KB2878635 / EventID 5142, 5120

Hi there,
We are running a 4 node Windows 2012 Core Hyper-V Cluster with CSVs (free online available w2k12 core) . Since wie tried to backup the VMs at Cluster level using the built-in Windows Backup we are facing the the EventIDs 5142 & 5120 causing downtimes
of several VMs due to temporary loss of connectivity to the CSVs.
KB2878635 describes the issue and Powershell (get-hotfix) tells that the hotfix has not been installed yet. Once we try to install it, the Setup Routine tells us that the hotfix is not applicable to the Computer. We checked the file Versions on the System
compared to the Versions mentioned in the KB - the KB contains newer Versions...
Any suggestions?
Cheerio
Holger

Hi Holger,
" Most patches will be deployed in a .MSU format. To apply these under native Hyper-V/Server Core, run the following at a command-prompt: “WUSA patchname.MSU /QUIET”.
For details please refer to following link:
http://support.microsoft.com/kb/934307/en
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

How do I find the EventID of an event in a custom control?

Hi all,
I have a custom control created in VB .NET that I have embedded into a SAP screen using a wrapper class as described in Thomas Jungs example: <a href="/people/thomas.jung3/blog/2004/09/01/using-net-windows-controls-in-the-abap-control-framework .Net Windows Controls in the ABAP Control Framework</a>
My problem is that I cannot get the wrapper class to react to any events raised by the custom control!
I do not know how to find what the EventID is of an event so that I can register it in the class - do you know how to find this EventID? Or even if this is the problem?
Tx.
N

Is there any way to find the image dpi in a free or low cost program?

Error while trying to retrieve the task: EventId(complete) does not belong

Hi Experts,
I have created a process composer DC in which i have created a process with two human tasks.
Each tasks is binded with web dynpro Iviews (means followed all the steps neccesary).
I deploed the DC successfully. now i started the process and got a task in my UWL but on click of the task i got the below error.
Error while trying to retrieve the task: EventId(complete) does not belong to referenced component interface of ComponentUsage(com.sap.tc.bpem.wdui.appcontainer.containercomp.ContainerComp:com.infosys.mdm.LoadRepositoryComp, createOnDemand=false, childComponent=com.infosys.mdm.LoadRepositoryComp)
[EXCEPTION]
java.lang.IllegalArgumentException: EventId(complete) does not belong to referenced component interface of ComponentUsage(com.sap.tc.bpem.wdui.appcontainer.containercomp.ContainerComp:com.infosys.mdm.LoadRepositoryComp, createOnDemand=false, childComponent=com.infosys.mdm.LoadRepositoryComp)
I have rechecked the event that i have created in the component controller and Interface controller.
Can you please help me in debunging the error.
thanks
Narendra

Hi,
sounds like an program error. That is an problem which occurs if one or multiple components try to lock the same galaxy object at the same point in time. Did you configured something special on the given task? e.g deadlines?
My proposal is to open an Customer Message so that we can have a detailed look onto the system. If this is not possible could you please provide the complete trace file and some more details about the modeled task?
Best Regards
Andreas

Windows 7 Group Policy Processing - EventID 1058

I am having an issue with Windows 7 clients refreshing group policy. When I run gpupdate the user policy refreshes and the moves on to the computer policies but fails displaying the error below. Replication topology checks out, dcdiag returns
no errors and sysvol permissions look ok too. Curiously the same policies apply just fine on windows xp pro systems. The Domain Controller is running Server 2008 Enterprise Edt R2 SP1, I see no 1030 eventid's on the domain controllers as others
frequently report with this error. The domain is running at Windows Server 2003 functional level but I have creaded a PolicyDefinitions folder in the sysvol for admx files etc. Where to go from here? Does anyone have any suggestions/insight
as to what the issue may be?
The sysvol and the gpt.ini file is accessible from the Windows 7 client using UNC path.
Thanks in advance for any assistance given.
The error code listed is 0 which is not mentioned in this article
http://social.technet.microsoft.com/wiki/contents/articles/1456.aspx
## Error details
Log Name:      System
Source:        Microsoft-Windows-GroupPolicy
Date:          2/8/2012 2:38:09 PM
Event ID:      1058
Task Category: None
Level:         Error
Keywords:
User:          SYSTEM
Computer:      win7box.abc123.net
Description:
The processing of Group Policy failed. Windows attempted to read the file
\\abc123.net\SysVol\abc123.net\Policies\{EB062BE8-CAF6-47B4-9B8B-27A19268C520}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused
by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
    <EventID>1058</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-02-08T20:38:09.770740300Z" />
    <EventRecordID>3972</EventRecordID>
    <Correlation ActivityID="{24F60AA4-DC8D-4F6D-8787-9535072F03C0}" />
    <Execution ProcessID="996" ThreadID="1148" />
    <Channel>System</Channel>
    <Computer>win7box.abc123.net</Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data Name="SupportInfo1">4</Data>
    <Data Name="SupportInfo2">816</Data>
    <Data Name="ProcessingMode">0</Data>
    <Data Name="ProcessingTimeInMilliseconds">3354</Data>
    <Data Name="ErrorCode">0</Data>
    <Data Name="ErrorDescription">The operation completed successfully. </Data>
    <Data Name="DCName">DC.abc123.net</Data>
    <Data Name="GPOCNName">CN={EB062BE8-CAF6-47B4-9B8B-27A19268C520},CN=Policies,CN=System,DC=abc123,DC=net</Data>
    <Data Name="FilePath">\\abc123.net\SysVol\abc123.net\Policies\{EB062BE8-CAF6-47B4-9B8B-27A19268C520}\gpt.ini</Data>
</EventData>
</Event>
## DCDiag Results (No RODC's hence NCSecDesc error )
Directory Server Diagnosis
Performing initial setup:
   Trying to find home server...
   Home Server = DC
   * Identified AD Forest.
   Done gathering initial info.
Doing initial required tests
   Testing server: North\DC
      Starting test: Connectivity
         ......................... DC passed test Connectivity
Doing primary tests
   Testing server: North\DC
      Starting test: Advertising
         ......................... DC passed test Advertising
      Starting test: FrsEvent
         ......................... DC passed test FrsEvent
      Starting test: DFSREvent
         ......................... DC passed test DFSREvent
      Starting test: SysVolCheck
         ......................... DC passed test SysVolCheck
      Starting test: KccEvent
         ......................... DC passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... DC passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... DC passed test MachineAccount
      Starting test: NCSecDesc
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=ForestDnsZones,DC=abc123,DC=net
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=DomainDnsZones,DC=abc123,DC=net
         ......................... DC failed test NCSecDesc
      Starting test: NetLogons
         ......................... DC passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... DC passed test ObjectsReplicated
      Starting test: Replications
         ......................... DC passed test Replications
      Starting test: RidManager
         ......................... DC passed test RidManager
      Starting test: Services
         ......................... DC passed test Services
      Starting test: SystemLog
         ......................... DC passed test SystemLog
      Starting test: VerifyReferences
         ......................... DC passed test VerifyReferences
   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation
   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation
   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
   Running partition tests on : abc123
      Starting test: CheckSDRefDom
         ......................... abc123 passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... abc123 passed test CrossRefValidation
   Running enterprise tests on : abc123.net
      Starting test: LocatorCheck
         ......................... abc123.net passed test LocatorCheck
      Starting test: Intersite
         ......................... abc123.net passed test Intersite

