Decoding the Device Event log (LGLG)

Not sure this is the best section to ask in, but...
Is there a document that can help developers decode the device event log (the one you see with Alt - LGLG) ?
We're trying to debug some connection issues and hope to find some help in the log.
Thanks!
Kev

Hi,
You may need to restore or re-issue your CALs.
Detailed steps.
The number of client access licenses may be reset to five in Windows Small Business Server 2003
http://support.microsoft.com/kb/888818/en-us
Hope this helps.
Jeremy Wu
TechNet Community Support

Similar Messages

Operations Manager Failed to Access the Windows Event Log and management server is showing warning state

Hi,
I am monitoring AD server from SCOM 2012 R2. My management server goes into waning state. When i run Health explorer then it come back in the healthy state but after some time it again goes into warning state. After seeing alert i found that a alert is coming
again and again i.e. Operations Manager Failed to Access the Windows Event Log.The description of alert is mention below
The Windows Event Log Provider is still unable to open the DhcpAdminEvents event log on computer 'nc2vws12ad5.corp.nathcorp.com'.
The Provider has been unable to open the DhcpAdminEvents event log for 64080 seconds.
Most recent error details: The RPC server is unavailable.
Please suggest me how to resolve this so that my management server will again come back in healthy state.
Thanks
Abhishek

Hi Abhishek,
As i mentioned earlier the Alert resolution says the same points.
Can you give details on the below ?
Is there really a log named "Dhcpadminevents" in the MS's Event viewer ?
Did you recently configure any new alert where you mentioned "Dhcpadminevents"
as a event log location ?
If yes then what is the target you selected for the rule / monitor there ?
Can you post the results for analysis ?
Gautam.75801

Thinking about using the Windows Event Logs as my main log store - looking for pros and cons

I have been writing some larger scripts that write to physical log files. Until today I have avoided trying to use the Windows Event logs, but, am beginning to rethink this and wondered if anyone has done this, and, what the strengths and weaknesses
of this logging approach has been. If I do it, I will probably write a function that accepts pipelined input and simply pass output to the log. I wanted to get a feel for what I would be getting into before I started writing things up since this
will probably take a little bit of work to get set up to run properly.

At my company we use the Windows event log for many of our batch process logging for several reasons:
Unlike logging to a central database, the Windows event log is always available. I've seen poorly thought out logging solution which log to a database and if the database happens to be unavailable the batch process would fail.
Monitoring tool such as SCOM already have Windows event log watchers so adding alerts to take action based on message written to the Windows event log is easy
Built-in support for writing Windows event log entries in the Powershell V2 write-eventlog cmdlet, a simple CLR can created in SQL Server or even command-line eventcreate.exe
Easy to create a custom event log so you don't have to use the default application log in Windows 2008 and higher.
Most shrink-wrap S/W already use the event log
Issues I've seen:
Windows 2008 with UAC on requires "registering" i.e. creating a new event log source with UAC. This can be done one time manually. Unfortunately there isn't a way to automate UAC--pure GUI. The Powershell command would be "New-EventLog -LogName Application
-Source mysource" if you're using the Application log and must be run as administrator.
Errant process writes many entries to the event log. Depending on the volume like for example writing stack dumps this can performance problems. I think I recall an issue an Windows 2003 or Windows 2008 with UAC off if you're creating a new
event log source each time (which you shouldn't) then these results in many registry entries which can cause problems.
I don't think the issues outweigh the benefits--just something to be aware of.

OpsMgr EventId 26007 on Domain Controllers "The EventLog service reported that the Security event log on computer ' ' is corrupt."

Hi,
We are receiving several eventids '26007' from the OpsMgr log on our Domain Controllers, also eventids '26008' with similar description are logged
The EventLog service reported that the Security event log on computer '<Domain Controller Computer>' is corrupt. The Windows Event Log Provider will attempt to recover by re-opening log.
I'll appreciate any suggestion in order to solve this issue.
Regards.

