Please wait for the System Event Notification Service…

One of my customers that I provide level 3 support for recently contacted me with an issue where their system would hang on the message “Please wait for the System Event Notification Service…” when they attempted to logout of their Windows 2008 terminal server:

We determined that their terminal server had recently received an update to Windows Live Messenger via Windows Update that was causing this issue. Removing Windows Live Messenger from their terminal server resolved their logout issues.



  1. Jeff Fogel

    The system event notifacation issue isn’t an issue with Windows Live messenger… Read below on what I have found.

    The fix for this issue is very simple.

    First we will examine what causes the issue to begin with. The cause is the COM+ Event Service detects a bad code and hangs. When you go to services.msc you won’t see the service hang but believe me it is. If you try to stop the server you will then see it hang and you won’t be able to get it back started. You can’t kill the process via taskmgr because its a svchost.exe service so you’ll never know which one to kill unless you download a little program call Processor Explorer from Sysinternals.

    1. Open Eventviewer and select Application and filter the list so all you see are Error logs

    2. Scroll through al Error logs till you come to one EventSystem (EventID=4621) (The COM+ Event System could not remove the EventSystem.EventSubscription object {C986B80D-E6CE-4FB0-9A44-F19BF27C165A}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The HRESULT was 800706be.)

    3. Ok now open Process Explorer and sort by process name

    4. Find the list of svhost.exe and start right clicking each and selecting Properties.

    5. After hitting Properties on each services make sure you are selecting the Services tab and look for the svchost.exe process that has the EventSystem service which its display name is COM+ Event System

    6. Now close the box and right click on the svchost.exe process and select Restart

    7. Instantly once the service shuts down and restarts you will notice in your taskmgr that the users that were hung are now gone and they can now login and logout as they please

    8. There are some services that won’t start back up after restarting this service so make sure you go back into services.msc and sort services by automatic and start up the ones that aren’t running.

    This should resolve your issue until you get another SystemEvent error in Event View, but then just follow these steps and you are fine. The greatest thing about this fix is it doesn’t requrie a reboot like all the millions of thread out there about this issue, because the issue isn’t resolved by a reboot.

    I am definately interested in hearing if this has worked for you so please let me know.

  2. graham ross

    Hi Mike,
    We’ve had the same issue and have found a different way to resolve the issue which doesn’t require a server reboot.
    Start Remote Desktop Services Manager
    Identify the user ID in the Users tab
    In the Processes tab sort by ID
    Go down to the user ID and end the winlogon.exe process
    the user session will be logged off
    A server reboot will probably be beneficial at the end of the day

    • ziwarfani

      below method worked for me too. thanks,

      Start Remote Desktop Services Manager
      Identify the user ID in the Users tab
      In the Processes tab sort by ID
      Go down to the user ID and end the winlogon.exe process
      the user session will be logged off
      A server reboot will probably be beneficial at the end of the day

    • Hoden-Fürst

      Thanks Graham 🙂

    • c

      ****************Didn’t Work***************

      As soon as we did this and try to access we server went blank and rebooted(Which fixed the issue)
      Logs indicated we had a freaking server crash………
      I wont recommend this method unless you want unpleasant surprises…….
      Restarting the server at night (less activity) seems to be the best option.

  3. Shawn Mortensen

    Graham, you are my hero, nothing work, but your suggestion did 🙂 Thank you!!

  4. Himanshu

    Thanks Graham…your solution is still working in 2013. Cheers

  5. Abbi Gail Bianca Durias

    mine is different. after i restart my laptop, it neve opens back. i can’t follow your advices since none of the programs opened.. it’s just the message that keeps on saying “Please wait for the System Event Notification Service…” and I spent the whole night waiting for it. up until now it is loading and I can’t do anything.. 🙁

  6. random701

    Here is how I got around it. From a command prompt on my PC or another computer on the domain I ran this to find out the PID of the svchost.exe associated with SENS

    sc \servername queryex SENS

    Then I kill that process with this command

    taskkill /S servername /PID xxxx /F

    where xxxx is the PID from the first command.

    Now I can connect to the server with RDP and I didn’t have to restart the server.

    Obviously this is not a fix for the actual problem, but it lets you log on to your server.

  7. Gusac

    Problem with random701’s solution is that the sc command will give the PID of svchost.exe process which host several other services too. they are:

    Appinfo, AppMgmt, BDESVC, BITS,
    CertPropSvc, EapHost, gpsvc, IKEEXT,
    iphlpsvc, LanmanServer, MMCSS, ProfSvc
    RasMan, Schedule, seclogon, SENS,
    SessionEnv, ShellHWDetection, Themes,
    Winmgmt, wuauserv

    So, question is, if you are willing to kill so many services, why not reboot it manuaally and GRACEFULLY using shutdown command?