I shortened this down a good bit but here is the gist of it, my question is which context/user/account is being denied access to the .ini files?  I have never used the streams utility but I'll give it a whirl and report back what I get. Most of
the cannot be accessed are probably just policies that are not applicable to the machine but the gpt.ini errors are baffling me.
New GPO - it appears that new GPOs are fine
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: Searching <cn={5D0EF3CD-7942-4A89-A879-4F9FDB3064BF},cn=policies,cn=system,DC=abc123,DC=net>
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: Machine has access to this GPO.
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: GPO passes the filter check.
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: Found functionality version of: 2
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: Found file system path of: <\\abc123.net\SysVol\abc123.net\Policies\{5D0EF3CD-7942-4A89-A879-4F9FDB3064BF}>
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: Found common name of: <{5D0EF3CD-7942-4A89-A879-4F9FDB3064BF}>
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: Found display name of: <gpoC-Win7Test>
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: Found machine version of: GPC is 0, GPT is 0
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: Found flags of: 0
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: No client-side extensions for this object.
GPSVC(3e4.80c) 12:43:27:510 ProcessGPO: GPO gpoC-Win7Test doesn't contain any data since the version number is 0. It will be skipped.
Older GPO's - not so fine
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={B34A8F23-269C-43D8-A097-2307729FBFF6},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: ==============================
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Searching <CN={55338992-95C9-4FA2-80E4-0ED4A623EE09},CN=Policies,CN=System,DC=abc123,DC=net>
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Machine has access to this GPO.
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: GPO passes the filter check.
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Found functionality version of: 2
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Found file system path of: <\\abc123.net\SysVol\abc123.net\Policies\{55338992-95C9-4FA2-80E4-0ED4A623EE09}>
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Found common name of: <{55338992-95C9-4FA2-80E4-0ED4A623EE09}>
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Found display name of: <gpoS-RealPlayerEnt6 - Security>
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Found machine version of: GPC is 0, GPT is 0
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Found flags of: 0
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: No client-side extensions for this object.
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: GPO gpoS-RealPlayerEnt6 - Security doesn't contain any data since the version number is 0. It will be skipped.
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: ==============================
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={C92FD413-E891-47E0-B554-BD7F9209D036},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={FEF33797-46D0-452A-B3D7-0BEEC2330592},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={CCBFECA5-2FF8-4512-8CE4-108C4092D009},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={767959D5-7AB6-4D55-A02E-3F54439CC7DA},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={10DCAC5E-9904-41FF-B678-E8514F481E56},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={3229FD3D-868A-4406-AFAF-6449ADBB4749},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={1DD39B5C-B930-4750-8EC3-42D0FB89A3B9},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={E10350D2-F632-4D5E-9668-4151596B1D77},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={86C864C5-C861-42FC-B728-BAEE81C9A091},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={FE1162BF-9FE2-4F04-A514-80A8E6D5F7CD},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={F68214D3-33F3-4F76-BE26-306D0237A048},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={CA6B06CE-C546-41F1-87FB-9013701AEF00},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={C8C9EFA2-90AA-4162-9051-23FD83B5CF62},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={DE445C4F-9A0F-488F-8769-C041CF2184AA},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={7CDB465C-55AC-4CBC-9C18-F3ADACDFEB46},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={F4E0F78E-BE36-4793-A8B1-83B2