubleshooting situation. Make a copy of the corrupt event file so you can use it or look through it later if there is a need.

Warning: this procedure should not be done without very careful procedures and should be a last resort as it can cause your system to be left in an unbootable state.

Get a copy of the MS resource kit utility called mv.exe make sure it is for the platform you are working on (Intel or Alpha). type mv /? for a list of command line options. This utility will enter cause NT to schedule a file movement operation to run on the next reboot (great for use when you need to move in-use files). Typically you use this command to move a pre-existing file so if you are trying to replace an event log file you should use a text editor to create a blank file with the same name as the file you are about to replace. The three event log files are named: Appevent.evt, Secevent.evt, and Sysevent.evt. Create a temporary blank version of this file with the same name (in this example in the root of the S: drive). Then use the following syntax (can be run through RCMD if the mv.exe file is uploaded to the remote computer):

s:>\ mv /x /d s:\Appevent.evt s:\winnt\system32\config\Appevent.evt

[Result]

s:\Appevent.evt => s:\Winnt\system32\config\Appevent.evt [ok, will happen next reboot]

If you check your registry at: HKLM\current control set\control\session manager\pendingfilerenameoperations you will now see the added entry and can delete these entries if you make syntax errors on the command.

After rebooting the system the file will rebuild and you may need to access the event viewer and then reboot the server yet again before all the services begin to function properly again.