Connection Timeout Expired in Windows Event Logs

I just recently installed SharePoint 2013 SP1 on a Windows Server 2008 R2 SP1 server and have been receiving this error message in the Windows Event logs:
Cannot connect to SQL Server.  <database server name> not found.  Additional error information from SQL Server is included below.
Connection Timeout Expired.  The timeout period elapsed during the post-login phase.  The connection could have timed out while waiting for server to complete the login process and respond; Or it could have timed out while attempting to create
multiple active connections.  The duration spent while attempting to connect to this server was - [Pre-Login] initialization=12; handshake=6; [Login] initialization=0; authentication=0; [Post-Login] complete=14000;
I have never seen this error message before in my life on any prior installation of SharePoint that I have ever done.  It is only occurring on this one particular installation of SharePoint.  The environment is corporate built, so I have no idea
as to how to troubleshoot or determine the root cause of this error message.
I looked at the value of the database-connection-timeout in stsadm and it gets back a value of 15, however, I am unable to alter the database connection timeout using stsadm since I either get an "Object reference not sent to an instance of an object"
error message or "This operation can be performed only on a computer that is joined to a server farm by users who have permissions in SQL Server to read from the configuration database.  To connect this server to the server farm, use the SharePoint
Products Configuration Wizard, located on the Start menu in Microsoft SharePoint 2010 Products."
Please advise. 

What is specification of your SQL server? i think its more CPU, RAM, I/O issue with SQL server.
under which account you are running the stsadm command?
check this one
http://stackoverflow.com/questions/21230927/sql-azure-the-timeout-period-elapsed-during-the-post-login-phase
may be you fall in this bug
http://connect.microsoft.com/VisualStudio/feedback/details/821803/connection-timeout-expired-the-timeout-period-elapsed-during-the-post-login-phase
Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

Similar Messages

  • Lost connection windows event log

    I have found in the System Configuration a list of errors that I can have write to the windows event log, but it does not include the Lost Connection to agent/adapter error.  I am now looking at looking at taking that system "Event" and attaching an action to it to write to the windows event log.  Is this the best/most elegant way to go about it?  Is there a way to include the machine location (as opposed to the agent name) in the event?
    What I am attempting to do, and this is coming from a thread in the CPO section, is create a windows application event when a connection is lost.  CPO would then be monitoring the TES server windows event log for such an event and perform some diagnostic and attempt to recover the agent.
    Thanks for any help!

    That is also an option that we have talked about, using snmp traps.  Another option we've talked about it triggering a job which would then use the CPO web services to run a process.
    But I like the idea better to have CPO also monitoring the connections and doing something about it.  Using the Windows Event Log would allow us to do that.
    In any case, there is also still the problem of grabbing the machine location.

  • While Installation of 11g database creation time error ORA-28056: Writing audit records to Windows Event Log failed Error

    Hi Friends,
    OS = Windows XP 3
    Database = Oracle 11g R2 32 bit
    Processor= intel p4 2.86 Ghz
    Ram = 2 gb
    Virtual memory = 4gb
    I was able to install the oracle 11g successfully, but during installation at the time of database creation I got the following error many times and I ignored it many times... but at 55% finally My installation was hanged nothing was happening after it..... 
    ORA-28056: Writing audit records to Windows Event Log failed Error  and at 55% my Installation got hung,,,, I end the installation and tried to create the database afterward by DBCA but same thing happened....
    Please some one help me out, as i need to install on the same machine .....
    Thanks and Regards

    AAP wrote:
    Thanks Now I am able to Create a database , but with one error,
    When I created a database using DBCA, at the last stage I got this error,
    Database Configuration Assistant : Warning
    Enterprise Manager Configuration Failed due to the Following error Listener is not up or database service is not registered with it.  Start the listener & Registered database service & run EM Configuration Assistant again....
    But when I checked the listener was up.....
    Now what was the problem,  I am able to connect and work through sqlplus,
    But  I didnt got the link of EM and when try to create a new connection in sql developer it is giving error ( Status : failure - Test Failed the Network Adapter could not establish the connection )
    Thanks & Regards
    Creation of the dbcontrol requires a connection via the listener.  When configuring the dbcontrol as part of database creation, it appears that the dbcontrol creation step runs before the dynamic registration of the databsase with the listener is complete.  Now that the database itself is completed and enough time (really, just a minute or two) has passed to allow the instance to register, use dbca or emca to create the dbcontrol.
    Are you able to get a sqlplus connection via the listener (sqlplus scott/tiger@orcl)?  That needs to be the first order of business.