D67083F1},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={53359F0A-8C9B-4831-936F-3D47C4CC2694},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={6793DBEE-47B0-458D-8F1C-D92EB7015733},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={93919120-7113-47C0-AA38-0561EAB18E42},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={5ABD1D9E-07E4-4A53-B854-A2FFC3B257CB},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={71E2B86C-A4A0-47C0-9D7F-BDD6220B9FA4},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={4401CF1C-7839-4496-BB87-304A8AB917FC},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={1244CA5A-D654-4ED6-9374-148F1F3DA8ED},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={42875CF2-B9E9-4EFA-90C2-7ACA8882F1B7},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={6DD428B6-6B19-4A53-B172-57DB3E15A38E},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={983BFDAD-65F0-42B4-807A-E78DF275C352},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={AFA31A2D-07D8-4CB4-BE86-067A9624E324},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={77C9CA17-6359-4355-9FDF-F605F0441245},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={75D43291-6FA2-4B98-8422-228DDB45571B},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={870C6FB3-74CD-46E8-9D4D-E6E6C0A2B52D},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={2144E4CF-01C1-4C5B-984B-E9BD4461406F},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={7D9DB917-1245-46BD-AEBF-163A2F0FCD06},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={B7431941-5DAA-4DD2-A569-35C31B92B677},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={D01BF1D1-33C8-4FC3-95C3-5948A1EE1647},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={57D4AD83-3BBF-43C2-9A3B-F71F3E52C2A6},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={A8DB7DAC-42F0-43FC-99E1-F1AC15006101},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={56574927-6DC5-48A7-82F9-A00E820335F6},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={2FB6858E-8B1C-4C89-83B2-0EEE97D9A72B},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={93C56E3F-5334-4325-A328-0CCAFED0828B},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={1B64E00F-D3B6-49B6-B6C8-7AD0A8C9AEFA},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={81B4E46C-8249-4547-BC75-9A1FB395E282},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 EvalList: Object <CN={43D5184A-73C8-4BFD-9B09-33C70B8BC3C2},CN=Policies,CN=System,DC=abc123,DC=net> cannot be accessed
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: ==============================
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Searching <CN={0ABE0BCF-0BC5-481E-AC86-5768D00901D5},CN=Policies,CN=System,DC=abc123,DC=net>
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Machine has access to this GPO.
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: GPO passes the filter check.
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Found functionality version of: 2
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Found file system path of: <\\abc123.net\SysVol\abc123.net\Policies\{0ABE0BCF-0BC5-481E-AC86-5768D00901D5}>
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: Couldn't find the group policy template file <\\abc123.net\SysVol\abc123.net\Policies\{0ABE0BCF-0BC5-481E-AC86-5768D00901D5}\gpt.ini>,
error = 0x0. DC: DC2.abc123.net
GPSVC(3e4.80c) 12:43:27:541 ProcessGPO: ==============================
GPSVC(3e4.80c) 12:43:27:541 EvalList: ProcessGPO failed
GPSVC(3e4.80c) 12:43:27:541 GetGPOInfo: EvaluateDeferredGPOs failed. Exiting
GPSVC(3e4.80c) 12:43:27:541 GetGPOInfo: Leaving with 0
GPSVC(3e4.80c) 12:43:27:541 GetGPOInfo: ********************************
GPSVC(3e4.80c) 12:43:27:541 ProcessGPOs: GetGPOInfo failed.
GPSVC(3e4.80c) 12:43:27:541 ProcessGPOs: No WMI logging done in this policy cycle.
GPSVC(3e4.80c) 12:43:27:541 ProcessGPOs: Processing failed with error 87.
GPSVC(3e4.80c) 12:43:27:557 Application complete with bConnectivityFailure = 0.
GPSVC(3e4.80c) 12:43:27:557 Signalling 1 Refresh Policy callers
GPSVC(f84.df4) 12:43:27:557 Exiting RefreshPolicyForPrincipal with status = 0
GPSVC(3e4.80c) 12:43:27:557 GPLockPolicySection: Sid = (null), dwTimeout = 600000, dwFlags = 0
GPSVC(3e4.80c) 12:43:27:557 LockPolicySection called for user <Machine>
GPSVC(3e4.80c) 12:43:27:557 Sync Lock Called
GPSVC(3e4.80c) 12:43:27:557 Writer Lock got immediately.
GPSVC(3e4.80c) 12:43:27:557 Lock taken successfully
GPSVC(3e4.80c) 12:43:27:557 UnLockPolicySection called for user <Machine>
GPSVC(3e4.80c) 12:43:27:557 UnLocked successfully

