|
Home | Site Map | Cisco How To | Net How To | Wireless | Search | Forums | Services | Setup Guide | Careers | About Us | Contact Us| |
||
|
|
Event ID
over 10000 Event ID from 1 to 999 Event ID from 1000 to 1999 Event ID from 2000 to 2999 Event ID from 3000 to 3999 Event ID from 4000 to 4999 Event ID from 5000 to 5999 Event ID from 6000 to 6999 Event ID from 7000 to 7999 Event ID from 8000 to 8999 Event ID from 9999 to 9999
Event ID 10002 - Scheduled Backup Does Not Run
Event 10004 Logon failure: unknown user name or bad password Event ID 10009 DCOM was unable to communicate with computer Event ID: 10010 - DCOM Windows 8 Event ID 10010 Event ID 10016 - DCOM Event ID 10016: permission settings do not grant windows 2008 with Event ID 10016 Event ID 10010 and 10016 - DCOM Server did not register with DCOM with Event ID 10010 Event Viewer ID: 482. 6004, 16217, and 17004 Error 10698 Virtual machine could not be live migrated Event ID 2088 and 11001 No such host is known Event ID: 11000 - Proxy service and Firewall service do not start Event ID: 11165 - The system failed to register host (A) resource records (RRs) for network adapter with settings Event ID 11166 Logon Failure target account name is incorrect Event ID 11722: There is a problem with Windows Installer Hyper-V Event ID: 32, 12010 and 12570 - can't start VM VM failed to start with Event ID 12140, 12010, 12030 Hyper-V error Event IDs: 12140, 12620, 14140 Event ID 12080: The system cannot find the path specified VSS Event 11 and 12292 are logged - 8004230f Hyper-V Event ID: 32, 12010 and 12570 - can't start VM Can't start VM with Event ID 12010 and 12240 Fixing Event ID 12294: The SAM database was unable to lockout the account of Administrator due to a resource error EVENT ID 12317 MESSAGE File Server Resource Manager failed Event ID 12240 and 12667 regarding USB storage Troubleshooting Event ID 12344 and 8229 Event ID 12610 - Cannot attach storage media to the controller because the specified location is in use Event ID 12611 - Cannot attach storage media to the controller because the specified location is in use Hyper-V error Event IDs: 12140, 12620, 14140 Hyper-V VM can't get information with Event ID 12620 Live Migration fails with error Event ID 12711 Event ID 13042 appears in SBS 2008 Event id 13508 - The File Replication Service is having trouble enabling replication Event ID 13508: The File Replication Service is having trouble enabling replication from DC2 to DC4 for c:\windows\sysvol\domain using the DNS name Event ID 2000: The server's call to a system service failed Windows 2008 DC logs Event ID 13509 Event ID: 13550, 13552 and 13555 - The File Replication Service errors Event ID 13559: replica root path has changed Domain replication Issue with Event ID 13559 Event ID 13562 - NtFrs New DC never shares sysvol or NTDS and gets Event 13565 Event ID 13566, 13552, 13555 Event ID 13568 - The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR Event ID 13560: Service is deleting this computer from the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" as an attempt to recover from the error state, Event ID 13561: The File Replication Service has detected that the replica set "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" is in JRNL_WRAP_ERROR New DC never shares sysvol or NTDS and gets Event 13565 Event ID14068: Hyper-V network unbind failed, error=2147749993, mof code=0 Event ID 14114: Timed out trying to acquire network configuration lock, current owner = 'nvspwmi' Event ID: 14127 -Proxy service and Firewall service do not start Hyper V network Event ID 14128Event ID 14128 14132: A protocol other than the Microsoft Virtual Network Switch Protocol has been bound to NIC 'Broadcom BCM5709C NetXtreme II GigE (NDIS VBD Client)' but the NIC is being used by a virtual switch. Event ID 14140 - failed to add device 'Microsoft Synthetic Disk Drive' Hyper-V VM failed to add device with Event ID 14140 Hyper-V error Event IDs: 12140, 12620, 14140 Event ID 16300: Cannot load a virtual machine configuration dfssvc 14526 warning event and 14529 event on the PDC Event ID 15350: The virtualization infrastructure driver (VID) is not running after Windows update windows DC log Event ID 16397 Event ID 3040, 4096, 3070 and 16410 - Microsoft-Windows-Hyper-V-Config Event ID 16410can't access the data folder of VM Event Viewer ID: 482. 