How to fix the error event ID 1000 in windows 2025

Question

How to fix the error event ID 1000 in windows 2025

Ravi Kumar 0

Dear Team,

How to resolve this error

Log Name: Application

Source: Application Error

Date: 12-09-2026 14:35:41

Event ID: 1000

Task Category: Application Crashing Events

Level: Error

Keywords:

User: NETWORK SERVICE

Computer: SD4-PROD25-NCT8.Krishnamaruti.local

Description:

Faulting application name: svchost.exe_TermService, version: 10.0.26100.32684, time stamp: 0x10211893

Faulting module name: msvcrt.dll, version: 7.0.26100.33158, time stamp: 0xeee20b14

Exception code: 0xc0000005

Fault offset: 0x000000000007b2dc

Faulting process id: 0x764

Faulting application start time: 0x1DD41E94F60CC74

Faulting application path: C:\WINDOWS\System32\svchost.exe

Faulting module path: C:\WINDOWS\System32\msvcrt.dll

Report Id: aeaa1ade-54e1-4697-8b27-b0177458f438

Faulting package full name:

Faulting package-relative application ID:

Event Xml:

<Provider Name="Application Error" Guid="{a0e9b465-b939-57d7-b27d-95d8e925ff57}" />

<EventID>1000</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>100</Task>

<Opcode>0</Opcode>

<Keywords>0x8000000000000000</Keywords>

<TimeCreated SystemTime="2026-09-12T09:05:41.3870558Z" />

<EventRecordID>232205</EventRecordID>

<Correlation />

<Execution ProcessID="16148" ThreadID="33136" />

<Channel>Application</Channel>

<Computer>SD4-PROD25-NCT8.Krishnamaruti.local</Computer>

<Security UserID="S-1-5-20" />

</System>

<Data Name="AppName">svchost.exe_TermService</Data>

<Data Name="AppVersion">10.0.26100.32684</Data>

<Data Name="AppTimeStamp">10211893</Data>

<Data Name="ModuleName">msvcrt.dll</Data>

<Data Name="ModuleVersion">7.0.26100.33158</Data>

<Data Name="ModuleTimeStamp">eee20b14</Data>

<Data Name="ExceptionCode">c0000005</Data>

<Data Name="FaultingOffset">000000000007b2dc</Data>

<Data Name="ProcessId">0x764</Data>

<Data Name="ProcessCreationTime">0x1dd41e94f60cc74</Data>

<Data Name="AppPath">C:\WINDOWS\System32\svchost.exe</Data>

<Data Name="ModulePath">C:\WINDOWS\System32\msvcrt.dll</Data>

<Data Name="IntegratorReportId">aeaa1ade-54e1-4697-8b27-b0177458f438</Data>

<Data Name="PackageFullName">

</Data>

<Data Name="PackageRelativeAppId">

</Data>

</EventData>

</Event>

0 comments

1 answer

Your answer

Answer 1

Hello @Ravi Kumar

Event ID 1000 itself is only the application crash event. In your case, the important details are:

Faulting application: svchost.exe_TermService

Faulting module: msvcrt.dll

Exception code: 0xc0000005

So the process hosting Remote Desktop Services (TermService) is crashing with an access-violation exception. Event ID 1000 is the actual application-crash event and recommends identifying the faulting process/module and collecting crash data when the event repeats.

Don't replace or manually register msvcrt.dll. Although it appears as the faulting module, that doesn't establish the DLL itself as the root cause; another component running in the TermService process can cause the invalid memory access.

First, confirm whether you're seeing an actual RDS symptom at the same timestamp. For example, users being disconnected, new RDP sessions failing, or Remote Desktop Services restarting.

Also check Event Viewer > Windows Logs > System and these channels around the same timestamp:

Microsoft-Windows-TerminalServices-LocalSessionManager/Operational

Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational

Look especially for TermService termination/restart events and RDS session errors immediately before Event 1000.

Make sure Windows Server 2025 is fully patched. Microsoft specifically recommends installing current OS and application updates before deeper crash analysis.

You can also run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

If both complete successfully and the crash continues, don't run them repeatedly. The next useful step is to capture a dump of the TermService crash.

One straightforward method is Windows Error Reporting LocalDumps. Because TermService runs under svchost.exe, however, be careful with a global svchost.exe dump configuration. It could collect dumps from unrelated Windows services. For a production server, Microsoft's application-crash troubleshooting guidance using Debugging Tools/ProcDump is preferable because it lets you target the affected process more precisely.

Before capturing it, identify the TermService PID:

sc queryex TermService

or:

Get-CimInstance Win32_Service -Filter "Name='TermService'" |
Select-Object Name, State, ProcessId

Then capture the affected process when reproducing the crash and preserve the dump for analysis.

Also check Event ID 1001 (Windows Error Reporting) immediately following Event 1000. If present, please share its Fault bucket, P1-P10, and report information, since that can provide a more specific failure signature.

If this is recurring, could you provide:

winver / exact Windows Server 2025 build
frequency of the crash
whether RDP sessions disconnect when it occurs
Event ID 1001 details, if present
any TermService/LocalSessionManager events immediately before the crash
whether this is an RDS Session Host or simply a server with administrative RDP enabled

Those details will help determine whether this is an RDS-specific Windows Server 2025 issue, a third-party component interacting with TermService, or an isolated process crash.

References:

Application/service crash troubleshooting guidance

Windows Server 2025 KB5053598 and Event ID 1000 issue

=============================================================================

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.