Do I Need Portable Device Enumerator Service

Frequent Event ID 7036 - The Portable Device Enumerator Service service entered the stopped/running state.

Archived Forums

Windows Server General Forum

Question
0

Sign in to vote

Windows 2008 R2, soledomain controller, latest patches applied

Every five minutes the Portable Device Enumerator service is starting. The sequence of events is:

11:52:39 am Upshot ID: 1502 - "The Grouping Policy settings for the figurer were candy successfully. New settings from 2 Grouping Policy objects were detected and practical."

xi:52:40Event ID7036 "The Portable Device Enumerator Service service entered the running country."

eleven:54:40 Event ID 7036 "The Portable Device Enumerator Service service entered the stopped state."

Typically an external USBhard drive is plugged into the server for backup purposes.

The Group policy for the domain and for the domain controllers are nigh completely untouched from default. (have merely password policy altered)

What is causing the Portable Device Enumerator service to keep starting and stopping?

Wed, Jan 12, 2011 12:07 AM

Answers

0

Sign in to vote

Hi,

The Portable Device Enumerator Service enforces group policy for removable mass-storage devices. Enables applications such equally Windows Media Player and the Image Import Wizard to transfer and synchronize content using removable mass-storage devices.

You may cheque if whatever grouping policy is enabled regarding removable mass-storage devices or Windows Media Player is tried to synchronize with removable mass-storage devices.

In addition, I would like to propose you lot test the issue in Make clean Boot to check if there is whatsoever tertiary party software conflicts.

Examination the event in Clean Boot

=================

1. Click "Kickoff", click "Run", type "msconfig" (without the quotation marks) in the Open box, and then click OK.

2. On the "Full general" tab, click "Selective Startup", and then clear all of the subsequent check boxes. You will not be able to articulate the Use Original Kicking.INI cheque box.

3. Click "OK", and and then click "Restart" to restart your computer.

iv. After Windows starts, determine whether the outcome reoccurs.

Y'all may also use Process Monitor to monitor the process trying to call Portable Device Enumerator Service.

Procedure Monitor v2.93

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Regards,

Please think to click "Mark equally Reply" on the mail that helps you, and to click "Unmark every bit Answer" if a marked post does not actually answer your question. This tin be beneficial to other community members reading the thread.
- Marked as answer by Arthur_LiMicrosoft contingent staff Monday, Jan 17, 2011 viii:31 AM
Wednesday, January 12, 2011 8:20 AM
0

Sign in to vote

hi

You can attempt disable the service if you practice not want your media histrion to perform actions similar synchronizing or importing images.
- Marked every bit reply past Arthur_LiMicrosoft contingent staff Monday, January 17, 2011 8:31 AM
Wednesday, January 12, 2011 8:45 AM
0

Sign in to vote

Thank you both for your replies which set me on the correct path to solving it.

I disabled the service every bit suggested only was still left with the Group Policy leaving an outcome every five minutes. Although the Group Policy on a domain controller does become applied every five minutes information technology does not normally leave an event.

Using RSOP.msc I found errors in

computer configuration\windows settings\security settings\ local policies\ user rights assignment

These errors happened where ever DefaultAppPool and WdiServiceHost was used in the policy. I removed DefaultAppPool and WdiServiceHost and replaced them with "IIS AppPool\DefaultAppPool" and "NT Service\WdiServiceHost"

Its got something to practise with a known error in Windows 2008 R2. These sites were helpful:

http://social.technet.microsoft.com/Forums/en-Us/winserverDS/thread/7bfe1f02-bb8b-472f-9c27-90d3481f2c53

and

http://acquire.iis.net/folio.aspx/624/awarding-pool-identities/

I volition allow the server run over the weekend and see what happens. I will also enable the service and see if the trouble goes abroad.

thanks for your aid to date.

10
- Marked as respond past Arthur_LiMicrosoft contingent staff Monday, January 17, 2011 8:31 AM
Friday, January 14, 2011 2:36 AM

All replies

0

Sign in to vote

How-do-you-do,

The Portable Device Enumerator Service enforces group policy for removable mass-storage devices. Enables applications such equally Windows Media Role player and the Image Import Wizard to transfer and synchronize content using removable mass-storage devices.

Y'all may check if whatever grouping policy is enabled regarding removable mass-storage devices or Windows Media Player is tried to synchronize with removable mass-storage devices.

In addition, I would like to suggest yous test the issue in Clean Kicking to check if there is any third party software conflicts.

Test the issue in Clean Boot

=================

ane. Click "First", click "Run", type "msconfig" (without the quotation marks) in the Open box, then click OK.

two. On the "General" tab, click "Selective Startup", and then articulate all of the subsequent check boxes. You will not be able to clear the Utilise Original Boot.INI bank check box.

iii. Click "OK", and then click "Restart" to restart your reckoner.

four. Later on Windows starts, determine whether the issue reoccurs.