Audit failure every 2 minutes on a W2K8 standalone Server in a Workgroup EventID 4625

Hello
By chance I discovered that every 2 minutes there is a login failure on my standalone (Workgroup) W2K8 R2 Server.
The administrator is disabled (login errors also appear when administrator user is enabled).
Could not find any tasks that are running with administrator credentials. It seems to me that it must be from the same machine, as the source IP Address is 127.0.0.1.
Does anyone have an idea?
Here the log:
An account failed to log on.
Subject:
   Security ID:       SYSTEM
   Account Name:       NS2308064$
   Account Domain:       WORKGROUP
   Logon ID:       0x3e7
Logon Type:           2
Account For Which Logon Failed:
   Security ID:       NULL SID
   Account Name:       Administrator
   Account Domain:       NS2308064
Failure Information:
   Failure Reason:       Unknown user name or bad password.
   Status:           0xc000006d
   Sub Status:       0xc000006a
Process Information:
   Caller Process ID:   0x20c
   Caller Process Name:   C:\Windows\System32\winlogon.exe
Network Information:
   Workstation Name:   NS2308064
   Source Network Address:   127.0.0.1
   Source Port:       0
Detailed Authentication Information:
   Logon Process:       User32
   Authentication Package:   Negotiate
   Transited Services:   -
   Package Name (NTLM only):   -
   Key Length:       0
Thanks & Regards
Chris

Hi,
This a forum for windows 7.
Please focus on one post to get better solutions.
http://social.technet.microsoft.com/Forums/en-US/5019d759-b497-44e4-a82a-4fefd4e367c6/audit-failure-every-2-minutes-on-a-w2k8-standalone-server-in-a-workgroup-eventid-4625?forum=winserversecurity
Thanks for your understanding!
Regards,
Ada Liu
TechNet Community Support

Unity Connection 10 - EventID: 0xC0000007 (7) - After 5 unsuccessful attempts to send a notification for subscription

hello,
i am receiving this event on MX:
this is showing ip address of my unity connection that is 172.20.101.22....
what could be reason and cause of it?
EventID: 0xC0000007 (7) - After 5 unsuccessful attempts to send a notification for subscription [EABtYngwMi5uaGljLmxvY2FsEAAAAIfIUmalt2VFie2S8ahJiKNZu5GtCIfRCA==] against endpoint [http://172.20.101.22:7080/NotificationService/services/NotificationService?id=33a00cf5-3f28-44e1-9d44-46b24da4bc2a&pid=14227], the subscription has been removed. Details: WebException: Unable to connect to the remote server Status: ConnectFailure at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult, TransportContext& context)
at System.Net.HttpWebRequest.EndGetRequestStream(IAsyncResult asyncResult)
at Microsoft.Exchange.Services.Core.NotificationServiceClient.CreateSendNotificationRequestAsync(IAsyncResult requestAsyncResult)

Navigate to CUC Administration, set the following under SMTP Configuration > Server, and give it another shot.
[V] Allow Connections From Untrusted IP Addresses
[ ] Require Authentication From Untrusted IP Addresses
-Mateusz

Exchange 2010 - EventID 2090&2102 on DC

Hi guys.
Exchange 2010 is installed on a domain controller (DC.domain.com).
Let's skip the part about telling me that Exchange 2010 installed on DC is not a wise idea and please help regarding this Event Viewer Warning:
EventID 2090
Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1188).
The configuration domain controller specified in the registry (DC.domain.com) is unreachable.
Exchange Active Directory Provider will select the configuration domain controller from the list of available domain controllers.
EventID 2102:
Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=1188). All Domain Controller Servers in use are not responding: DC.domain.com
dcdiag /s:DC.domain.com saids everything is fine.
Why is event viewer complaining then?
With best regards,
bostjanc

Hi,
Based on my research,
Event ID 2090 is just a warning message that indicates a particular server was configured, in the registry, to be used as the configuration domain controller and this server was not reachable. Usually, this event can be ignored.
However, if there is an accompanying MSExchangeDSAccess
Event ID 2102, the Exchange Services might not start. It would be a known issue when Exchange server installed in DC:
Service start up issues where Exchange services cannot start since AD is not available as the DC is still starting up.
To resolve it, the following blog mentioned a potential workaround about
Start up dependencies:
http://blogs.technet.com/b/rmilne/archive/2013/07/03/exchange-on-a-dc.aspx
Additionally, I still want to be verbose that it is not recommended to
install an Exchange server in a domain controller.
Thanks,
Winnie Liang
TechNet Community Support

Any idea, Eventid for Subnet creation\deletion in AD? Eventid for Site creation\deletion in AD?

Any idea, Eventid for Subnet created\deleted in AD? Eventid for Site created\deleted in AD?

If you just want to know when those sites and subnets have been created, you can just look at their whenCreated attributes. If you want to track subnet and site creation in real time, you need to enable the audit.
Enabling the audit consists of two steps:
Enabling the audit of the category of your choice. If you are using the
old way to performing auditing, it is the category Audit directory service access. If you are using the
advanced auditing (available since Windows Server 2008 and higher versions, more granular) you have two options. The category DS Access/Audit Directory Service Access and/or DS
Access/Audit Directory Changes. The first one generate the same eventid for creation and deletion: 4662. The second one have an eventid for the creation: 5137 and one for the deletion: 5141
These audit settings need to be applied on the domain controllers therefore you can do that through a group policy link at the appropriate level.
You need to configure the
SACL of the resources you want to audit. And tell you want to catch child object creation and child object deletion. I believe this is already configured by default for the CN=Sites on the configuration partition, so just make sure and you should be good
to go
I would recommended to go for the advanced auditing, make sure you follow the steps mentioned on the links I provided. If there is already a policy in place, make sure you are not breaking anything :)

