NS_I_STOP_CUB 0X400D005C: NetShow Content Server Stopped by Admin

Quick answer for advanced users

This is an informational event, not a real error. It just tells you an admin (or automated script) stopped the NetShow Content Server. Check your Windows Media Services console or event logs to see who stopped it. No fix needed—just restart the service if you didn't mean to stop it.

What's happening here?

I know seeing 0X400D005C in your event log can make you panic. But this one's not a problem. It's a notification from Windows Media Services (the old NetShow system). It says: "A NetShow administrator at network location %1 stopped Content Server %2." The %1 and %2 are placeholders—they'll show the actual admin's IP or name and the server name in your log.

This usually happens when:

• You manually stopped the Windows Media Services service.
• A scheduled task or script stopped it for maintenance.
• Another admin remotely stopped the streaming server.
• The server was shut down or rebooted cleanly.

Think of it like turning off a light switch—the log just records who flipped it. If the server stopped unexpectedly (like a crash), you'd see a different error, like NS_E_CUB_FAIL or a timeout. So breathe—this one's just paperwork.

How to check who stopped it

If you're curious or need to audit, here's how to find the culprit:

1. Open Event Viewer (press Windows + R, type eventvwr.msc, hit Enter).
2. Go to Windows Logs > Application.
3. Look for the event with ID 400 (source: Windows Media Services). Double-click it.
4. In the description, you'll see the network location (%1) and server name (%2).
   • If %1 is localhost or 127.0.0.1, it was stopped locally.
   • If it's an IP address or hostname, that's the remote admin.
   • If it's blank, the service was stopped by the system itself (like during shutdown).

Example event text

A NetShow administrator at network location 192.168.1.100 stopped Content Server STREAM-SERVER-01. The exact error code is: 0X400D005C.

What to do about it

Since it's just a notification, your main fix is to restart Windows Media Services if you didn't want it stopped.

1. Open Services (press Windows + R, type services.msc, hit Enter).
2. Find Windows Media Services in the list.
3. If it's not running, right-click and select Start.
4. Set the startup type to Automatic if you want it to run always (right-click > Properties > Startup type).

Alternative: Restart via command line

net start "Windows Media Services"

That's it. If the service starts fine and your streams work, you're done.

If the server keeps stopping

Maybe you're seeing this event multiple times in a row. That means something—or someone—is repeatedly stopping your server. Here's how to track it down:

1. Check Task Scheduler for tasks that stop Windows Media Services. Open Task Scheduler (type taskschd.msc in Run), look under Task Scheduler Library for anything with "Media" or "WMS" in the name.
2. Check your Group Policy—some admins push scripts that stop services on a schedule.
3. Look at the Security log in Event Viewer for logon events from administrators around the same time. Filter for Event ID 4624 (successful logon) and cross-reference with the time of the stop.

When this error appears

I've seen this most often in two scenarios:

• Windows Server 2008 R2 or 2012 running Windows Media Services for corporate intranet streaming. An admin reboots the server or stops the service to install updates.
• Automated failover scripts in high-availability setups where a script stops the primary server to switch to a backup. The event just logs that action.

In both cases, it's normal. Don't treat it like an error.

Prevention tip

If you're the admin and you don't want this event cluttering your logs, stop the service cleanly every time—or just ignore it. There's no harm in leaving it. But if you need a clean log, schedule your service stops during maintenance windows and document them. That way, when you see 0X400D005C, you'll know it's planned.

Bottom line: NS_I_STOP_CUB 0X400D005C is a friendly heads-up, not a fire alarm. You've got this.