6004, 16217, and 17004 Event ID Error: 17836, Severity: 20, State: 1 SQL Backup failed with Event ID 18204 Event ID 18456: Login failed Event ID 20000: Old OTAKEYGEN packet is cancelled, Tag=12 Event ID: 20035 - Remote Access Connection Manager failed to start because it could not create buffers. Restart the computer. Access is denied. Event ID 20049 - An invalid request was sent to the admin support thread for Remote Access Service... Event ID 20050 - The user Domain\User connected to port VPNx has been disconnected Event ID 20050 The user Domain\User connected to port VPNx has been disconnected - Case study Event Log Error 20050 with SBS 2003 Event ID 7023, 20063, 20151 and 20070 - Can't create VPN on Vista Event ID 20073 - There are no authentication protocols available for use Event ID 20078 - The account for user \username connected on port VPN3-127 does not have Remote Access privilege. Event ID 20078 and 20189 Event ID 20103 and 20133 - RRAS Fails to Start Event ID 20100: VM Management Service failed to register Hyper-V live migration failed with ID 20201, 20126, 20134 21114, 21502 Event ID 20159 - The connection to <connection_name> made by user <user_name> using device <com_port> was disconnected. Event ID 20169 - Unable to contact a DHCP server Event ID 20189 - The user \username connected from x.x.x.x but failed Event ID 20097 and 20111 Event id 20106 - Unable to add the interface Internal with the Router Manager for the IP protocol. Event ID 20194 - The reason for disconnecting was user request Hyper-V live migration failed with ID 20201, 20126, 20134 21114, 21502 Event ID 20209 - A connection between the VPN server and the VPN client has been established, but the VPN connection cannot be completed. Event ID 20314: Device ID used to be 308EA696 but is now blank Accessing RDS slow with Event ID 20499 Event ID 20460: [SRP] Connection failed Hyper-V live migration failed with ID 20201, 20126, 20134 21114, 21502 Event ID 21111, 21502 and 20122: VM live migration did not succeed at the source Event ID 21502: VM Configuration failed to register Event ID 1069,1205, 4683 21502 related to failover Cluster error Event ID: 521, 1, 24583 Event ID 27745 - Windows SharePoint Services 3 The Event Viewer may have this event ID 29212 Event ID 32020: Hyper-V did not allow the operation for virtual machine 'Servername' because test failover is enabled - Resolution with screenshots Event ID 32784: The WS-Management service cannot process the request Event ID 33808: An error occurred while processing a B2D command. Drive: ReadMTFData() ReadFile failed. Error=1450 Event ID 33919 - The automated credentials test failed for the following server or servers - Resolution with screenshots Event ID 34113: The job failed with the following error: The backup storage device has failed - Resolution with screenshots Event ID 36881: The certificate received from the remote server has either expired or is not yet valid. The SSL connection request has failed. The attached data contains the server certificate Event ID 36882: untrusted certificate authority Event ID 36887: The following fatal alert was received: 48 Event ID= 36887, Schannel Fatal Alert Error 48: Event ID: 36887 The following fatal alert was received: 0 Event ID 36888 - The internal error state is 10. Event ID 36888 - The internal error state is 1203 Event ID 40960: The Security System detected an authentication error for the server LDAP. The failure code from authentication protocol Kerberos was The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested. Event ID 40961 - The Security System could not establish a secured connection with the server ldap/Computername.domain.com. No authentication protocol was available. Event ID 40961 and 153 Event ID 50000: Controller: This BES Agent is under control of BlackBerry Agent Controller Event ID 50049: Waiting for external UDP log messages on port 4085 Event ID 50079: 2 user(s) failed to initialize Event ID 50076: Starting BlackBerry Mailbox Agent 1 for Server BES - Version 4.1.2.23 Event ID 50096: [SRP] Dispatcher\SRP Connection established Event ID 57665: Insufficient system resources exist to complete the requested service - Resolution with screenshots Event ID 57860 - An error occurred while attempting to logon Event ID 57860: SQL Server does not exist or access denied Event ID 58117: Backup Exec Remote Agent didn't start The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.
