I have a group of servers which all show these symptoms. Every 2-7 days twice in a row, the following error shows up in the Application event log:

Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.

The first four bytes are 34 00 00 C0. Event ID is 2004.

Googling for this always leads to this document on the Microsoft site:


However, it claims that to resolve the issue one has to "Restart the Server service".

The "Server" service is always running and to my knowledge has never ever not worked on any of those servers.

Any ideas?

  • 1
    What is the output of net statistics server and net statistics workstation? – ErikE Nov 28 '13 at 21:13
  • 1 sessions ccepted, everything else 0. Statistics since the event last happened. Apparently the Server service restarted at that exact time. – Andrew J. Brehm Nov 29 '13 at 8:08
  • 1
    What OS/archictecture are these servers? – bentek Jul 6 '15 at 19:00
  • I'd suspect a 3rd party app/service that's not using/reporting performance counters properly. Is it possible to boot one server with all non-builtin services disabled, and slowly adding them back one by one to isolate the issue? – strongline Jul 7 '15 at 14:59
  • Is there some sort of backup/snapshot event that takes place on the server around these times? Perhaps a check for security or other updates? – Matt Jul 14 '15 at 2:18

When looking into this there seem to be two different things that can cause this problem.

Your running sharepoint in which case the recommendation is to update sharepoint if possible or try and rebuild performance counters.

There is some application that need to collect network performance data. To collect this data the account running this application need to be lcoal administrator on the server or it will not get access and this error will show up in event log.


Here's an MS hotfix: https://support.microsoft.com/en-us/kb/2733563

Are these Servers all VMs or imaged from the same one image? You may need to resolve the issue and build a new image to use moving forward if so.

I'd also run an SFC /SCANNOW on one of the machines and then look over the log afterward to see if there's anything in there that points to some fix.


It may be an x86/x64 issue with WMI performance counters with some application that doesn't utilize the appropriate CPU architecture the Server OS is but perhaps the hotfix resolves that issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.