I guess this issue is caused by event ID 4661 is corrupted in security event log.
Please check if you have many 4661 events in security event log and XML view cannot be viewed.
Running the below command on DC will disable the auditing of the SAM Object access. This should stop the Event ID 4661 from being logged which should stop the Alert regarding corrupt Event log:
auditpol /set /subcategory:"SAM" /success:disable /failure:disable
Regards,

Windows could not start the Cluster Service on Local computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 2.

Dear Technet,
Windows could not start the Cluster Service on Local computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 2.
My cluster suddenly went disappear. and tried to restart the cluster service. When trying to restart service this above mention error comes up.
even i tried to remove the cluster through power-shell still couldn't happen because of cluster service not running.
Help me please.. thank you.
Regards
Shamil

Hi,
Could you confirm which account when you start the cluster service? The Cluster service is a service that requires a domain user account.
The server cluster Setup program changes the local security policy for this account by granting a set of user rights to the account. Additionally, this account is made a member
of the local Administrators group.
If one or more of these user rights are missing, the Cluster service may stop immediately during startup or later, depending on when the Cluster service requires the particular
user right.
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Data Access Service is unable to log audit events to the security event log

Hi,
Scenario: SCOM 2012 R2 UR4. (Windows 2012 R2)
Today SCOM have generated 4 alerts Data Access Service is unable to log audit events to the security event log.
The service account for "System Center Data Access Service" service is "Local System".
The users at "Generate security audits" are: LOCAL SERVICE and NETWORK SERVICE.
The question is:
how to resolve this alert? (Where look for to obtain more information to resolve this problem)
Thanks in advance!

Local system account is differet to local service account. Fo detail description of these accounts, pls. refer
LocalService Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188(v=vs.85).aspx
LocalSystem Account
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx
Generate security audits which is under Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment of Group policy, determines which accounts can be used by a process to add entries to the security log. This user right
is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, only the LocalSystem account has the privilege to be used by processes to generate security audits.
For identified the SDK account
1) open services.msc
2) From the system Center Data Access Service, you can see the SDK logon on as account
Roger

How can I turn off Event ID 5156 AND 5145 in the Security Event Log?

Hi,
I have a high volume web service. Everytime there is a connection from the outside, it logs this in my security event log.
I want to turn this off.
How can I stop the logging of event id 5156 on the web server and 5145 on the file server?
Thanks!
Dane!

Hi,
Thanks for posting in Microsoft TechNet forums.
The problem can be related to Audit settings. Please check the following threads to see if the information can be useful during the troubleshooting:
auditing file share on windows 2008 R2
http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/9e633bad-cda6-4ec4-8f04-c01de57ce767
Event ID 5156 filling up event logs. Probably due to anti-virus software (SEP 11)
http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/8044fb62-f5ea-45b5-b717-3f6592af77e0
Regards
Kevin
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback
on our support quality, please send your feedback here.

Daily Errors in the System Event Log

Once a day, presumably due to scheduled maintenance task running, on our Windows 8.1 systems (set up with local accounts) we're seeing the following DistributedCom messages, ID 10010, logged:
The server {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} did not register with DCOM within the required timeout.
The server {1B1F472E-3221-4826-97DB-2C2324D389AE} did not register with DCOM within the required timeout.
The events are logged about 30 seconds apart.
A search of the registry reveals the first event is related to SkyDrive, specifically "Automatic Maintenance task to enable SkyDrive file sync to make progress while in Connected Standby" while the second seems to
also be related to sync maintenance ("SyncEngineCOMServer Class").
On a system with a local account, and on which no SkyDrive access is needed/wanted, what's the method to disable the software that's apparently still trying to access SkyDrive?
Thanks in advance.
-Noel
Detailed how-to in my eBooks:
Configure The Windows 7 "To Work" Options
Configure The Windows 8 "To Work" Options