Alert with EventId 33333 and Source DataAccessLayer

Hello!
I have developed an Outbound connector.
In occasions that are not still clear to me, this error exits in the Operations Manager log of my RMS (root mgmt server):
EventId: 33333
Source: DataAccessLayer
Description: Data Access Layer rejected retry on SqlError:
Request: AlertUpdate -- (AlertId=8b31fef8-103e-4ffd-b0a6-1b0cb670cc43), (BaseManagedEntityId=ac65b07f-82f4-1492-3925-09cf546b8951), (ResolutionState=0), (Owner=), (CustomField1=), (CustomField2=), (CustomField3=), (CustomField4=), (CustomField5=), (CustomField6=), (CustomField7=), (CustomField8=), (CustomField9=), (CustomField10=), (Comments=Message dispatched successfully), (TimeLastModified=6/8/2009 12:12:11 PM), (ModifiedBy=KRMCMESPE01\Administrator), (TicketId=), (ConnectorId=2f5adcde-631d-412b-bf9f-c200288546b1), (ModifyingConnectorId=), (RETURN_VALUE=-1)
Class: 16
Number: 777980200
Message: Request to update alert ignored due to invalid TimeModified
and my Outbound connector cathces this exception:
ConnectorMonitoringAlert's Update method failed.
System.Collections.ListDictionaryInternal
Request to update alert ignored due to invalid TimeModified
Microsoft.EnterpriseManagement.OperationsManager
   at Microsoft.EnterpriseManagement.Monitoring.MonitoringAlert.UpdateInternal(String comments, Nullable`1 modifyingConnectorId)
   at Microsoft.EnterpriseManagement.Monitoring.MonitoringAlert.Update(String comments)
   at SCOM_CS_WinSvc.ServiceCore.MonitorState(Object state)
Void UpdateInternal(System.String, System.Nullable`1[System.Guid])
I have already applied this patch:
http://support.microsoft.com/kb/957135
But still the error happens.
Some hint ?
Lizzie!

Hello!
Prorably your idea is the right solution but I need one more suggestion:
Currently I have a method that periodically check the alerts for the connector:
alerts = connector.GetMonitoringAlerts();
if (alerts.Count > 0)
foreach (ConnectorMonitoringAlert alert in alerts)
                       ...do...
I was thinking to put the alert.Refresh inside the foreach. Whad do you think ?

2008R2 Domain - Recently started receiving the old EventID 8003 Bowser in the System Log - Any ideas?

Hi All,
I've "googled" this to death and noted the registry keys that are associated with the "Computer Browser Service."
On the PDC:
IsDomainMaster = TRUE
MaintainServerList = Auto
On one of the Workstations noted in the EventID Logs:
MaintainServerList = Auto
There is no "IsDomainMaster" key on the Workstation.
In addition, I've looked for the "browstat.exe" utility, but after my google searches, it turns out that tool has been deprecated for 2008R2 and Win7. Our entire company is on Win7...
From what I've read, the logged 8003 messages are no big deal, but it seems odd that all of a sudden, late May, I started receiving these messages and I'm trying to retrace my steps. The DCs had not been patched at that time.
Thank you for your time,
Mr Mister

We can close this question.
From an elevated prompt, I ran 'fsutil resource setautoreset true' and attempted to remove the files with .blf and regtrans-ms file extensions from C:\Windows\System32\config\TxR. but these files were locked by system processes. (They are also
tagged with the hidden file attrib so you may not see them at first)
So, I booted the system with a Windows 2008 R2 Install Disk, selected repair OS and selected the command prompt. I then performed a chkdsk /f c: and selected "Y" to unmount the drive. It made some repairs.
With the system booted from the install disk, and chkdsk executed, the locks were freed and I was able to delete the files from C:\Windows\System32\config\TxR.
Once the system rebooted, the services came back fine and everything was back to normal.

ActiveDirectory_DomainService EventID 1481 Error

Dear All,
First of all: please apologize my weak English
I had a few strange warnings on internal processing yesterday in the directory service Eventlog on a RODC (2K8) in our branch office. After some head scratching, I decided
to run a integrity check on the ntds.dit - furthermore I've compacted the Database on the RODC - even knowing, there is an automatic process for that. At the end: no luck at all! - Long story short answer: I demoted the RODC.
To gain more information on the health state of the directory partitions, I turned on verbose loging for internal processing (log Level 5). In this mode I received many occurrences
of the following errors:
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          12.06.2014 14:13:14
Event ID:      1481
Task Category: Internal Processing
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      dc1.domainB.lan
Description:
Internal error: The operation on the object failed.
Additional Data
Error value:
2 000020EF: NameErr: DSID-03250105, problem 2001 (NO_OBJECT), data -1603, best match of:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS General" />
    <EventID Qualifiers="49152">1481</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>9</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-12T12:13:14.863Z" />
    <EventRecordID>608185</EventRecordID>
    <Correlation />
    <Execution ProcessID="616" ThreadID="4696" />
    <Channel>Directory Service</Channel>
    <Computer>dc1.domainB.lan</Computer>
    <Security UserID="S-1-5-7" />
</System>
<EventData>
    <Data>000020EF: NameErr: DSID-03250105, problem 2001 (NO_OBJECT), data -1603, best match of:
</Data>
    <Data>2</Data>
</EventData>
</Event>
and
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          12.06.2014 14:13:07
Event ID:      1481
Task Category: Internal Processing
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      dc1.domainB.lan
Description:
Internal error: The operation on the object failed.
Additional Data
Error value:
1 00002074: AtrErr: DSID-03120527, #1:
   0: 00002074: DSID-03120527, problem 1001 (NO_ATTRIBUTE_OR_VAL), data 0, Att 90204 (serverReferenceBL)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS General" />
    <EventID Qualifiers="49152">1481</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>9</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-12T12:13:07.534Z" />
    <EventRecordID>608174</EventRecordID>
    <Correlation />
    <Execution ProcessID="616" ThreadID="5276" />
    <Channel>Directory Service</Channel>
    <Computer>dc1.domainB.lan</Computer>
    <Security UserID="S-1-5-7" />
</System>
<EventData>
    <Data>00002074: AtrErr: DSID-03120527, #1:
   0: 00002074: DSID-03120527, problem 1001 (NO_ATTRIBUTE_OR_VAL), data 0, Att 90204 (serverReferenceBL)
</Data>
    <Data>1</Data>
</EventData>
</Event>
These errors are only displayed while verbose (debug) logging on "Internal Processing" and we have no known Issue with our ADDS Forest. But now I'm:
a) little bit concerned
b) Curious what's going on (I already know what the DSIS-%nr% represents and that object or attribute of objects were not found.
I'm just asking for your professional advice or help if needed, as I don't have much experience with this kind of errors.
kind regards
Basil
MCITP Enterprise Admin
MCSA Windows Server 2012
And some other stuff....