  • Lots of Anyconnect Error Message in Windows Event Log

    Hi Community.
    We have lots of Anyconnect Error Messages in the Windows Event Log. Following two examples.
    Can anyone tell me why these errors appears and how do I fix them ? I already installed the newest Anyconnect on my machine.
    Thanks in advance and Kind Regards Patrick
    Example 1
      <Provider Name="acvpnagent" />
      <EventID Qualifiers="9216">2</EventID>
      <Keywords>0x80000000000000</Keywords>
      <EventRecordID>97564</EventRecordID>
      <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
    - <EventData>
      <Data>Function: CNetEnvironment::logProbeFailure File: .\NetEnvironment.cpp Line: 1432 Invoked Function: CHttpProbeAsync::SendProbe Return Code: -27066354 (0xFE63000E) Description: HTTP_PROBE_ASYNC_ERROR_CANNOT_CONNECT HTTP (host: 109.164.211.237)</Data>
      </EventData>
    Example 2
      <Provider Name="acvpnagent" />
      <EventID Qualifiers="9216">2</EventID>
      <Keywords>0x80000000000000</Keywords>
      <EventRecordID>97565</EventRecordID>
      <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
    - <EventData>
      <Data>Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp Line: 1385 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28966899 (0xFE46000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target</Data>
      </EventData>

    HI and welcome to Discussions,
    in my personal opinion there is not much for you to worry about.
    The 'Windows Tool for the elimination of malware' is nothing you miss as long as you have a decent Anti-Virus Software running.
    The update for the IE 7 might be missing an installed IE 7, which can do by downloading it yourself from Microsofts webpage.
    If you don't use the IE but something like Firefox or Opera or Safari, than don't bother with these update.
    Stefan