Y'all may likewise use Process Monitor to monitor the process trying to call Portable Device Enumerator Service.

Process Monitor v2.93

http://technet.microsoft.com/en-u.s.a./sysinternals/bb896645.aspx

Regards,

Please think to click "Mark equally Answer" on the postal service that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be benign to other customs members reading the thread.
- Marked as answer by Arthur_LiMicrosoft contingent staff Monday, Jan 17, 2011 8:31 AM
Midweek, Jan 12, 2011 8:xx AM
0

Sign in to vote

hi

Y'all tin try disable the service if you do non desire your media player to perform actions like synchronizing or importing images.
- Marked every bit answer by Arthur_LiMicrosoft contingent staff Monday, January 17, 2011 viii:31 AM
Wednesday, Jan 12, 2011 8:45 AM
0

Sign in to vote

Give thanks you both for your replies which set up me on the correct path to solving information technology.

I disabled the service equally suggested but was still left with the Grouping Policy leaving an result every 5 minutes. Although the Group Policy on a domain controller does go practical every 5 minutes it does not normally leave an issue.

Using RSOP.msc I found errors in

computer configuration\windows settings\security settings\ local policies\ user rights consignment

These errors happened where ever DefaultAppPool and WdiServiceHost was used in the policy. I removed DefaultAppPool and WdiServiceHost and replaced them with "IIS AppPool\DefaultAppPool" and "NT Service\WdiServiceHost"

Its got something to do with a known error in Windows 2008 R2. These sites were helpful:

http://social.technet.microsoft.com/Forums/en-United states of america/winserverDS/thread/7bfe1f02-bb8b-472f-9c27-90d3481f2c53

and

http://learn.iis.net/page.aspx/624/awarding-pool-identities/

I will let the server run over the weekend and see what happens. I will as well enable the service and see if the problem goes away.

cheers for your help to date.

10
- Marked equally reply by Arthur_LiMicrosoft contingent staff Monday, January 17, 2011 8:31 AM
Friday, January 14, 2011 two:36 AM
0

Sign in to vote

Glad to hear that :)

Friday, January 14, 2011 3:12 AM
0

Sign in to vote

Alibi me, please while I ask an innocent, if uninformed question.

I have a standalone Win vii auto that never goes wireless, all patches applied, etc. At that place is not and never has been whatsoever grouping policy practical. I had an experience of putting a flash drive in, copying a fairly large pdf, which went quickly and without incident. When I so copied a very small .png file, from the same folder on my hard drive, information technology took a VERY long time. When I looked at the details, I saw something that seemed to mean that some mechanism was enumerating the things on the flash drive.

When I went to the event log(s) for the moment this occurred, I saw this entry: "The Portable Device Enumerator Service service entered the running state."

The whole thing smelled weird to me. Tin can anyone tell me why there is such a thing as a Portable Device Enumerator Service? Thanks then much.

Friday, December 9, 2011 5:54 PM

Effect ID 7036

This issue is recorded for several services when the computer is powered on. The reason for this is that diverse services may perform certain tasks at startup and once done they will cease by themselves. In this case, the 7036 event is accompanied by the corresponding 7035 (recorded when the service enter the "running land").

Description: In my case I got this event with an error message The Portable Device Enumerator Service service entered the stopped state.

After I take googled some time, I got following suggestion for this issue

The Portable Device Enumerator Service enforces group policy for removable mass-storage devices. Enables applications such as Windows Media Player and the Image Import Wizard to transfer and synchronize content using removable mass-storage devices.

You may check if any group policy is enabled regarding removable mass-storage devices or Windows Media Thespian is tried to synchronize with removable mass-storage devices.

In addition, I would like to suggest you test the outcome in Clean Boot to check if there is any third party software conflicts.

Test the result in Clean Boot
=================
1. Click "Offset", click "Run", blazon "msconfig" (without the quotation marks) in the Open up box, and and so click OK.
ii. On the "General" tab, click "Selective Startup", and then articulate all of the subsequent check boxes. You volition not exist able to clear the Employ Original BOOT.INI bank check box.
3. Click "OK", and then click "Restart" to restart your computer.
4. After Windows starts, determine whether the issue reoccurs.

You may also utilise Process Monitor to monitor the process trying to call Portable Device Enumerator Service.

