At the moment I work at a company with about 8000 to 9000 workstations. A couple of users called in an issue that they had trouble logging in into Windows 7. Once in a while they got the following error message during the logon process.
"Windows could not connect to the Event Notification Service service. Please consult your System Administrator"
Only one or more reboot(s) seemed to bypass the error. This was not an acceptable situation and I was asked to look into this problem.
- Windows 2008 R2
- Window 7
- SCCM 2007 R2
- RES Workspace Manager 2011
- App-V 4.6 SP1
Underneath a screenshot of the error message:
After checking the event viewer I noticed that not only the "System Event Notification Service" was failing but also several other services failed to start. Underneath a list of services that are involved.
- Certificate Propagation
- Extensible Authentication Protocol
- Group Policy Client
- IKE and AuthIP IPsec Keying Modules
- IP Helper
- Multimedia Class Scheduler
- User Profile Service
- Task Scheduler
- System Event Notification Service
- Shell Hardware Detection
- Windows Management Instrumentation
With the knowledge that not only the "System Event Notification Service" service was failing to start I searched the web for a solution. I found several articles but they didn't solve my problem. Than I stumbled onto the following Hotfix:
This hotfix solved my problem. But in the meanwhile several users were still experiencing this problem. Due a backlog on the change management side, it would take a while to get this hotfix in production. I decided to look for a workaround for the customers who were experiencing this problem more frequently. It seemed, like described in the article, that the "Microsoft Virtualization client" had something to do with it. I quote:
"Cause: This issue occurs when a new drive is added to the system while background services are still starting. The most common example of this is with Microsoft Application Virtualization Client. When this service starts, it creates a virtual drive. When this drive is created during system startup, the Server service may crash the shared service host process. This process contains other services which are important for completing user logins. When these services fail at startup, a blue or black background image is displayed instead of the user’s desktop."
When trying to find a workaround I found that delaying the startup of the "Microsoft Virtualization Client" service seemed to work. This should give the other services time to start-up. It's a quick and dirty method but it did solve the problem for the users who were experiencing this problem on a frequent base. We decided to use it as a temporally workaround until the hotfix was applied.
The hotfix is also applicable for Windows Server 2008 R2 in case you are experiencing the same issues on a server.