  8. Al

    Did anyone ever truly resolve this issue? I am having it on Server 2012 Standard.

  9. Gwen

    I’m seeing it on a 2012R2 installation now.

  10. Graceson Mathew C

    My prob

    Killing the svhost process worked for me as well,

    step 1 : get the command prompt though different user or using psexec
    type : sc queryex sens
    step 2 :find the PID.

    Step 3 : run taskkill /PID

  11. jahs1980

    The other posted techniques did not resolve my issue. I had Windows Server 2012 that did not shut down and/or reboot. I have a USB 3.0 connected external drive where connectivity to it became unstable. All attempts to shutdown/reboot the server were futile. After scouring the web and finding nothing that resolved the issue I called Microsoft. The following registry changes “truly resolved” my issue. I hope and would love to know if this helps anyone else. That was done approximately 3 weeks ago and the server is absolutely reliable in every regard. Best practices – make a copy of the registry and/or entries before making changes. All of Microsoft’s proposed changes are being posted as it may be relevant for someone else.

    1. Checked the value of (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management) ClearPageFile at Shutdown
    Value is already 0 – so did not make any changes here.

    2. Took backup and changed the value of the below registry key:
    HKLM >> system >> current control set001>> select control >> WaitToKillServiceTimeout >> Change the value from 5000 to 500.

    3. Rebooted the server.

    • tulsianiprashantshant

      Hey Guys,

      does anyone found the solution from Microsoft… am facing the same issue with Windows 2008 R2 with Exchange 2010 running… Hard Reboot works but that’s a workaround not the solution… does Microsoft provide any hotfix for this???

      don’t have any messenger installed on in (msn, yahoo or lync)… received the Comp+ warning in event viewer he COM+ Event System timed out attempting to fire the Logoff method on event class {D5978650-5B9F-11D1-8DD2-00AA004ABD5E} for publisher and subscriber . The subscriber failed to respond within 180 seconds. The display name of the subscription is “Explorer”.

      also the below registry key doesn’t worked for me
      HKLM >> system >> current control set001>> select control >> WaitToKillServiceTimeout >> Change the value from 5000 to 500.

      Thanks in advance!

  12. Ivan Bauer

    Almost 2015 and we are still facing this problem. Thank you, Microsoft!

  13. William

    Do any one here have the solution ?

    Thank you,

  14. Prabhat

    Thanks a lot, Graham.
    Your method just worked absolutely fine without rebooting the server.
    Thanks, again.

  15. jpxdude

    How does one solve this problem with Windows 2008 Standard? RDSM doesn’t exist, as it still uses Terminal Services! Plagued with this issue for a while now, and won’t go away. Have attempted command line taskkill for the PID, but not working. Any help much appreciated.

  16. zack

    This is a privacy issue. Microsoft doesn’t need to know everytime to shut down your computer. Call your Congressman is the solution for the illegal activity by M$.

  17. Tmac

    Well not it’s 2016 and just got this error, luckily server is in AWS so a hard shutdown and restart fixed the issue. it is a terminal server and i got this error when logging out of my session via my user name. I was able to then log in as administrator kill the svchost but after doing so the server crashed and i couldn’t ping it or remote to it any longer. A shut down in AWS and restart worked, problem is for how long!!! Microsoft really needs to get their **** together on this…

  18. Syed

    I’ve got this error yesterday. I wanted to restart my Cluster Node, then this Message did appear. I was waiting for like 30mins and watched the server with ping “IP-Adress” -t . Then after 34mins i was able to connect again the Node.

    Well its confusing, when your Servers are in the Datacenter and you are thinking, if you should go and manually shutdown the servers.

    Well i’d recommend you should wait for like 30mins, until you go and manually restart your servers 🙂 and don’t panic like me.

    Best Regards

    PS: Sorry for my bad english 🙂

    IT-Guy from Switzerland

  19. Danny9

    For me, I disable the service “Windows Search”, and this solved my problem of “Please wait for the System Event Notification Service”, it shut down without hang now.

    • Cincolo

      Did you figure out the cause of this? It just happened to my customer’s server last night. Is it still happening? How did you disable the Windows Search when the screen was stuck on the message, or did you reboot the server and then disable the service? I’m not in front of the server (I access it remotely) and am waiting to hear back from my customer to see what she sees on the screen.

  20. Shalaw


    Well done , it’s working for me.


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: