I was rebooting a remote server (Windows Server 2008 R2 Standard) over remote desktop and the session now shows the blue screen during the shutdown sequence, and the message "Please wait for the System Event Notification Service..."

It seems that everything is still running on the server (for instance, http://jeffhandley.com is still responding), but I need to get the machine to finish the reboot sequence.

How can I force the machine past this point? It's been stuck there for about 30 minutes.

  • Oh dear... after killing the process for SENS (System Event Notification Service), the server shut down immediately and now it won't boot. Uh oh... – Jeff Handley Dec 8 '10 at 7:48
  • do you have Windows Live Messenger installed on the server? That seems to be the culprit for this problem for a lot of people. – MattB Dec 8 '10 at 14:53

This was happening with me on 2012 R2 as well. So, For this you have to log in from another account with admin rights

  1. Start "Remote Desktop Services Manager"
  2. Identify the user ID in the Users tab
  3. In the Processes tab sort by ID Go down to the user ID
  4. Kill the winlogon.exe process with the user ID, session will be logged off
  5. Now you can log in again!

Original Article

To Stop this from happening again, see this article please wait for the system Event Notification service Problem. This article states:

Yes, the issue with this was related to SSMS trying to send telemtry data back to Microsoft, this was hanging and causing the process not to exit. The solution we went with was to disable the sending of telemetry all together using this registry key:

[HKEY_CURRENT_USER\Software\Microsoft\VisualStudio\Telemetry]Name = DisableSqmUploader


Data = 0000000


Either wait for it to finish (but obviously you don't want to) or take a shot at using PsService to find the executable name and PsKill to kill the process directly, letting the server continue rebooting.



  • Ended up just using task manager to find and kill the process. – Jeff Handley Dec 8 '10 at 6:57
  • Ah. Normally during shutdowns a new login isn't allowed, requiring remote tools. – Jeff McJunkin Dec 8 '10 at 8:11

As advised in the comments in this link, there's a problem with SENS. I couldn't run sc queryex successfully, so I took the (much more risky) method of killing every svchost.exe instance:

sc \server taskkill /IM svchost.exe /F

While it's slowly terminating these processes, I keep an eye on the Windows machine until it gets past this error message; then I stop taskkill.

Risky? Yes. You may kill the wrong service and hose your machine. I was stuck, so I had no other option.


This is how I fixed it:

1- logging in to the server using the psexec utility:

psexec \\ -u administrator -p pass cmd

2- Finding all of the running tasks:

tasklist /v

3- Finding all of the PID's of winlogons and killing them using the power-shell:

kill -id PidNumber

Blue Screen error often appears due to Memory dump issue or Problem in newly installed Hardware.

Check that RAM is not faulty or try changing RAM slot and boot your server.


If remove any newly installed hardware and check it.

also Windows 2008 has feature of Memory Diagnostics Tool you can check your Memory with this tool.

  • 1
    It wasn't a blue screen of death... it was the blue screen you see during the logoff / shutdown sequence. Thanks though. – Jeff Handley Dec 8 '10 at 7:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.