| Event Id | 7036 |
| Source | Service Control Manager |
| Description | Description 1.The Print Spooler service entered the running state. 2.The Windows Firewall/Internet Connection Sharing (ICS) service entered the stopped state. |
| Event Information | According to Microsoft : Cause 1: The specified service changed to the state indicated in the message. This message is logged for informational purposes only. Resolution : This is a normal condition. No further action is required. Cause 2.: This problem occurs if the Cpmmon.dll file causes the Print Spooler service to unexpectedly stop. The Cpmmon.dll file is installed by the Citrix MetaFrame XP 1.0 program. Resolution: To resolve this problem, obtain a hotfix from Citrix. Cause 3.: This problem may occur if certain Administrative Templates from the Windows XP Security Guide were applied to the computer before Windows XP SP2 was installed. The problem occurs because of a problem in some of the security templates that were published as part of the Windows XP Security Guide. In Windows XP SP2, remote procedure call (RPC) runs using the NT Authority\NetworkService account. The default security descriptor for services in Windows XP SP2 gives Read access to the Authenticated Users group, which includes the NT Authority\NetworkService account. Resolution: Method 1: Restore the default security descriptor for the SharedAccess service. Method 2: Restore the default SD for the SharedAccess services. Cause 4: A corrupted file in the policy store causes this problem. An interruption that occurs when the policy is being written to the disk may cause the corruption. Resolution 3: To resolve this issue, delete the following registry subkey and then rebuild the policy: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Local To do this, follow these steps. 1. Delete the local policy registry subkey. To do this, follow these steps: a. Click Start, click Run, type regedit, and then click OK. b. In Registry Editor, locate and then click the following subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local c. On the Edit menu, click Delete. d. Click Yes to confirm that you want to delete the subkey. e. Quit Registry Editor 2. Rebuild a new local policy store. This message from newsgroup may help you: -------------------------------------------------------------------------------- To resolve the DCOM error, create a folder "Network" in: C:\Documents and Settings\All Users\Application Data\Microsoft\ so the full path becomes: C:\Documents and Settings\All Users\Application Data\Microsoft\Network --------------------------------------------------------------------------------. |
| Reference Links | Event ID 7036 from Service Control Manager The Print Spooler service unexpectedly stops when Citrix MetaFrame XP 1.0 is installed on a computer that is running Windows Server 2003 or Windows 2000 Server You cannot start the Windows Firewall service in Windows XP Service Pack 2 You receive an error message when you try to open the IPSec MMC policy on a Windows Server 2003-based computer Event Id:7036 Source Id:Service Control Manager |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.