Event IDs 1008 and 2001 repeatedly logged when you use performance monitoring (811089)

Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry

SYMPTOMS

When you use performance counters in Windows 2000 to collect system data, the following events may be repeatedly logged in the Application log of the Event Viewer:

Event ID 1008

Date:     date        Source:   Perflib
Time:     time        Category: None
Type:     Error       Event ID: 1008
User:     N/A
Computer: Servername

Description:
The Open Procedure for service 'Remote Access' in DLL
"Rasctrs.dll" failed. Performance data for this service will not 
be available. Status code returned is DWORD 0.

Event ID 2001

Date:     date        Source:   Rasctrs
Time:     time        Category: None
Type:     Error       Event ID: 2001
User:     N/A
Computer: Servername

Description:
Load of Rasctrs.dll failed. Make sure the DLL file is in the
PATH.WIN32 Error number is returned in the data.

CAUSE

This issue may occur after you disable the Remote Access service. These events are logged because when you first create a performance query, the performance library checks the availability of all counters that are listed in the registry. If a listed counter is not available, an Application log entry is logged.

Note This issue may also occur after you apply the HiSecWeb security template.

WORKAROUND

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

To work around this issue, edit the Windows registry to disable the Remote Access service performance counters:

Click Start, click Run, type regedit in the Open box, and then click OK.
Click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \RemoteAccess\Performance
On the Edit menu, point to New, and then click DWORD Value.
In the New Value #1 box, type Disable Performance Counters, and then press ENTER.
Right-click Disable Performance Counters, and then click Modify.
In the Value data box, type 1, and then click OK.
Quit Registry Editor, and then restart the computer.

MORE INFORMATION

For more information about how to resolve Event ID 2003 warnings that are logged in the Application log, click the following article number to view the article in the Microsoft Knowledge Base:

267831 Event ID 2003 warning message logged when loading performance counters

For more information about how to rebuild performance library values, click the following article number to view the article in the Microsoft Knowledge Base:

300956 How to manually rebuild Performance Counter Library values

For more information about how to resolve a similar issue with disk performance counters, click the following article number to view the article in the Microsoft Knowledge Base:

296187 Application log events generated when you start performance counter query