"Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code." event is logged every 144 minutes.

Question

Hello,

I have been running Windows Server 2019 on Azure. After the recent windows update, the following events is logged every 144 minutes.

Log Name:      Application
Source:        Microsoft-Windows-Perflib
Date:          2023/04/24 6:38:54
Event ID:      1008
Task Category: None
Level:         Warning
Keywords:      
User:          NETWORK SERVICE
Computer:      
Description:
The Open procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed with error code Access is denied.. Performance data for this service will not be available.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Perflib" Guid="{13b197bd-7cee-4b4e-8dd0-59314ce374ce}" />
    <EventID>1008</EventID>
    <Version>1</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2023-04-23T21:38:54.200330700Z" />
    <EventRecordID>95427</EventRecordID>
    <Correlation />
    <Execution ProcessID="3336" ThreadID="1756" />
    <Channel>Application</Channel>
    <Computer></Computer>
    <Security UserID="S-1-5-20" />
  </System>
  <EventData>
    <Data Name="Service">BITS</Data>
    <Data Name="Library">C:\Windows\System32\bitsperf.dll</Data>
    <Data Name="Win32Error">5</Data>
  </EventData>
</Event>

Log Name:      Application
Source:        Microsoft-Windows-PerfNet
Date:          2023/04/24 6:38:54
Event ID:      2004
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      
Description:
Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-PerfNet" Guid="{CAB2B8A5-49B9-4EEC-B1B0-FAC21DA05A3B}" EventSourceName="PerfNet" />
    <EventID Qualifiers="49152">2004</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2023-04-23T21:38:54.267030100Z" />
    <EventRecordID>95428</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer></Computer>
    <Security />
  </System>
  <EventData>
    <Binary>220000C0</Binary>
  </EventData>
</Event>

How to fix these warning and error ?

Answer 1

To solve that different methods might apply here: Methods 01: 1.) Open a CMD via run as admin 2.) enter C:\Windows\system32\lodctr.exe /R and then C:\Windows\SysWOW64\lodctr.exe /R If you get the error “Error: Unable to rebuild performance counter setting from system backup store, error code is 2” repeat step 2. 3.) Now re-registers the computer´s performance libraries with the following (for more infos see): C:\Windows\System32\wbem\winmgmt.exe /RESYNCPERF C:\Windows\SysWOW64\wbem\winmgmt.exe /RESYNCPERF Methods 02: On some websites it is requested to use the PerfStringBackup.ini located in %systemroot%\system32. However this file do not include all performance counters. The reason here is that the PerfStringBackup.ini is created before an application added new performance counters. That means the file is never aktuell and therefore using this might cause issues with the performance counters! So please be careful if you use: %windir%\system32\lodctr /r: perfstringbackup.ini

Answer 2

Hi, I'd be happy to help you out with your question. Sorry for the inconvenience caused. To resolve this issue, I recommend that you follow these steps: Check the permissions on the C:\Windows\System32\bitsperf.dll file to ensure that the NETWORK SERVICE account has Read and Execute permissions. Run the following command in an elevated Command Prompt to rebuild the performance counters on the server: lodctr /r. Restart the Server service to see if that resolves the issue. If the issue persists, try running the System File Checker (SFC) tool to scan and repair any corrupted system files: sfc /scannow. If none of the above steps work, you may need to reinstall the performance counters. You can do this by running the following command in an elevated Command Prompt: unlodctr <service name>, then lodctr <service name>. Replace <service name> with the name of the service that is causing the error (in this case, "BITS" for the first error and "Server" for the second error). For more Information, please refer to following resource :- https://answers.microsoft.com/thread/dec76dc7-f99f-456e-a0f1-8c63c4fac730 Unable to open the Server service performance object. The first four bytes (DWORD) of the Data section contains the status code. - If you have any other questions or need assistance with anything, please don't hesitate to let me know. I'm here to help.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.