It could be (for example) a DC was promoted for a new DC in the forest and either the promote failed or the DC was removed before the global catalog was converged. Using this example, there would still be an object for this domain in the Configuration
NC yet to be cleaned up. With no other events to go on that would indicate this - or any other - root cause of the situation it's almost impossible to tell.
If you're really adamant about clearing this event, you could do a semantic database analysis on one of the DC's to see if that fixes it.
http://technet.microsoft.com/en-us/library/cc816754(v=WS.10).aspx
Otherwise I'd keep monitoring the DS logs to see if additional errors crop up indicating a problem. For now it sounds like the forest is probably ok. There might just be some "junk" in the database, but not likely a corruption.

Windows Server 2008 R2 Domain Controller NOT logging EventID 4740

EventID 4740 (account lockout) is not being logged to the event viewer. When searching through the security log there are none to be found. Having accounts locked out and no logging is driving me nuts. Hope someone has run into this before. This is what
i have checked thus far.
>Windows Server 2008 R2 Domain Controller
>Verified the following GPO settings are set and correct:
>Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\ all are set for Success & Failure
>Computer Configuration\Windows Settings\Security Settings\Advanced Audit Configuration\Logon/Logoff) is set for Success and Failure
>Powershell command Get-Eventlog -log Security -InstanceId 4740 returns no results which makes sense since there are no entries in the security log file.
>No 4740 entries in the netlogon.log debug file
AD and the LockoutStatus tool show the account is locked out but i still have nothing in the logs.
Anyone have any ideas? From everything i can find online , it appears i have everything set properly.
Thanks, Chico

Hi Chico,
I suggest you try to enable this group policy below:
Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit account management
More information for you:
Missing 4740 EventID's
http://social.technet.microsoft.com/Forums/windowsserver/en-US/c9871d72-7439-46b5-98e6-a7fadfa6ff28/missing-4740-eventids?forum=winserversecurity
If you have multiple Domain Controllers, check this event on other DCs, too.
Please feel free to let us know if there are any further requirements.
Best Regards,
Amy Wang

Get specific eventId from sensor using browser

Is there a way I can use just a browser (no java) to request only a specific eventId (alarm) from a sensor? XML results are fine. Thanks,
Matt

RDEP uses HTTP. I can, for example, pull a range events from a sensor using a normal browser with the following URL:
https:///cgi-bin/event-server?startTime=0077590400314257&events=evAlert+evError&maxNbrOfEvents=100&alertSeverities=medium&errorSeverities=error&mustHaveAlarmTraits=3,10-15&mustNotHaveAlarmTraits=2
this much is all nicely documented by Cisco in their CIDEE,RDEP, and SDEE specifications. The question though is can I pull a SINGLE known event from a sensor using an event Id?