Yes for anyone who actually came to this thread for the topic, going off on a tangent is confusing as at a glance we think what you are talking about is relative to the topic and we then have to waste time reading many irrelevant comments to figure out you're
going off a tangent. Thnks for that!
Really? You think going off topic AFTER arriving at the definitive answer is a real problem for you?
Then you complain that the off topic talk interferes with your totally unrelated question?
New to internet forums? Hint: Start your own thread.
To summarize this one: On a system where the user wants no part of SkyDrive / OneDrive, there's a scheduled task that remains and tries to access the online resources. Someone at Microsoft forgot to get rid of it when OneDrive is disabled.
Simple as that.
-Noel
Detailed how-to in my eBooks:
Configure The Windows 7 "To Work" Options
Configure The Windows 8 "To Work" Options

Search for records in the event viewer after the last run (not the entire event log), remove duplicate - Output Logon type for a specific OU users

Hi,
The following code works perfectly for me and give me a list of users for a specific OU and their respective logon types :-
$logFile = 'c:\test\test.txt'
$_myOU = "OU=ABC,dc=contosso,DC=com"
# LogonType as per technet
$_logontype = @{
2 = "Interactive"
3 = "Network"
4 = "Batch"
5 = "Service"
7 = "Unlock"
8 = "NetworkCleartext"
9 = "NewCredentials"
10 = "RemoteInteractive"
11 = "CachedInteractive"
Get-WinEvent -FilterXml "<QueryList><Query Id=""0"" Path=""Security""><Select Path=""Security"">*[System[(EventID=4624)]]</Select><Suppress Path=""Security"">*[EventData[Data[@Name=""SubjectLogonId""]=""0x0""
or Data[@Name=""TargetDomainName""]=""NT AUTHORITY"" or Data[@Name=""TargetDomainName""]=""Window Manager""]]</Suppress></Query></QueryList>" -ComputerName
"XYZ" | ForEach-Object {
#TargetUserSid
$_cur_OU = ([ADSI]"LDAP://<SID=$(($_.Properties[4]).Value.Value)>").distinguishedName
If ( $_cur_OU -like "*$_myOU" ) {
$_cur_OU
#LogonType
$_logontype[ [int] $_.Properties[8].Value ]
#Time-created
$_.TimeCreated
$_.Properties[18].Value
} >> $logFile
I am able to pipe the results to a file however, I would like to convert it to CSV/HTML When i try "convertto-HTML"
function it converts certain values . Also,
a) I would like to remove duplicate entries when the script runs only for that execution.
b) When the script is run, we may be able to search for records after the last run and not search in the same
records that we have looked into before.
PLEASE HELP !

If you just want to look for the new events since the last run, I suggest to record the EventRecordID of the last event you parsed and use it as a reference in your filter. For example:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[(EventID=4624 and
EventRecordID>46452302)]]</Select>
<Suppress Path="Security">*[EventData[Data[@Name="SubjectLogonId"]="0x0" or Data[@Name="TargetDomainName"]="NT AUTHORITY" or Data[@Name="TargetDomainName"]="Window Manager"]]</Suppress>
</Query>
</QueryList>
That's this logic that the Server Manager of Windows Serve 2012 is using to save time, CPU and bandwidth. The problem is how to get that number and provide it to your next run. You can store in a file and read it at the beginning. If not found, you
can go through the all event list.
Let's say you store it in a simple text file, ref.txt
1234
At the beginning just read it.
Try {
$_intMyRef = [int] (Get-Content .\ref.txt)
Catch {
Write-Host "The reference EventRecordID cannot be found." -ForegroundColor Red
$_intMyRef = 0
This is very lazy check. You can do a proper parsing etc... That's a quick dirty way. If I can read
it and parse it as an integer, I use it. Else, I just set it to 0 meaning I'll collect all info.
Then include it in your filter. You Get-WinEvent becomes:
Get-WinEvent -FilterXml "<QueryList><Query Id=""0"" Path=""Security""><Select Path=""Security"">*[System[(EventID=4624 and EventRecordID>$_intMyRef)]]</Select><Suppress Path=""Security"">*[EventData[Data[@Name=""SubjectLogonId""]=""0x0"" or Data[@Name=""TargetDomainName""]=""NT AUTHORITY"" or Data[@Name=""TargetDomainName""]=""Window Manager""]]</Suppress></Query></QueryList>"
At the end of your script, store the last value you got into your ref.txt file. So you can for example get that info in the loop. Like:
$Result += $LogonRecord
$_intLastId = $Event.RecordId
And at the end:
Write-Output $_intLastId | Out-File .\ref.txt
Then next time you run it, it is just scanning the delta. Note that I prefer this versus the date filter in case of the machine wasn't active for long or in case of time sync issue which can sometimes mess up with the date based filters.
If you want to go for a date filtering, do it at the Get-WinEvent level, not in the Where-Object. If the query is local, it doesn't change much. But in remote system, it does the filter on the remote side therefore you're saving time and resources on your
side. So for example for the last 30 days, and if you want to use the XMLFilter parameter, you can use:
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[System[TimeCreated[timediff(@SystemTime) <= 2592000000]]]</Select>
</Query>
</QueryList>
Then you can combine it, etc...
PS, I used the confusing underscores because I like it ;)
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Create Project Web App Site - Failed - see the Application event Log