  • How to write to windows event logs from determinations-server under IIS

    This is just an FYI technical bit of information I wish someone had shared with me before I started trying to write OPA errors to the windows event log... Most problems writing to the windows event log from log4net occur because of permissions. Some problems are because determinations-server does not have permissions to create some registry entries. Some problems cannot be resolved unless specific registry entry permissions are actually changed. We had very little consistency with the needed changes across our servers, but some combination of the following would always get the logging to the windows event log working.
    To see log4net errors as log4net attempts to utilize the windows event log, temporarily add the following to the web.config:
    <appSettings>
    <!-- uncomment the following line to send diagnostic messages about the log configuration file to the debug trace.
    Debug trace can be seen when attached to IIS in a debugger, or it can be redirected to a file, see
    http://logging.apache.org/log4net/release/faq.html in the section "How do I enable log4net internal debugging?" -->
    <add key="log4net.Internal.Debug" value="true"/>
    </appSettings>
    <system.diagnostics>
    <trace autoflush="true">
    <listeners>
    <add
    name="textWriterTraceListener"
    type="System.Diagnostics.TextWriterTraceListener"
    initializeData="logs/InfoDSLog.txt" />
    </listeners>
    </trace>
    </system.diagnostics>
    To add an appender for the windows event viewer, try the following in the log4net.xml:
    <appender name="EventLogAppender" type="log4net.Appender.EventLogAppender" >
    <param name="ApplicationName" value="OPA" />
    <param name="LogName" value="OPA" />
    <param name="Threshold" value="all" />
    <layout type="log4net.Layout.PatternLayout">
    <conversionPattern value="%date [%thread] %-5level %logger [%property{NDC}] - %message%newline" />
    </layout>
    <filter type="log4net.Filter.LevelRangeFilter">
    <levelMin value="WARN" />
    <levelMax value="FATAL" />
    </filter>
    </appender>
    <root>
    <level value="warn"/>
    <appender-ref ref="EventLogAppender"/>
    </root>
    To put the OPA logs under the Application Event Log group, try this:
    Create an event source under the Application event log in Registry Editor. To do this, follow these steps:
    1.     Click Start, and then click Run.
    2.     In the Open text box, type regedit.
    3.     Locate the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application
    4.     Right-click the Application subkey, point to New, and then click Key.
    5.     Type OPA for the key name.
    6.     Close Registry Editor.
    To put the OPA logs under a custom OPA Event Log group (as in the demo appender above), try this:
    Create an event log in Registry Editor. To do this, follow these steps:
    1.     Click Start, and then click Run.
    2.     In the Open text box, type regedit.
    3.     Locate the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
    4.     Right-click the eventlog subkey, point to New, and then click Key.
    5.     Type OPA for the key name.
    6.     Right-click the new OPA key and add a new DWORD called "MaxSize" and set it to "1400000" which is about 20 Meg in order to keep the log file from getting too large.
    7.     The next steps either help or sometimes cause an error, but you can try these next few steps... If you get an error about a source already existing, then you can delete the key.
    8.     Right-click the OPA subkey, point to New, and then click Key.
    9.     Type OPA for the key name.
    10.     Close Registry Editor.
    You might need to change permissions so OPA can write to the event log in Registry Editor.  If you get permission errors, try following these steps:
    1.     Click Start, and then click Run.
    2.     In the Open text box, type regedit.
    3.     Locate the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
    4.     Right-click the EventLog key, select Permissions.
    5.     In the dialog that pops up, click Add...
    6.     Click Advanced...
    7.     Click Locations... and select the current machine by name.
    8.     Click Find Now
    9.     Select both the Network user and IIS_IUSERS user and click OK and OK again. (We never did figure out which of those two users was the one that fixed our permission problem.)
    10.     Change the Network user to have Full Control
    11.     Click Apply and OK
    To verify OPA Logging to the windows event logs from Determinations-Server:
    Go to the IIS determinations-server application within Server Manager.
    Under Manage Application -> Browse Application click the http link to pull up the local "Available Services" web page that show the wsdl endpoints.
    Select the /determinations-server/server/soap.asmx?wsdl link
    Go to the URL and remove the "?wsdl" from the end of the url and refresh. This will throw the following error into the logs:
    ERROR Oracle.Determinations.Server.DSServlet [(null)] - Invalid get request: /determinations-server/server/soap.asmx
    That error should show up in the windows event log, OR you can get a message explaining why security stopped you in "logs/InfoDSLog.txt" if you used the web.config settings from above.
    http://msdn.microsoft.com/en-us/library/windows/desktop/aa363648(v=vs.85).aspx
    Edited by: Paul Fowler on Feb 21, 2013 9:45 AM

    Thanks for sharing this information Paul.

  • Operations Manager Failed to Access the Windows Event Log and management server is showing warning state

    Hi,
    I am monitoring AD server from SCOM 2012 R2. My management server goes into waning state. When i run Health explorer then it come back in the healthy state but after some time it again goes into warning state. After seeing alert i found that a alert is coming
    again and again i.e.  Operations Manager Failed to Access the Windows Event Log.The description of alert is mention below
    The Windows Event Log Provider is still unable to open the DhcpAdminEvents event log on computer 'nc2vws12ad5.corp.nathcorp.com'.
    The Provider has been unable to open the DhcpAdminEvents event log for 64080 seconds.
    Most recent error details: The RPC server is unavailable.
    Please suggest me how to resolve this so that my management server will again come back in healthy state.
    Thanks
    Abhishek

    Hi Abhishek,
    As i mentioned earlier the Alert resolution says the same points.
    Can you give details on the below ?
    Is there really a log named "Dhcpadminevents" in the MS's Event viewer ?
    Did you recently configure any new alert where you mentioned "Dhcpadminevents"
    as a event log location ?
    If yes then what is the target you selected for the rule / monitor there ?
    Can you post the results for analysis ?
    Gautam.75801

  • Cannot open eventlog service on computer '.'. (Windows Event Log service doesn't exist)