DNS EventID 4015 on PDC since Domain Migration from 2003 R2 = 2012

Hi,
following problem here:
2 Domain Controllers with AD Integrated DNS Zone, migrated from 2003 R2 to 2012. One Single Root Forest.
The Primary Domain Controller shows every 2, 3 or 4 hours the DNS EventID 4015. No further error is available: (which is may emty) "".
Only on the Details pane you can find this Information:
======================================
- System
- Provider
   [ Name] Microsoft-Windows-DNS-Server-Service
   [ Guid] {71A551F5-C893-4849-886B-B5EC8502641E}
   [ EventSourceName] DNS
- EventID 4015
   [ Qualifiers] 49152
   Version 0
   Level 2
   Task 0
   Opcode 0
   Keywords 0x80000000000000
- TimeCreated
   [ SystemTime] 2013-12-10T19:48:17.000000000Z
   EventRecordID 2456
   Correlation
- Execution
   [ ProcessID] 0
   [ ThreadID] 0
======================================
The Migration was made by the following steps:
Bring Up the first 2012 MigrationDC as 3rd DC to the Domain.
Move the FSMO Roles to the 2012 MigrationDC
DHCP Data migrated with Server Migration Tools, IAS Data with iasmigrader.exe exported
DCPromo DC1 (2003 R2) and Format C:
Install a fresh 2012 Installation on old DC1 an rename it again with the original Name DC1
DHCP Data migrated with Server Migration Tools, IAS Data with iasmigrader.exe exported
DCPromo DC2 (2003 R2) and Format C:
Install a fresh 2012 Installation on old DC2 an rename it again with the original Name DC2
Move Back the FSMO Roles to DC1
DCPromo the first 2012 MigrationDC
Metadata Cleanup for MigrationDC
DCDIAG /V /C Shows no Errors, all works good, the funny Thing is, that only DC1 Shows the DNS EventId 4015 in production evironment. The only exception is, that if you reboot DC1 (i.e. for maintenance, upates etc) than the error appears on DC2. Exactly on
that time, if DC1 is temporarily not availble and DC2 is under "load". If DC1 is back again, the Event 4015 Ends on DC2 and Comes back to DC1!!!
I backupped and restored DC1 and DC2 in an lab Environment, the funny Thing is that the EventID 4015 doesnt appear in lab Environment. The difference between prod and lab is: prod is bare metal with 2 teamed nics, lab is hyper-v vm's with 2 virtual teamed
nics. same IP's etc... DNS NIC Settings are the same.
It Looks like you can only produce the error in the production lab if you have the DC under "load".
This Event was discussed here more than one time in the Forum, but the issues doesnt match 100% to my Problem. No RODC is available in my prod Environment, the EventID 4015 has no further Errors "" in the Eventlog like in other Posts.
Ace Fekays blog :" Using ADSI Edit to resolve conflicting or duplicate AD Integrated Zones" was helpful for metadata cleanup, but it could not fix the EventId 4015 away. Because we had no Problems with disappearing zones...
Maybe Enabling NTDS Verbose Logging in the registry is helpful, but i dont know for what i have to Keep an eye out?
The thread
http://social.technet.microsoft.com/Forums/windowsserver/en-US/c0d3adb4-67d2-470c-97fc-a0a364b1f854/dns-server-error-event-id-4015-after-replacing-domain-controller-with-another-using-same-name?forum=winserverDS seems to match to my Problem, but also no
soulution available...
Any ideas what causes this "ugly" Event without noticable consequences?

Zonenname
Typ
Speicher
Eigens
chaf
ten
Cache
AD-Domain
_msdcs.our-domain-name.com
Primary
AD-Forest
Secure
0.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
1.1.10.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
1.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
1.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
10.10.10.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
10.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
11.10.10.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
11.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
11.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
11.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
11.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
11.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
128.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
13.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
13.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
13.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
13.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
130.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
15.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
15.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
15.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
15.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
15.29.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
15.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
16.10.10.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
16.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
16.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
17.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
17.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
17.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
17.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
17.29.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
17.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
19.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
19.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
19.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
196.169.193.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
2.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
20.10.in-addr.arpa
Primary
AD-Domain
Secure
Rev
20.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
200.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
21.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
21.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
21.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
23.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
23.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
23.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
23.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
239.24.217.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
25.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
25.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
25.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
25.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
252.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
252.22.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
252.23.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
252.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
252.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
252.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.22.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.23.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.26.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.29.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
253.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.22.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.23.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.29.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
254.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
255.10.10.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
27.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
27.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
27.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
29.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
29.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.22.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.23.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.26.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.29.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
3.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
31.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
31.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
32.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
33.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
35.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
37.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
39.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
41.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
43.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
45.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
47.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
49.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.19.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.22.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.23.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.29.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
5.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
50.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
51.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
52.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
53.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
54.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
55.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
60.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
62.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
64.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.22.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.23.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.29.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
7.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
70.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
80.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
88.168.192.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
9.18.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
9.21.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
9.22.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
9.23.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
9.24.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
9.25.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
9.29.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
9.30.172.in-addr.arpa
Primary
AD-Domain
Secure
Rev
Aging
our-domain-name.com
Primary
AD-Domain
Secure
Agi
ng
TrustAnchors
Primary
AD-Forest

RRAS doesn't start. Error 8007042a. EventID 20103

Hi all.
When I install and enable the Routing and Remote Access service on a Windows 2008 R2 (with Remote Access and NAT), the service does not start (EventID 20103 - Unable to load C:\Winnt\System32\Iprtrmgr.dll).
In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RemoteAccess\RouterManagers\<protocol>\DllPath:
Value data: %SystemRoot%\System32\Iprtrmgr.dll
Iprtrmgr.dll is located in the C:\Windows\System32\
When I install RRAS without Remote Access, the service is start without errors.
Can anybody help me to solve this problem?
P.S. sorry for my bad english.

