NLASVC Event 7011

On our windows 2008 terminal servers i experience logon problems. Sometimes the logon time takes about 10 seconds wile other times it can take up more than 50 seconds only showing an rotating welcome.

i found out that when this problem occurs there is an event loged that sais that the nlasvc didn't response for more than 30 seconds. See the event below.

Log Name:      System
Source:        Service Control Manager
Date:          5/25/2009 9:31:48 PM
Event ID:      7011
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NlaSvc service.
Event Xml:
<Event xmlns="">
    <Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7011</EventID>
    <TimeCreated SystemTime="2009-05-25T19:31:48.000Z" />
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Security />
    <Data Name="param1">30000</Data>
    <Data Name="param2">NlaSvc</Data>

I can't find any solution for this problem, hope someone can help me with this isseu.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

As you NlaSvc is the Network Location Awareness service which collects and stores network configuration information such as IP addresses, Workgroup and/or Domain name changes (if your PC is connected to a Windows network), as well as Location change information, and which notifies applications when this information changes so that they in turn adapt to the computer's connectivity changes.

As far as i remeber there was a issue related to TrendMicro Antivirus which affected NlaSvc:

Basically, TrendMicro detects nlasvc.dll as a virus and quarantined it.
rtjdamenAuthor Commented:
This is not the isseu because we do not use this antivirus solution. I think i allready found the cause of this problem. however i can't find a solution for this problem.

The problem is that the lsm.exe service is growing day by day on memory usage. After a couple of days the service uses more then 200mb of memory wich makes everything real slow. I checked the internet for a cause but i found only a small group of users experiencing the same problem. I am testing on the moment. The strange thing is that the service grows even if there are no users logged on during the night. Some times it doesn't grow att all. Sometimes alle my servers have the problem, some days later only one or 2 servers have the problem. Real strange would be very happy if someone can help me on this.
what ServicePack you have installed on W2k8 TS?
Maybe you can try SP2 of Windows 2008 which has been released last month, i think.
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

rtjdamenAuthor Commented:
I allready tried this, i think it has to do with some of the installed applications on the server. anyone has an idea how i can monitor wich application is putting this memory in use?
200mb of what kind of memory? Commitable memory, Paged or Non Paged Pool memory?
rtjdamenAuthor Commented:
i'm not shure, what i see is that the task manager shows about 200mb of memory usage. I think this is commited memory?
Post a screenshot please......Of the Services and the performance tabs.....
rtjdamenAuthor Commented:
I will post, i saw this message to late because of an holiday. Tomorrow when the service growed i will add screenshot. Thanks a lot for the help.
I think that 200MB memory that rtjdamen mentioned is the private working set of the lsm.exe.  That is the default memory usage that you can see from task manager.

I also have a terminal server farm that runs Windows 2008 with SP2 and experiencing the similar issue, freezing from time to time and seeing the same events on the event logs at the moment of freezing.  Would be interested in seeing if you guys can come up with something.
We are getting the exact same error and are having to reboot every other night.  I've yet to find anything online about a fix for this.  This server has only 4 users logged on in the attched file.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Jian An LimSolutions ArchitectCommented:
this is a known issue where i have a server also experience it.

Usually if you have re-direction of shell in your group policy.

Microsoft ackonwledged it and will have a patch ETA 11/27.
rtjdamenAuthor Commented:
not resolved
I havea very similar issue... When i try to remote desktop it gets stuck at the welcome screen and never goes through...

When i try to logon locally, i press ctrl-alt-del and then the logon screen never comes up. After a few minutes it just asks me to press ctrl -alt-del again...

I got the error above on my event viewer first then over and over again (until i forced shutdown and restarted)

also seems to be 30sec apart for this message also

A timeout (30000 milliseconds) was reached while waiting for a transaction response from the CryptSvc service.

I've had the same problem and found the cause.
When you are using Windows server 2008 (or R2) and you use a Windows server 2003 terminal services manager to control your Server 2008 machines the LSM.EXE start growing until it crashes. It took me a long long time to find out the cause. But for me this was the solution. I contacted my collegeaus and told them to stop using server 2003 terminal services manager and to start using remote desktop services manager and ever sincen it stopped growing (LSM.exe) and the problem never occured.

I hope this is also the solution for you guys because I know what a pain in the ass this problem is!

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.