    This problem used to be solved after moving a computer object into the appropriate OU and restarting, and if that didn't work, it used to be solved when uninstalling and reinstalling Microsoft FEP (restarts in-between).  Now, the only way to access
    event logs is by logging in as a domain admin, or by accessing event logs through remote manage.
    If a machine object is added to the domain, dropped into the computers container, and restarted, we get this error when going into Computer Management:
    "Cannot open eventlog service on computer '.'."
    The original problem was noticed on our VMs, but I also tried it with a Lenovo Windows 7 build out of the box, added it to our domain, and the problem occurred. When our desktops are built, SCCM's task manager drops it into the appropriate OU immediately,
    so desktops don't have issues.  With VMs, they are dropped into the computers container and restarted, so once this problem occurs, it almost never leaves.  SOMETIMES, removing it from the domain solves the problem, but not always.
    I've tried all of the suggestions I've seen online and none of them have worked, such as cleaning up the policies (through registry, and the appropriate system folders), adding the proper NTFS permissions on the RtBackup folder and %SystemRoot%\System32\winevt\logs, netsh
    winsock reset, cleanboot, etc.
    I did notice that I'm unable to find the NT Service\EventLog user group. I wanted to add it to %systemroot%\system32\winevt\logs, but the group cannot be found on the local computer. Even if that's the problem, why is it missing?
    It doesn't seem like anyone else on the internet gets this exact error.

    Hi Kate!
    Yes, the Windows Event Log service is missing. I had already tried your method (#3), and I did try it again. This is the error I get:
    "The specified service already exists."
    If you check services.msc, it's still not there. If you try to start the Event Viewer, the same error comes up:
    Cannot open eventlog service on computer '.'.
    Hi, 
    Please check for the existence of this key. If not found, create a *.reg file from another machine and import.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
    Then, check the issue again.
    If this doesn't work, let's run System file checker tool to repair system:
    Run SFC command in elevated command prompt
    SFC /scannow
    Any error message, please post here to let me know.
    Keep post.
    Kate Li
    TechNet Community Support

  • Thinking about using the Windows Event Logs as my main log store - looking for pros and cons

    I have been writing some larger scripts that write to physical log files.  Until today I have avoided trying to use the Windows Event logs, but, am beginning to rethink this and wondered if anyone has done this, and, what the strengths and weaknesses
    of this logging approach has been.  If I do it, I will probably write a function that accepts pipelined input and simply pass output to the log.  I wanted to get a feel for what I would be getting into before I started writing things up since this
    will probably take a little bit of work to get set up to run properly.

    At my company we use the Windows event log for many of our batch process logging for several reasons:
    Unlike logging to a central database, the Windows event log is always available. I've seen poorly thought out logging solution which log to a database and if the database happens to be unavailable the batch process would fail.
    Monitoring tool such as SCOM already have Windows event log watchers so adding alerts to take action based on message written to the Windows event log is easy
    Built-in support for writing Windows event log entries in the Powershell V2 write-eventlog cmdlet, a simple CLR can created in SQL Server or even command-line eventcreate.exe
    Easy to create a custom event log so you don't have to use the default application log in Windows 2008 and higher.
    Most shrink-wrap S/W already use the event log
    Issues I've seen:
    Windows 2008 with UAC on requires "registering" i.e. creating a new event log source with UAC. This can be done one time manually. Unfortunately there isn't a way to automate UAC--pure GUI. The Powershell command would be "New-EventLog -LogName Application
    -Source  mysource" if you're using the Application log and must be run as  administrator.
    Errant process writes many entries to the event log. Depending on the volume like for example writing stack dumps this can performance problems. I  think I recall an issue an Windows 2003 or Windows 2008 with UAC off  if you're creating a new
    event log source each time (which you shouldn't) then these results in many registry entries which can cause problems.
    I don't think the issues outweigh the benefits--just something to be aware of.

  • Webcache reports 'Connect failed errno = 146' in Event Log

    Hi, when checking the webcache event log I keep getting the above message.
    The webcache server and the application server are physically separate boxes on the same network. There is a firewall between them.
    The webcache server runs purely webcache, the application server runs HTTP Server and OC4J. The connection from webcache to the application server is usually available but sometimes there is a timeout - which I'm assuming is related to the above.
    I understand that a 146 error is a socket connection error.
    Does anyone have any ideas on why I'm seeing this message and where I should start looking to sort it out ?
    Thanks,
    Paul.

    You said "There is a firewall between them.".
    That is probably the key issue here. Can you tell us what exactly is the firewall device. Is it transparent like some layer 3 or below device? With the given info, it is too wild to speculate what caused the connection failure. The problem is usually not in the application process running on the end system.

  • Windows event log monitoring

    We have Grid Control 10GR2 monitoring some Windows servers and the out-of-box config monitors both the System and Security event logs for warning and error conditions. If I want to keep this default config, but just filter out certain EventID's so they don't show up in Grid, is that possible?

