When working with Windows Server environments, you might encounter this perplexing error in the Application event log:

Event ID: 2004
Source: Server
Message: Unable to open the Server service performance object. 
         The first four bytes (DWORD) of the Data section contains the status code: 34 00 00 C0

Microsoft's documentation suggests simply restarting the Server service (LanmanServer), but as many sysadmins have discovered:

• The service appears to be running normally
• Restarting provides only temporary relief
• The error recurs every 2-7 days on multiple servers

The root cause often relates to performance counter corruption. Here's a PowerShell script to verify:

# Check Server service performance counters
$counters = Get-Counter -ListSet "Server"
if ($counters.CounterSetName -ne "Server") {
    Write-Host "Performance counters corrupted for Server service"
} else {
    Write-Host "Performance counters appear normal"
}

Try this comprehensive approach:

1. Rebuild Performance Counters (admin CMD):

   lodctr /r

2. Reset Windows Performance Counters:

   unlodctr /M:PerfOS
   unlodctr /M:PerfProc
   unlodctr /M:PerfNet
   lodctr /M:PerfOS
   lodctr /M:PerfProc
   lodctr /M:PerfNet

3. Registry Cleanup (backup first):

   reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib" /f
   reg copy "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009" 
            "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Current" /s /f

Create a scheduled task to monitor and alert when this occurs:

$query = @'
<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">
      *[System[Provider[@Name='Server'] and EventID=2004]]
    </Select>
  </Query>
</QueryList>
'@

$action = {
    # Send alert email or trigger remediation
    Send-MailMessage -To "admin@domain.com" -Subject "Server Performance Object Error Detected" -Body "Event ID 2004 occurred"
}

Register-ScheduledTask -TaskName "Monitor Server Perf Errors" -Trigger (New-ScheduledTaskTrigger -AtStartup) 
                       -Action (New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument $action) 
                       -Settings (New-ScheduledTaskSettingsSet -StartWhenAvailable -DontStopOnIdleEnd)

For persistent cases, consider:

• Running System File Checker: sfc /scannow
• Checking for Windows updates specifically related to performance counters
• Reviewing any recently installed monitoring software that might conflict with built-in counters

When monitoring Windows Server performance counters, you might encounter this frustrating event in Application logs:

Event ID: 2004
Source: PerfNet
Description: Unable to open the Server service performance object.
First four bytes (DWORD): 34 00 00 C0 (0xC0000034)
Frequency: Every 2-7 days, occurring twice consecutively

Microsoft's documentation suggests simply restarting the Server service, but in practice:

• Server service shows as "Running" in services.msc
• Basic functionality (file sharing, RPC) remains operational
• Restarting provides only temporary relief

The error code 0xC0000034 (STATUS_OBJECT_NAME_NOT_FOUND) indicates a registry corruption in performance counter configuration. This typically happens when:

1. Performance counter DLLs become unregistered
2. Registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib get corrupted
3. SMB performance counters fail to initialize

Create this PowerShell script to completely rebuild performance counters:

# Save as Reset-PerfCounters.ps1
$null = New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS
$perfPaths = @(
    "HKLM:\SYSTEM\CurrentControlSet\Services\*\Performance",
    "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib",
    "HKU:\.DEFAULT\Perflib"
)

# Backup current configuration
Get-ChildItem $perfPaths | Export-Clixml "PerfCounterBackup_$(Get-Date -Format yyyyMMdd).xml"

# Rebuild counters
Start-Process lodctr.exe "/R" -Wait -NoNewWindow
Start-Process lodctr.exe "/Q" -Wait -NoNewWindow
Start-Process unlodctr.exe "/Q" -Wait -NoNewWindow

# Re-register SMB counters
$smbFiles = Get-ChildItem "$env:windir\System32\srv*" -Include *.dll,*.exe
$smbFiles | ForEach-Object {
    regsvr32 /s $_.FullName
}

For proactive detection, implement this check in your monitoring system:

# Nagios/Icinga plugin example
$Error.Clear()
$counters = Get-Counter -ListSet * -ErrorAction SilentlyContinue
if ($Error[0] -like "*0xC0000034*") {
    Write-Host "CRITICAL: Performance counter corruption detected"
    exit 2
}
Write-Host "OK: Performance counters healthy"
exit 0

For stubborn cases, manually verify these registry values:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Performance]
"Library"="srvsvc.dll"
"Open"="OpenPerformanceData"
"Collect"="CollectPerformanceData"
"Close"="ClosePerformanceData"
"InstallType"=dword:00000001
"PerfIniFile"="srvctrs.ini"