Hi, we have installed MS Project Server 2010 on our LAB SharePoint 2010 Server (Single Server and SQL Server Database).
My farm admin account have all server roles in SQL, it is runng the OWSTimer also and it is the AppPool Service App.
No specific error in the Application log from eventvwr on SharePoint Server.
No specific error log from SQL
This is the log information from SharePoint ULS :
04/09/2015 10:56:47.01 OWSTIMER.EXE (0x1464) 0x0728 Project Server Provisioning 6935 Critical Error provisioning database. Script: C:\Program Files\Microsoft Office Servers\14.0\Sql\Project Server\Core\addpublishsps12.sql,
Line: 0, Error: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote
connections. (provider: TCP Provider, error: 0 - An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full.), Line: grant execute on dbo.MSP_RESTORE_WEB_SECURITY_SP_CAT_PERMISSIONS to ProjectServerRole
. 5141bd37-50f2-495c-bcd6-d0804f08e3f0
04/09/2015 10:56:47.01 OWSTIMER.EXE (0x1464) 0x0728 Project Server Provisioning 6580 Critical Failed to provision database LAV-SP2010LAB-SQL.ProjectServer_Published as Published because of exception grant execute on dbo.MSP_RESTORE_WEB_SECURITY_SP_CAT_PERMISSIONS
to ProjectServerRole . 5141bd37-50f2-495c-bcd6-d0804f08e3f0
04/09/2015 10:56:47.01 OWSTIMER.EXE (0x1464) 0x0728 Project Server Provisioning 6993 Critical Provisioning 'PWA': Failed to provision databases. An exception occurred: grant execute on dbo.MSP_RESTORE_WEB_SECURITY_SP_CAT_PERMISSIONS
to ProjectServerRole . 5141bd37-50f2-495c-bcd6-d0804f08e3f0
04/09/2015 10:56:47.01 OWSTIMER.EXE (0x1464) 0x0728 Project Server Provisioning 6958 Critical Provisioning 'PWA': Database provisioning failed. 5141bd37-50f2-495c-bcd6-d0804f08e3f0
04/09/2015 10:56:47.01 OWSTIMER.EXE (0x1464) 0x0728 Project Server Provisioning 6971 Critical Failed to provision site PWA with error: Microsoft.Office.Project.Server.Administration.ProvisionException: Failed to provision
databases. ---> Microsoft.Office.Project.Server.Administration.ProvisionException: grant execute on dbo.MSP_RESTORE_WEB_SECURITY_SP_CAT_PERMISSIONS to ProjectServerRole ---> System.Data.SqlClient.SqlException: A network-related or instance-specific
error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - An operation
on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full.)     at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)     at System.Data.SqlClient.TdsParser.Connect(ServerInfo serverInfo, SqlInternalConnectionTds connHandler, Boolean ignoreSniOpenTimeout, Int64 timerExpire,
Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, SqlConnection owningObject)     at System.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, Boolean ignoreSniOpenTimeout,
Int64 timerExpire, SqlConnection owningObject)     at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions,
Int64 timerStart)     at System.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity
identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)     at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions
options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionFactory.CreateNonPooledConnection(DbConnection owningConnection, DbConnectionPoolGroup poolGroup)
at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)     at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)
at System.Data.SqlClient.SqlConnection.Open()     at Microsoft.Office.Project.Server.Data.SqlSession.OpenConnection()     at Microsoft.Office.Project.Server.Data.SqlSession.ExecuteNonQuery(SqlCommand command)
at Microsoft.Office.Project.Server.Administration.ProjectDatabase.ExecuteScript(SqlSession session, TextReader textReader, Int32 commandTimeout)     --- End of inner exception stack trace ---     at Microsoft.Office.Project.Server.Administration.ProjectDatabase.ExecuteScript(SqlSession
session, TextReader textReader, Int32 commandTimeout)     at Microsoft.Office.Project.Server.Administration.ProjectDatabase.ExecuteScript(SqlSession session, String path, Int32 commandTimeout)     at Microsoft.Office.Project.Server.Administration.ProjectDatabase.Provision(ProjectDatabaseType
databaseType, PjSqlConnectionString databaseConnectString, String installpath, Int32 lcid)     at Microsoft.Office.Project.Server.Administration.ProjectDatabase.Provision(PjSqlConnectionString databaseConnectString, Int32 lcid, ProjectDatabaseType
databaseType, Guid collectionGuid)     at Microsoft.Office.Project.Server.Administration.ProjectSite.ProvisionDatabases(String pubConn, String wrkConn, String verConn, String repConn, String adminUsername, String adminName, String adminEmail,
Int32 lcid, Guid collectionGuid)     at Microsoft.Office.Project.Server.Administration.PsiServiceApplication.EnsureDatabases(ProjectProvisionSettings provset, SPSite pwaSite, String adminName, String adminEmail, ProjectDatabaseStateType&
originalDatabaseState, Guid& adminGuid)     --- End of inner exception stack trace ---     at Microsoft.Office.Project.Server.Administration.PsiServiceApplication.EnsureDatabases(ProjectProvisionSettings provset,
SPSite pwaSite, String adminName, String adminEmail, ProjectDatabaseStateType& originalDatabaseState, Guid& adminGuid)     at Microsoft.Office.Project.Server.Administration.PsiServiceApplication.CreateSite(ProjectProvisionSettings
provset) 5141bd37-50f2-495c-bcd6-d0804f08e3f0
Social Technet Microsoft.