    Hi,
    Did you try host metric--"Log File Pattern Matched Line Count" for this ?
    Metalink ID:735137.1 has some info..
    Pls chk out...
    Thanks...

  • Windows event log

    Hi,
    I need to write a specific message into the windows event logger.
    I am trying to use Message statement but I am unable to see any logs appearing in the event viewer.
    Please help me find out what is not right with my code below
    CREATE PROCEDURE message_text( )
    BEGIN
    MESSAGE 'Just a test message' TYPE INFO TO SYSTEM/EVENT LOG
    END;
    Both system and event does not seem to be writing in windows event log

    Hi Sunil,
    The following seems to work okay for myself on SQL Anywhere 16.0.2018 (SP 21):
       MESSAGE 'Hello, World!' TYPE INFO TO EVENT LOG;
    This event then appears in the "Application" Windows System Event Log:
    Were you checking the 'Application' event log for this message?
    Regards,
    Jeff Albion
    SAP Active Global Support

  • Firefox 3.6.9 not starting, no crash dialog, no temporary entry in task manager, no entry in Windows Event Log.

    FF won't start, even in safe mode. No crash dialog or file is generated. This was a fresh install of FF 3.6.9, which didn't generate any error messages while installing. There is a crash file that appears to be related to the installation, named "InstallTime20100824153629". The file has just one line of text (all digits): 1283985675 .

    Problem solved, although I'm unsure of exact cause, since I did a number of other software installs between succeeding FF installs. But I have 2 most likely suspects. The particular PC I'm using was salvaged from another department in my company after being hit with a virus that was quite severe and the dept admins just decided to replace it. While installing other software, I got an error about the replacement PC having the same name in the company domain as this salvage one, although MS-IE-8 ran OK under that condition (now fixed). Also, while uninstalling FF, I had left a console CD'd to the FF run directory so as to add the safe mode option, and the uninstall program never mentioned that it couldn't delete some FF-related files, it just didn't delete them. It wasn't until I went to manually delete them with Win-Explorer that I got a non-deletable message.
    For the duplicate machine name problem, it wouldn't be proper to ask you folks at Mozilla to try to detect it, but for the non-deletable file problem, I would recommend that you provide some type of warning message in the uninstall program when some program files can't be deleted.
    - Dennis McNulty, Portland, OR, USA

  • VSS snapshot of 1.1TB is ending after few hours with timeout. No errors in event log

    Hello,
    does someone have experienced issue where starting making snapshot (forum GUI or command line) is taking a lot of time and then it just ends with timeout?
    I have scenario on virtualised Windows Web Server 2008 R2 where backup is being made by Idera Backup Software but since it relies on VSS Snapshots then we can just skip this point because making snapshots from directly Windows command line or drive preferences/GUI
    is ending with timeout for this single drive after few hours. Affected system has 3 drives: C - 95GB, D-1.06TB and E-120GB. C and E can be backuped correctly and only drive D has problems. System is updated with latest drivers vssadmin for writers returns
    list without any errors and snapshot for drive D which ends with timeout is not generating any error in event log. I wanted to configure VSS trace like it is being instructed on this site:
    http://publib.boulder.ibm.com/infocenter/tsminfo/v6/index.jsp?topic=%2Fcom.ibm.itsm.tshoot.doc%2Ft_pdg_traceprfrm.html
    but I don't see any trace.txt file on given location. If I remove drive D from backup process it ends without errors. System was restarted many times. Only thing which is visible in windows Event log (application part) is that "The VSS service is shutting
    down due to idle timeout." about 4 hours after snapshot making proces is starting.
    I've contacted Idera backup about this but they can't help too much if Windows snapshot process is failing. They suggested that something can be wrong with this drive but since this is virtualised machine and all of my VM are being stored on RAID10 disk
    array connected to my server using fiber connections then I don't think that this is hardware issue (especially when other two drives are located on the same LUN on disk array).
    Any suggestions?
    Regards

    Hi,
    Do you create VMs on Hyper-V or VMWare? Based on research, possible causes could be:
    1. Files changes in the volume is very huge. So the shadow size may be big and the current shadow storage my not able to hold it. And that’s cause the shadow copy creation failure. 
    2. The I/O in D drive is heavy and make the shadow copy I/O failed. 
    3. Server is too busy to handle the request.
    4. The disk is heavily defragment.
    Please refer to the articles to troubleshoot the issue:
    Time-out errors occur in Volume Shadow Copy service writers, and shadow copies are lost during backup and during times when there are high levels of input/output
    http://support.microsoft.com/kb/826936/en-us
    VSS timeouts during backup? What could contribute to that?
    https://blogs.technet.com/b/askpfeplat/archive/2012/09/12/vss-timeouts-during-backup-check-fragmentation.aspx
    Regards,
    Mandy
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Remote desktop fails, can still connect to event log and services.

