I was recently working with a server that was locking up every ten seconds or so and wouldn’t respond for thirty seconds. Every ten seconds, it would record an event 7011 in the eventlog and would just stop responding. Thirty seconds later, I’d have ten seconds to diagnose as much as I could, then I’d have to wait another thirty seconds to fit in as many diagnostic checks as I could.

The events would start with a “Timeout (30000 milliseconds) waiting for a transaction response from the ShellHWDetection service” error and then every thirty seconds thereafter, a 7011 error would get recorded with “Timeout (30000 milliseconds) waiting for a transaction response from the dmserver service“. (dmserver is evidently the disk management service). Until the server was rebooted, the errors would continue.

I tried stopping services, but the problem persisted. Seeing the original ShellHWDetection error, I started investigating the hardware and found several forums with users mentioning virtualCD drivers causing problems.  I knew I didn’t have virtualCD drivers loaded, but I did discover one piece of hardware that was new. With the latest version of Dameware, a mirror driver had been installed. The mirror driver emulates a second monitor (with a mirror of the first monitor’s output) and pipes it over the network. Tracking back over the eventlogs, I was able to determine it was installed about the time the 7011 errors began. Removing the mirror driver instantly fixed the problem.

For those that have the same type of issue, even if the desktop locks every ten seconds, you can attach to the eventlog across the network to diagnose it, without interruption. The thirty second lockup only affects the local desktop UI on the server.

Additionally, if you are experiencing this type of error, be sure to check for any virtual hardware, not just a Dameware mirror or virtualCD driver.