We have found the problem. The organisation was asking us to reduce the number of Dynamic TCP Port.
Our setup was only 3,975
Netsh Int IPv4 Show Dyn TCP
Protocol tcp Dynamic Port Range
Start Port      : 1025
Number of Ports : 3975
We have use this command to raise the number of port available to 60,000
netsh int ipv4 set dyn tcp start=1025 num=60000
Everything is working now.
Social Technet Microsoft.

Event Log stopped working - Error 1747 : The Authentication Service is Unknown

I reccently noticed that my scheduled tasks were no longer running. I tried to bring up the task scheduler and it said the service was not running. I checked the service and sure enough, it was not running. I tried to start it and it failed because the windows event log service, which is a dependency, was also not running. I tried to start the event log service, and gave the error above in the subject line.
The event log service uses a log on of "Local Service". There are other services that use the same log on and they start up with no problem. I have searched the internet for a solution to this and have tried several things I found with no luck. One was to run SFC, another was to delete the Windows/Logs and Windows/System32/Logfiles folders so they would be re-created on startup. I also tried subinacl to reset the ACLs on registry branches and the subfolders of %SystemDrive% as recommeded in another forum.
I am running Vista Home Premium and all the latest updates have neen applied. Anyone have any further ideas? (short of re-installing Vista).
Thanks.