     I am unable for some reason to remote into a machine that I've been able to before.  This occurred after it installed automatic updates.  At the moment I can connect to
    services and the event log from another machine with the same credentials, but I can't log onto the machine itself.  Is there any way to reset this info or such.  This machine is a part of a domain and can read credentials from the domain controller. 
    I also do know that remote desktop is enabled.
    The following error occurs in the even log on the affected machine.
    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          2013-03-21 10:28:23 AM
    Event ID:      5061
    Task Category: System Integrity
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      ****
    Description:
    Cryptographic operation.
    Subject:
        Security ID:        SYSTEM
        Account Name:        ****$
        Account Domain:        *******
        Logon ID:        0x3e7
    Cryptographic Parameters:
        Provider Name:    Microsoft Software Key Storage Provider
        Algorithm Name:    RSA
        Key Name:    TSSecKeySet1
        Key Type:    Machine key.
    Cryptographic Operation:
        Operation:    Decrypt.
        Return Code:    0xc000000d
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
        <EventID>5061</EventID>
        <Version>0</Version>
        <Level>0</Level>
        <Task>12290</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8010000000000000</Keywords>
        <TimeCreated SystemTime="2013-03-21T14:28:23.339874500Z" />
        <EventRecordID>937125</EventRecordID>
        <Correlation />
        <Execution ProcessID="500" ThreadID="548" />
        <Channel>Security</Channel>
        <Computer>**********</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="SubjectUserSid">S-1-5-18</Data>
        <Data Name="SubjectUserName">*******$</Data>
        <Data Name="SubjectDomainName">********</Data>
        <Data Name="SubjectLogonId">0x3e7</Data>
        <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
        <Data Name="AlgorithmName">RSA</Data>
        <Data Name="KeyName">TSSecKeySet1</Data>
        <Data Name="KeyType">%%2499</Data>
        <Data Name="Operation">%%2484</Data>
        <Data Name="ReturnCode">0xc000000d</Data>
      </EventData>
    </Event>

     
    Hi,
    The following methods could be used to resolve some of the most common problems.
    Potential issues that may be seen:
    1.) Remote Desktop endpoint is missing
    Each virtual machine that is created should have a remote desktop endpoint for the VM at port 3389. If this endpoint is deleted then a new endpoint must be created. The public port can be any available port number. The private port (the port on the VM) must
    be 3389.
    2.) RDP fails with error: "The specified user name does not exist. Verify the username and try logging in again. If the problem continues, contact your system administrator or technical support."
    RDP connection may fail when there are cached credentials. Please see the following article to resolve this problem:
    http://www.c-sharpcorner.com/uploadfile/ae35ca/windows-azure-fixing-reconnect-remote-desktop-error-the-specified-user-name-does-not-exist-verif/
    3.) Failure to connect to uploaded VHD
    When a VHD is uploaded to Windows Azure you must make sure that Remote Desktop is enabled on the VHD and an apporopriate firewall rule is enabled on the VM to open port 3389 (Remote Desktop port).
    Hope this helps!
    Regards.
    Vivian Wang
    TechNet Community Support

  • Windows update KB2964444 broke Event Logging Service and SQL Agent Service on Windows Server 2008 R2