Resolution:
1. Synchronize the computer with the DC. Event ID 41 - Description: The file system structure on the disk is corrupt and unusable. Causes: 1. The
CPUs in your computer are not all at the same stepping level, and
Windows writes an informational message to the Event log. Event ID 1000 and 1001 - Windows cannot read the history of GPOs from the registry - The computer has rebooted from a bugcheck. - Security policy cannot be propagated. - The Group Policy client-side extension Security was passed flags (17) and returned a failure status code of (3).
If a multihomed domain controller does not have File and Printer Sharing bound to it, the following multiple problems are logged or displayed when you attempt to work with Group Policy objects on the domain controller:
1)UserEnv 1000 The Group Policy client-side
extension Security was passed flags (17) and returned a failure
status code of (3).
2) SceCli 1001 Security policy cannot be propagated. Cannot access the template. Error code = 3. \\domain name\sysvol\domain name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf. 3) UserEnv 1000 Windows cannot access the registry information at \\domain name\sysvol\domain name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\registry.pol with (51). 4) Attempting to gain access to the Group Policy objects by using the Domain Security policy and the Default Domain Controller Security policy displays a "Group Policy Error" error message. The text of the message states: "Failed to Open Group Policy Object. You may not have appropriate rights. Details: The network path not found." 5) Attempting to access the Group Policy objects by using the Active Directory Users and Computers snap-in or Group Policy Editor displays a "Domain Controller for Domain domain name not found" error message. There are several options, none of which work. 6) Attempting to open the Sysvol share by using \\domain name\sysvol causes a "Remote Computer not available" error message.
RESOLUTION:
|
Symptoms: your w2k/xp clients may receive this Event ID 1053 - Windows cannot determine the user or computer name. (<error description>). Group Policy processing aborted. Or error: "The specified user does not exist." |
Resolutions: 1.
Make sure that your internal DNS server is the server for the domain
you are logging in to.
2. Verify the DNS Settings. This will occur if your DNS server is
unable to resolve information about your domain.
3. Delete the problem computer from DNS records and re-create it.
Symptoms: when logon TS, System Event Viewer may receive the above messages.
Resolution: 1. Install the printer drive in the TS server.
2. You have to edit the Ntprint.inf file to fix this problem.
1. Windows 2000 domain controllers running Terminal Services configured to use Remote Administration mode do not permit regular user logon, with the exception of two concurrent administrator accounts for server management. When a user attempts to connect to a Windows 2000-based domain controller running Terminal Services configured to use Remote Administration mode, the following error message is generated: You do not have access to logon to this Session.
2. Windows 2003 domain controllers running RDC do not permit regular user logon, with the exception of administrator accounts.
3. The user attempting to log on does not have sufficient permissions on the appropriate RDP-TCP connection. Modify the RDP-TCP permissions by using Terminal Services Configuration to grant the user or group the logon permission.
4. Terminal Services has a default connection security setting allows only administrators to log on. If the security attributes on a specified connection have not been set, the connection inherits these default security settings.
Error 1311 - There are currently no logon servers available to service the logon request
Symptoms: The primary purpose of logging on with cached credentials is to enable you to access the local workstation. However, if you have logged on by cached credentials, you may be unable to access network resources because you have not been authenticated. For example 1) after you log on to a w2k/xp laptop by using cached credentials, you may be unable to access the network resources. This issue is commonly experienced by laptop users whose computer resides in a Windows Server domain and who log on to the computer by using cached credentials prior to being able to establish a remote access connection. 2) You log on to a w2k/xp laptop with a domain logon option in a workgroup network. After you establish the connection and you try to map the network drives, the operation may be unsuccessful, and you may receive the following error message: "System Error: (1311) There are currently no logon servers available to service the logon request."
Case Study - There are currently no logon servers available to logon your request
Event ID: 2011 When accessing shares on a server from a client, you may receive "Not enough server storage is available to process this command." error. .
Resolution: The registry value IRPstackSize may be not explicitly present. To increase the value of the parameter, go to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ LanmanServer\Parameters. If the key is not present, choose Add Value in the Registry Editor. The Value Name should be IRPStackSize and the Data Type is REG_DWORD. Refer to MS Q106167 and Q177078 for more details.
Symptoms: Some
hardware like 3COM Dynamic Access Protocol and USRobotics PCI
56K faxmodem, and software such as Symantec's Norton AntiVirus, Open
File Manager and overloading services can cause to leak non-paged
pool memory. You may get the following symptoms.
