Event ID 2003 after installing Windows Server 2003 Service Pack 2

After installing Service Pack 2 I received the following error on multiple
servers:
Application - Event Log
Source: SysmonLog
Category: None
Event ID: 2003

Description: Unable to open the Performance Logs and Alerts configuration.
This configuration is initialized when you use the Performance Logs and
Alerts Management Console snapin to create a Log or Alert session.

Also, when I look at the Performance Logs and Alerts Service it is set to
automatic, but it is not started. When I attempt to start it, I receive the
following error:

Windows could not start the Performance Logs and Alerts on Local Computer.
For more information, review the System Event Log. If this is a
non-Microsoft service, contact the service vendor, and refer to
service-specific error code 2003.

Is this normal behavior post-SP2?

On Jul 5, 9:58 am, GregA415 <GregA...@discussions.microsoft.com>
wrote:
> After installing Service Pack 2 I received the following error on multiple
> servers:
> Application - Event Log
> Source: SysmonLog
> Category: None
> Event ID: 2003
>
> Description:UnabletoopenthePerformanceLogsandAlertsconfiguration.
> Thisconfigurationis initialized when you use thePerformanceLogsandAlertsManagement Console snapin to create a Log or Alert session.
>
> Also, when I look at thePerformanceLogsandAlertsService it is set to
> automatic, but it is not started. When I attempt to start it, I receive the
> following error:
>
> Windows could not start thePerformanceLogsandAlertson Local Computer.
> For more information, review the System Event Log. If this is a
> non-Microsoft service, contact the service vendor, and refer to
> service-specific error code 2003.
>
> Is this normal behavior post-SP2?

Try changing the log on properties of the Performance Logs and Alerts
service to use the Local Service Account. This fixed the issue when I
was having this same error.

~Kelly [MCSE]

Thanks for the response. Unfortunately I had tried this already and it did
not resolve the issue. I checked a Windows 2003 Server that was at SP1 and
noticed this service was in Manual. I changed the service on one of the
Windows 2003 Servers that has SP2 installed (that is having the issue) to
manual as well and I am not getting any error messages.

Do you know if this will cause any issues? So far everything has been
working without issue on this server. Thanks again for your response on this.

"Kelly [MCSE]" wrote:

> On Jul 5, 9:58 am, GregA415 <GregA...@discussions.microsoft.com>
> wrote:
> > After installing Service Pack 2 I received the following error on multiple
> > servers:
> > Application - Event Log
> > Source: SysmonLog
> > Category: None
> > Event ID: 2003
> >
> > Description:UnabletoopenthePerformanceLogsandAlertsconfiguration.
> > Thisconfigurationis initialized when you use thePerformanceLogsandAlertsManagement Console snapin to create a Log or Alert session.
> >
> > Also, when I look at thePerformanceLogsandAlertsService it is set to
> > automatic, but it is not started. When I attempt to start it, I receive the
> > following error:
> >
> > Windows could not start thePerformanceLogsandAlertson Local Computer.
> > For more information, review the System Event Log. If this is a
> > non-Microsoft service, contact the service vendor, and refer to
> > service-specific error code 2003.
> >
> > Is this normal behavior post-SP2?
>
> Try changing the log on properties of the Performance Logs and Alerts
> service to use the Local Service Account. This fixed the issue when I
> was having this same error.
>
> ~Kelly [MCSE]
>
>

In my case, setting the local group "Performance Log Users" on
registry key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
\SysmonLog" and giving it Full Control did the job.
The "NT AUTHORITY\Network Service" account should be member of this
group.

Starting the service resulted in giving the normal message "The
Performance Logs and Alerts service on Local Computer started and then
stopped. Some services stop automatically if they have no work to do,
for example, the Performance Logs and Alerts service."