    I got the following problem:
    I discovered that on my Windows Server 2008R2 machine the event logging stopped working on 04/May/2014 at 03:15.
    Also, SQL Agent Service won't run
    The only change that day was security
    update KB2964444 - Security
    Update for Internet Explorer 11 for Windows Server 2008 R2for x64-based Systems, that was installed exactly 04/May/2014 at 03:00. Apparently, that's what broke my machine...
    When I try to start Windows Event Log via net
    start eventlog or via Services
    panel, I get an error:
    C:\Users\Administrator>net start eventlog
    The Windows Event Log service is starting.
    The Windows Event Log service could not be started.
    A system error has occurred.
    System error 2 has occurred.
    The system cannot find the file specified.
    I tried:
    restarted the OS (virtual on the host's VMWare).
    re-checked the settings in services menu -they are like in the link.
    checked the identity in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog -
    the identity is NT
    AUTHORITY\LocalService
    gave all Authenticated Users full access to C:\Windows\System32\winevt\Logs
    ran fc /scannow - Windows Resource Protection did not find any integrity violations.
    went to the file %windir%\logs\cbs\cbs.log -
    all clean, [SR] Repairing 0 components
    EDIT: Uninstalled the recent system updates and rebooted - didn't help
    EDIT: Sysinternals Process Monitor results when running start service from services panel (procmon in elevated mode):
    filters:
    process name is svchost.exe : include
    operation contains TCP : exclude
    the events captured are:
    21:50:33.8105780 svchost.exe 772 Thread Create SUCCESS Thread ID: 6088
    21:50:33.8108848 svchost.exe 772 RegOpenKey HKLM SUCCESS Desired Access: Maximum Allowed, Granted Access: Read
    21:50:33.8109134 svchost.exe 772 RegQueryKey HKLM SUCCESS Query: HandleTags, HandleTags: 0x0
    21:50:33.8109302 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\Services REPARSE Desired Access: Read
    21:50:33.8109497 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\Services SUCCESS Desired Access: Read
    21:50:33.8110051 svchost.exe 772 RegCloseKey HKLM SUCCESS
    21:50:33.8110423 svchost.exe 772 RegQueryKey HKLM\System\CurrentControlSet\services SUCCESS Query: HandleTags, HandleTags: 0x0
    21:50:33.8110705 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS Desired Access: Read
    21:50:33.8110923 svchost.exe 772 RegQueryKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS Query: HandleTags, HandleTags: 0x0
    21:50:33.8111257 svchost.exe 772 RegOpenKey HKLM\System\CurrentControlSet\services\eventlog\Parameters SUCCESS Desired Access: Read
    21:50:33.8111547 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services SUCCESS
    21:50:33.8111752 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services\eventlog SUCCESS
    21:50:33.8111901 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
    21:50:33.8112148 svchost.exe 772 RegCloseKey HKLM\System\CurrentControlSet\services\eventlog\Parameters SUCCESS
    21:50:33.8116552 svchost.exe 772 Thread Exit SUCCESS Thread ID: 6088, User Time: 0.0000000, Kernel Time: 0.0000000
    NOTE: previoulsy, for
    21:46:31.6130476 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
    I also got NAME
    NOT FOUND error ,so I created the new string value for the Parameters with
    the name ServiceDll and
    data %SystemRoot%\System32\wevtsvc.dll (copied
    from the upper HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog key)
    and this event now is
    21:46:31.6130476 svchost.exe 772 RegQueryValue HKLM\System\CurrentControlSet\services\eventlog\Parameters\ServiceDll SUCCESS Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\wevtsvc.dll
    I also checked for the presence of wevtsvc.dll in
    the place and it's there.
    Also, I tried to capture all events with path containing 'event' and
    got following events firing every several seconds:
    21:38:38.9185226 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\Tag NAME NOT FOUND Length: 16
    21:38:38.9185513 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\DependOnGroup NAME NOT FOUND Length: 268
    21:38:38.9185938 services.exe 492 RegQueryValue HKLM\System\CurrentControlSet\services\EventSystem\Group NAME NOT FOUND Length: 268
    Also, I tried to capture all the events containing 'file',
    excluding w3wp.exe,
    chrome.exe, wmiprvse.exe, wmtoolsd.exe, System and it shows NO attempts to access any file ih the time I try to start
    the event logger (if run from cmd - there are several hits by net executable,
    not present if run from the panel).
    What can be done?

    Hi,
    I don’t found the similar issue, if you have the IE 11 please try to update system automatic or install the MS14-029 update.
    The related KB:
    MS14-029: Security update for Internet Explorer 11 for systems that do not have update 2919355 (for Windows 8.1 or Windows Server 2012 R2) or update 2929437 (for Windows 7
    SP1 or Windows Server 2008 R2 SP1) installed: May 13, 2014
    http://support.microsoft.com/kb/2961851/en-us
    Hope this helps.
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

Maybe you are looking for