Hi there Robin. I am an IT Technician & felt that I needed to begin communication with you regarding this issue. I recently made a post in this thread detailing my issues & found resolution. I just wanted to share my post with you & hope that the information is useful to others that need to resolve these issues without re-installing their operating systems. Please find my post below:
Hi all. I am an IT technician & have recently been troubleshooting a customer's Windows Vista Home Premium laptop in a wireless home network.
In a nutshell the laptop suddenly stopped connecting to the wireless router; upon investigation I found lots of windows services were not starting; this sent me on a bit of a wild goose chase as this showed all signs of some kind of trojan / malware infection hogging the system. Here are some of the things I saw:
1). Norton 360 wasn't even running correctly & I was unable to view it's firewall status.
2). Windows firewall was disabled & I was unable to start it (service failed error message).
3). I was unable to view windows event logs & received "Error 1747 : The Authentication Service is Unknown"
4). Windows Side Bar was all blanked out & not showing any gadgets
5). I attempted a system restore but that failed (I saw references in system restore that the Bonjour service had been un-installed)
I did loads of further investigation & found this thread. It would appear that removing, or even trying to remove / un-install the Bonjour service may cause the above mentioned issues in windows Vista. I have not seen this kind of errata in windows XP.
I have heard of people pulling their hair out & re-installing the operating system possibly due to experiencing these issues.
Please Read On....
Resolution that worked for me:
I ran the Winsock corruption fix that is mentioned in previous threads as per microsoft's instructions found at the following URL: http://support.microsoft.com/kb/811259
Manual steps to recover from Winsock2 corruption for Windows Vista users
Winsock corruption can cause connectivity problems. To resolve this issue by using Network Diagnostics in Windows Vista, follow these steps:
1.
Click , and then click Network.
2.
Click Network and Sharing Center.
3.
In the Network and Sharing Center box, click Diagnose and Repair.
Note You may also access the Network and Sharing Center in Control Panel.
If the Network and Diagnostic tool was unable to find a problem, you can manually repair or reset Winsock.
Manual steps to repair or to reset Winsock for Windows Vista users
1.
Click , type cmd in the Start Search box, right-click cmd.exe, click Run as administrator, and then press Continue.
2.
Type netsh winsock reset at the command prompt, and then press ENTER.
Note If the command is typed incorrectly, you will receive an error message. Type the command again. When the command is completed successfully, a confirmation appears, followed by a new command prompt. Then, go to step 3.
3.
Type exit, and then press ENTER
Hey Presto!!!! After re-booting everything is back online & all necessary windows services & norton 360 are starting as normal.
Further Information on Bonjour Service:
http://en.wikipedia.org/wiki/Bonjour_(software)
As I understand & in my experience the Bonjour service is installed as a sub-aplet with certain 3rd party software applications including Apples itunes & Adobe newest Creative Suite 3 installs Apple’s Bonjour service even if you don’t install Version Cue. Its main goal is to provide zero-configuration connectivity between Version Cue server and the suite’s applications.
A bit more CSi & i've established how to un-install Bonjour service; there is a great topic on this subject at the following URL: http://www.raymond.cc/blog/archives/2008/02/10/how-to-uninstall-or-remove-bonjour-mdnsresponderexe/
Thanks to all for your post & input...it has really helped to get this issue resolved (well for me anyway) & has of course save a re-install!!!!
I will keep an eye on this thread...please post your resolutions / experiences to help others.
Kind regards

Audit/Log GPO changes and Logging of new addition of Domain Controllers in the Event Log

Hi all,
We am trying to log the following items in the event log for Windows 2012. This applies to a domain controller.
1) Audit any changes made to the Group Policy
2) Log the addition of new domain controllers added to the system.
We need the windows event log to record the above events for security purposes. Can anyone advise if this is doable? If yes what are the steps.
Thank you

