Please wait for the System Event Notification Service…

One of my customers that I provide level 3 support for recently contacted me with an issue where their system would hang on the message “Please wait for the System Event Notification Service…” when they attempted to logout of their Windows 2008 terminal server:

We determined that their terminal server had recently received an update to Windows Live Messenger via Windows Update that was causing this issue. Removing Windows Live Messenger from their terminal server resolved their logout issues.

µ

About Mike Robbins

PowerShell Enthusiast | IT Pro | Winner of the Advanced Category in the 2013 PowerShell Scripting Games | Author of Chapter 6 in the PowerShell Deep Dives Book.
This entry was posted in Windows Server 2008. Bookmark the permalink.

14 Responses to Please wait for the System Event Notification Service…

  1. Jeff Fogel says:

    The system event notifacation issue isn’t an issue with Windows Live messenger… Read below on what I have found.

    The fix for this issue is very simple.

    First we will examine what causes the issue to begin with. The cause is the COM+ Event Service detects a bad code and hangs. When you go to services.msc you won’t see the service hang but believe me it is. If you try to stop the server you will then see it hang and you won’t be able to get it back started. You can’t kill the process via taskmgr because its a svchost.exe service so you’ll never know which one to kill unless you download a little program call Processor Explorer from Sysinternals.

    1. Open Eventviewer and select Application and filter the list so all you see are Error logs

    2. Scroll through al Error logs till you come to one EventSystem (EventID=4621) (The COM+ Event System could not remove the EventSystem.EventSubscription object {C986B80D-E6CE-4FB0-9A44-F19BF27C165A}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The HRESULT was 800706be.)

    3. Ok now open Process Explorer and sort by process name

    4. Find the list of svhost.exe and start right clicking each and selecting Properties.

    5. After hitting Properties on each services make sure you are selecting the Services tab and look for the svchost.exe process that has the EventSystem service which its display name is COM+ Event System

    6. Now close the box and right click on the svchost.exe process and select Restart

    7. Instantly once the service shuts down and restarts you will notice in your taskmgr that the users that were hung are now gone and they can now login and logout as they please

    8. There are some services that won’t start back up after restarting this service so make sure you go back into services.msc and sort services by automatic and start up the ones that aren’t running.

    This should resolve your issue until you get another SystemEvent error in Event View, but then just follow these steps and you are fine. The greatest thing about this fix is it doesn’t requrie a reboot like all the millions of thread out there about this issue, because the issue isn’t resolved by a reboot.

    I am definately interested in hearing if this has worked for you so please let me know.

    jefffogel1974@hotmail.com
    Thanks
    Jeff

  2. graham ross says:

    Hi Mike,
    We’ve had the same issue and have found a different way to resolve the issue which doesn’t require a server reboot.
    Start Remote Desktop Services Manager
    Identify the user ID in the Users tab
    In the Processes tab sort by ID
    Go down to the user ID and end the winlogon.exe process
    the user session will be logged off
    A server reboot will probably be beneficial at the end of the day
    Regards
    Graham

  3. Shawn Mortensen says:

    Graham, you are my hero, nothing work, but your suggestion did :) Thank you!!

  4. Himanshu says:

    Thanks Graham…your solution is still working in 2013. Cheers

  5. Abbi Gail Bianca Durias says:

    mine is different. after i restart my laptop, it neve opens back. i can’t follow your advices since none of the programs opened.. it’s just the message that keeps on saying “Please wait for the System Event Notification Service…” and I spent the whole night waiting for it. up until now it is loading and I can’t do anything.. :(

  6. random701 says:

    Here is how I got around it. From a command prompt on my PC or another computer on the domain I ran this to find out the PID of the svchost.exe associated with SENS

    sc \servername queryex SENS

    Then I kill that process with this command

    taskkill /S servername /PID xxxx /F

    where xxxx is the PID from the first command.

    Now I can connect to the server with RDP and I didn’t have to restart the server.

    Obviously this is not a fix for the actual problem, but it lets you log on to your server.

  7. Gusac says:

    Problem with random701’s solution is that the sc command will give the PID of svchost.exe process which host several other services too. they are:

    Appinfo, AppMgmt, BDESVC, BITS,
    CertPropSvc, EapHost, gpsvc, IKEEXT,
    iphlpsvc, LanmanServer, MMCSS, ProfSvc
    RasMan, Schedule, seclogon, SENS,
    SessionEnv, ShellHWDetection, Themes,
    Winmgmt, wuauserv

    So, question is, if you are willing to kill so many services, why not reboot it manuaally and GRACEFULLY using shutdown command?

  8. Al says:

    Did anyone ever truly resolve this issue? I am having it on Server 2012 Standard.

  9. Gwen says:

    I’m seeing it on a 2012R2 installation now.

  10. Graceson Mathew C says:

    My prob

    Killing the svhost process worked for me as well,

    step 1 : get the command prompt though different user or using psexec
    type : sc queryex sens
    step 2 :find the PID.

    Step 3 : run taskkill /PID

  11. jahs1980 says:

    The other posted techniques did not resolve my issue. I had Windows Server 2012 that did not shut down and/or reboot. I have a USB 3.0 connected external drive where connectivity to it became unstable. All attempts to shutdown/reboot the server were futile. After scouring the web and finding nothing that resolved the issue I called Microsoft. The following registry changes “truly resolved” my issue. I hope and would love to know if this helps anyone else. That was done approximately 3 weeks ago and the server is absolutely reliable in every regard. Best practices – make a copy of the registry and/or entries before making changes. All of Microsoft’s proposed changes are being posted as it may be relevant for someone else.

    1. Checked the value of (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management) ClearPageFile at Shutdown
    Value is already 0 – so did not make any changes here.

    2. Took backup and changed the value of the below registry key:
    HKLM >> system >> current control set001>> select control >> WaitToKillServiceTimeout >> Change the value from 5000 to 500.

    3. Rebooted the server.

Leave a Reply