A complete solution to the RRAS won’t start with 8007042a or event ID 7024, aka the “routing remote access unable to load Iprtrmgr.dll” problem.
History: The history of this error, which has mostly gone unsolved, dates back to Windows 2000.
Platforms affected: Windows Server 2008 R2, Server 2008, Server 2003 R2, Server 2003, Server 2000 (both 32-bit and 64-bit installs are affected).
Error Messages:
Event ID: 7024 The Routing and Remote Access service terminated with service-specific error 2 (0x2).
Event ID: 7024 The Routing and Remote Access service terminated with service-specific error 31 (0x1F).
Event ID: 7024 The Routing and Remote Access service terminated with service-specific error 20205 (0x4EED).
Event ID: 7024 The Routing and Remote Access service terminated with service-specific error 193 (0xC1).
Event ID: 20103 Unable to load C:\WINDOWS\System32\iprtrmgr.dll . (32-bit installs).
Event ID: 20103 Unable to load C:\WINDOWS\SysWOW64\iprtrmgr.dll . (64-bit installs).
Cause: There are two basic causes for this error.
An incorrect key in the registry if you are running IPv6.
TCP/IPv4 corruption.
Related causes:
This has happened to me on a couple of Dell Windows 2003 R2 64-bit servers that had Broadcom NetXtreme II adapters. My problem was the second cause above, TCP/IP corruption, which I believe that happens for some reason when you install the driver for the
Broadcom adapter. It certainly may happen with other adapters, but there were definitely a high number of unsolved cases on the Internet with various Broadcom adapters.
Additional factors:
This happened even on clean installs as I tested using both the Dell-specific Windows Server 2003 R2 media, and Microsoft media downloaded from the Volume License site. It happens with either media.
Troubleshooting that did not work for me, or most people on the Internet:
Reinstalling clean.
Running sfc /scannow (I got no errors).
Comparing, and replacing, the iprtrmgr.dll’s from a working server.
Reinstalling the NIC’s after deleting them from Device Manager.
Running “NETSH INT IP RESET C:\reset.log” or “NETSH RESET WINSOCK”.
Running “NETSH WINSOCK RESET”.
Checking for ghost adapters after setting devmgr_show_nonpresent_devices=1 and then showing hidden devices in Device Manager (I had none).
Reregistering Oledb32.dll and Oledb32r.dll , and renaming C:\Windows\System32\ias \dnary.mdb, and ias.mdb files and restarting RRAS. Those files are located in the C:\Windows\SysWOW64 directory on 64-bit systems. This was in KB840696
http://support.microsoft.com/kb/840686.
Solutions:
If you have Server 2008, and are running TCP/IPv6, your problem is probably not TCP/IPv4 corruption, but rather that you have this extra key, HKEY_LOCAL_MACHINE\System\currentcontrolset\services\remoteaccess\routermanagers\IPV6, which you will remove after
you back it up by exporting it. Removing this key was an easy solution that widely helped many people on the Internet.
If you still want to use the TCP/IPv6 protocol you may have to do more. Since I did not apply to my server, and I could not test it, you may still have IPv6 corruption, and may want to troubleshoot by removing and reinstalling the TCP/IPv6,
akin to the solution below. The above solution may just be masking potential corruption by avoiding the issue.
If you are not running IPv6, the chances are that you have TCP/IPv4 corruption, and the solution is to reinstall it. If you have never noticed, if you try to uninstall TCP/IP, it is grayed out. To get around that, I followed KB 325356:
http://support.microsoft.com/kb/325356 . That says it is for a domain controller, but works on member servers also. The steps are:
Just in case, disable RRAS in the RRAS mmc, as this will uninstall it.
Backup your registry.
Ignore steps 1-4, and step 21 if you are just on a member server.
1.Restart the domain controller.
2.When the BIOS information appears, press F8.
3.Select Directory Services Restore Mode, and then press ENTER.
4.Use the Directory Services Restore Mode password to log on.
5.Click Start, and then click Run.
6.In the Open box, type regedit, and then click OK.
7.Locate the following registry subkeys:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2
8.Right-click each key, and then click Delete.
9.Click Yes to confirm the deletion of each key.
10.Close Regedit.
11.Locate the Nettcpip.inf file in %winroot%\inf, and then open the file in Notepad.
12.Locate the [MS_TCPIP.PrimaryInstall] section.
13.Edit the Characteristics = 0xa0 entry and replace 0xa0 with 0x80.
14.Save the file, and then exit Notepad.
15.In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
16.On the General tab, click Install, select Protocol, and then click Add.
17.In the Select Network Protocols window, click Have Disk.
18.In the Copy manufacturer's files from: text box, type c:\windows\inf, and then click OK.
19.Select Internet Protocol (TCP/IP), and then click OK. (Note: This step will return you to the Local Area Connection Properties screen, but now the Uninstall button is available).
20.Select Internet Protocol (TCP/IP), click Uninstall, and then click Yes.
21.Restart your computer, and then select Directory Services Restore Mode as mentioned in steps 2 - 4.
22.In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
23.On the General tab, click Install, select Protocol, and then click Add.
24.In the Select Network Protocols window, click Have Disk.
25.In the Copy Manufacturer's files from text box, type c:\windows\inf, and then click OK.
26.Select Internet Protocol (TCP/IP), and then click OK.
27.Restart your computer.
Configure and Enable Routing and Remote Access.
At this point, your RRAS should start.
Related problem and solution:
When I would enter a static IP address, although it would hold the static, the properties would reset back to “Obtain an IP address automatically”. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network and delete the Config key. Reenter
your static settings, and they should hold, and rebuild that Config key.
I hope this solves this difficult problem for many of you.
Best Regards,
Kevin Cotreau
MCSE+I, MSDBA, MCNE

KB2878635 / EventID 5142, 5120

Similar Messages

Maybe you are looking for