I did some maintenance on our email server on Saturday (backup, chkdsk, defrag) just simple stuff, but somewhere inside the chkdsk things got mangled. I knew there were some file level problems on the machine, and there'd been a general stability problem for a while, so all of this was about due to happen. But what an annoyance, really. We had no inbound email for the entire weekend and Monday. In the end, the problem was limited to our Xwall spam filter. It's an incredible filter and I highly, highly recommend it. In this case a couple of it's key files got re-arranged by the chkdsk, and it wasn't forwarding emails onto Exchange after it checked them. It took me all weekend and yesterday to diagnose, I'm kinda kicking myself for it. All's well that ends well I suppose, though.
In the process, I noticed the Appletalk protocol was still installed (from some old stuff we had some on the server, a couple of years back). I removed Appletalk, and then the even log started filling (every minute or two) with:
Event Type: Error Event Source: atkctrs Event Category: None Event ID: 3001 Date: Time: User: N/A Computer: Description: Unable to open ATK device for R access. Returning IO Status Block in Data.
Which was a real pain, and only frustrated the troubleshooting process. In the end one Kaushal Shah came to my rescue:
I am facing the same problem. The following Microsoft KB Article ID: Q257760 provides the solution.
It recommends dowloading Exctrlst.exe utility from the Microsoft Windows 2000 Resource Kit. Run this utility and uncheck all the performance counters for which you are getting a error.
Thanks buddy. In my case it was Windows 2003, but it didn't make a difference; I ran the Exctrlst utility, dropped the performance logging on Appletalk (which, again, wasn't installed anymore) and problem solved.