Cheque these linkshttp://social.technet.microsoft.com/Forums/windowsserver/en-US/fa81faad-b02b-470f-b3f6-d46e50c10720/frequent-event-id-7036-the-portable-device-enumerator-service-service-entered-the-stoppedrunning?forum=winservergen

http://www.eventid.cyberspace/display-eventid-7036-source-Service%20Control%20Manager-eventno-1529-stage-1.htm

xiv Replies

· · ·

Serrano

May xv, 2014 at 13:45 UTC

Windows Updates?

Did you say that the actual server shuts down or the RDS Service shuts down?

· · ·

Poblano

Caoibhin May 15, 2014 at 13:l UTC

Windows updates are disabled on the server..... :/

The RDS service I presume is shutting downwardly. The server logs the users off and they tin can log back in virtually directly away

· · ·

Jalapeno

jonv72 May 15, 2014 at thirteen:54 UTC

Hi at that place are settings in group policy which control how long users can stay connected.

If they are all starting work at the same time, this could be the effect?

It's under Estimator Configuration/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Session Time Limits

There is an option there for Set time limit for active Remote Desktop Services sessions

· · ·

Poblano

Caoibhin May 15, 2014 at 13:59 UTC

Hi Jon,

I checked and time limit for active sessions is set to never.

I also checked Ad and the under the sessions tab all settings are set to never also

· · ·

Jalapeno

jonv72 May fifteen, 2014 at xiv:00 UTC

Weird. This is nether the local GP settings on the actual machine right?

· · ·

Jalapeno

jonv72 May 15, 2014 at 14:01 UTC

Have y'all taken a look at scheduled tasks to bank check that in that location aren't any rogue logoff scripts being triggered?

· · ·

Thai Pepper

Nazih Haddad This person is a Verified Professional

May 15, 2014 at 14:02 UTC

CedarsHost is an It service provider.

weird. Since your server is not showing whatever faulty logs have you tried to run wireshark during that time and watch the traffic ?

· · ·

Jalapeno

bhempstead May xv, 2014 at 14:06 UTC

Practise you have any scheduled tasks on the server or network? The result reoccurring at the exact time daily makes me think a network event may be interfering with RDS session host connectivity or service.

· · ·

Poblano

Caoibhin May 15, 2014 at 14:06 UTC

Jon

Yes this is on the actual server. Also I take disabled any tasks on the server.

Nazih

That is going to be my side by side stop. I merely idea someone may take came across the same event

· · ·

Jalapeno

jonv72 May 15, 2014 at 14:16 UTC

Just a thought merely besides look at the aforementioned settings mentioned above under the User Configuration:

ie User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

The session limit tin apparently also exist ready at an individual user level under Local Users and groups, merely if this is happening with domain accounts I doubt that would exist an issue.

· · ·

Poblano

Caoibhin May fifteen, 2014 at xiv:19 UTC

Checked with user configuration, nothing is configured and the domain GPO is set to never also

· · ·

Jalapeno

jonv72 May 15, 2014 at 14:28 UTC

Possibly grasping at straws but have you also checked the configuration in the Session Host configuration?

Right click on the RDP connection, properties, Sessions tab. Check that the Override user settings options aren't ticked.

Other than that I'm out of ideas... every bit above possibly an external network event leading to the loss of the connection.

· · ·

Poblano

Caoibhin May fifteen, 2014 at xiv:forty UTC

The override options were ticked when I checked. I will check again tomorrow and see if we have the event. I'll also run wireshark to see.

· · ·

Poblano

Caoibhin May 29, 2014 at 09:12 UTC

We figured out what the issue was. The DSL modem for the site was installed @ i:33PM on the site in question in Germany. As role of a daily routine German Telecom reset all DSL connections every 24Hrs apparently. And so we rebooted the modem late in the evening and havent had the event since. The connection withal drops but at night so the users are not afflicted..... Thanks for the aid guys

This topic has been locked by an administrator and is no longer open for commenting.

To keep this discussion, please inquire a new question.

Microsoft Windows Security Event Log

The JSA DSM for Microsoft Windows Security Event Log accepts syslog events from Microsoft Windows systems. All events, including Sysmon and Winlogbeat.json, are supported.

For consequence drove from Microsoft operating systems, JSA supports the post-obit protocols:

Syslog (Intended for Snare, BalaBit, and other third-party Windows solutions)
Forwarded.
TLS Syslog.
TCP Multiline Syslog.
Microsoft Event Log (WMI). See Juniper Secure Analytics Vulnerability Manager User Guide.
Windows Event Log Custom (WMI). Encounter Juniper Secure Analytics Vulnerability Manager User Guide.
MSRPC (Microsoft Security Event Log over MSRPC).
WinCollect. Come across the Juniper Secure Analytics WinCollect User Guide.
WinCollect NetApp Data ONTAP. See the Juniper Secure Analytics WinCollect User Guide.
Amazon Web Services protocol from AWS CloudWatch.