Hi,
>>1) Audit any changes made to the Group Policy
We can enable audit for directory service object access and configure specific SACL for group policy files to do this.
Regarding how to step-to-step guide for auditing changes of group policy, the following two blogs can be referred to for more information.
Monitoring Group Policy Changes with Windows Auditing
http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447951.aspx
Auditing Group Policy changes
http://blogs.msdn.com/b/canberrapfe/archive/2012/05/02/auditing-group-policy-changes.aspx
>>2) Log the addition of new domain controllers added to the system.
Based on my knowledge, when a server is successfully promoted to be domain controller, event ID 29223 will be logged in the System log.
Regarding this point, the following thread can be referred to for more information.
Is an Event ID for a completed Domain Controller promotion logged on the PDC?
https://social.technet.microsoft.com/Forums/windowsserver/en-US/11b18816-7db0-49e2-9a65-3de0e7a9645e/is-an-event-id-for-a-completed-domain-controller-promotion-logged-on-the-pdc?forum=winserverDS
Best regards,
Frank Shen

My Application logs "The description of Event ID 0 from MyApp cannot be found" event to application event log

Hello,
This is regarding the following event logged by my application (MyApp.exe) to the application event log:
Log Name:      Application
Source:        MyApp
Date:          03/2/2015 12:00:09 PM
Event ID:      0
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Rajesh
Description:
The description for Event ID 0 from source MyApp cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
I have confirmed that the key "EventMessageFile" in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\MyApp correctly specifies the "dll" responsible for displaying events.
I would appreciate suggestions on the above.
Best Regards,
Rajesh K Singh

Hi All,
can you provide solution on below error.
The description for Event ID 17052 from source MSSQLSERVER cannot be found
Severity: 16 Error:0, OS: 0 [Microsoft][SQL Server Native Client 10.0]Unable to complete login process due to delay in opening server connection
Thanks in advance.
Vijay
Check below thread, information is not complete to actually comment what were you doing when you got this message.refer errorlog for more details
http://social.msdn.microsoft.com/Forums/en-US/9a41ced9-19ad-4c4f-83ac-7e877b699a8f/login-failure-error-in-event-log-daily
Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it.
My TechNet Wiki Articles

The event logging service encountered an error (res=5) ...

Hi,
I have promoted a new server to be a third DC.
All seems ok, replication, dns, etc are working properly but after the boot in the system event log I see those errors:
Log Name: System
Source: Microsoft-Windows-Eventlog
Date: 25.5.2012 14:32:15
Event ID: 23
Task Category: Service startup
Level: Error
Keywords: Service availability
User: LOCAL SERVICE
Computer: dc3.x.x
Description:
The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-API-Tracing/Operational.
and then for about 40 Microsoft channels:
The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-AppID/Operational.
The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-AppLocker/EXE and DLL.
The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-AppLocker/MSI and Script.
The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-Audio/CaptureMonitor.
The event logging service encountered an error (res=5) while initializing logging resources for channel Microsoft-Windows-Security-Configuration-Wizard/Operational.
etc...
There is no error event before those event id 23
Any idea?
Thank you

Have you checked the path of the System event log? Something similar happened to me once, turned out the log file was corrupted. I updated the path and created a new evt which solved the issue for me.
Hopefully this helps:
http://technet.microsoft.com/en-us/library/dd315662(v=ws.10).aspx

Webcache reports 'Connect failed errno = 146' in Event Log

Hi, when checking the webcache event log I keep getting the above message.
The webcache server and the application server are physically separate boxes on the same network. There is a firewall between them.
The webcache server runs purely webcache, the application server runs HTTP Server and OC4J. The connection from webcache to the application server is usually available but sometimes there is a timeout - which I'm assuming is related to the above.
I understand that a 146 error is a socket connection error.
Does anyone have any ideas on why I'm seeing this message and where I should start looking to sort it out ?
Thanks,
Paul.

You said "There is a firewall between them.".
That is probably the key issue here. Can you tell us what exactly is the firewall device. Is it transparent like some layer 3 or below device? With the given info, it is too wild to speculate what caused the connection failure. The problem is usually not in the application process running on the end system.

Decoding the Device Event log (LGLG)

Similar Messages

Maybe you are looking for