1.You may receive Event ID 2019, "The server was unable to allocate
from the system non-paged pool because the pool was empty".
2. Your server may lose network connectivity with its clients and
report the following errors in the event log: Event ID: 2020, "The
server was unable to allocate from the system paged pool because the
pool was empty".
3. Event ID: 2021: Server was unable to create a work item n
times in the last seconds seconds.
4. Event ID 2022: "The server was unable to find a free connection 4
times in the last 60 seconds".
5. Your server may stop accepting new user connections and you may
receive this message "Windows cannot logon you because the profile
cannot be loaded. Contact your network administrator. DETAIL -
Insufficient system resources exist to complete the requested
service."
6. You may receive the following error: "Not enough storage
available to process this command".
7. If you keep getting above errors without fixing, the
server may need to reboot.
Resolutions: 1.
Apply the Latest Service Pack.
2. Apply the Latest Device Driver Updates.
3. Examine the Hard Disks for Errors and Defrayment the Hard Disk
Drives.
4. Upgrade or apply SP to the suspect software.
5. Try to maximize the resources that can be made available to the
Server service. This may eliminate the error messages or only lessen
the frequency of the errors.
Causes: Netlogon Issue
Symptoms: 1.
When you double-click My Network Places in a
client, an incomplete browse list is displayed.
2. Computers that do not have file and printer sharing turned on do
not appear in the browse list.
3. Windows client that try to use the browse list gets Event ID 8021
or 8032:
4. On the domain controller that does not have file and printer
sharing turned on gets Event ID: 2504 or Event ID: 2505
Cause: This update helps resolve an issue on computers running Windows XP Service Pack 2. Programs that connect to IP addresses in the loopback address range may not work as expected and you may receive an error message indicating you cannot establish a connection.
Event ID: 3095 - Source: NETLOGON - This Windows NT computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.
1. Since the Netlogon service should not be
configured to start automatically on a server that is not a domain
member (a stand-alone server or non-networked Windows NT-based
computer), configure the Netlogon service so that its startup type
is set to "Manual."
2. Make sure workstation service is running and restart
Symptoms: After install or uninstall some services or patches, you may receive some the following messages:
Event ID : 4119 Source : TCP/IP Description: IP could not open registry key for NdiswanX. -or- Event ID : 4311 Source : NetBT Description: Initialization failed because the driver device could not be created.
Event ID 5701 - The Netlogon service failed to update the domain trust list
Netlogon Event ID 5701: The Netlogon service failed to update the domain trust list. The following error occurred: There are currently no logon servers to validate the logon request.
Causes: 1. You may have exhausted
the NetBT datagram buffer.
2. This error can be caused by a failing NIC or
defective device driver.
Event ID 5774, 5775 and 5781 - Netlogon
Symptoms: you may find Event ID 5774 and 5775 - Registration of the DNS record '<dns record>'. 600 IN SRV 0 100 3268 <domain name>.' failed with the following error: <error description>.on your AD with DNS server.
Resolutions: 1.
Make sure
the Domain Controller points to itself as a DNS
server.
2. If you have two NICs on this server, disable one of them
or point all NICs to the internal DNS.
3. If you just upgraded the server or changed the IP, you
may need delete the problem record manually and restart the
NETLOGON service.
Symptoms: when attempting to logon a domain, you keep getting an error that "The system cannot log you on now because the domain "name" is not available." Also, Event viewer shows Event ID: 5719. No Windows NT or Windows 2000 Domain Controller is available for domain <domain name>. The following error occurred: There are currently no logon servers available to service the logon request.
Resolutions: One possible cause of this error is that you have run out of buffer space in the NetBT datagram buffer. To resolve this problem, increase the MaxDgramBuffering value from 128 KB to 256 KB. Run Regedt32.exe, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters. On the Edit menu, click Add Value, and then add the following information:
Value
Name: MaxDgramBuffering
Data Type: REG_DWORD
Value: 0x40000
Refer to 072704RL
Event
ID 5805 - Net Logon
Cause: A machine account
failed to authenticate, which is usually caused by
either multiple instances of the same computer name, or
the computer name has not replicated to every domain
controller.
Event ID: 7024 - Source: Service Control Manager - The Net Logon service terminated with service-specific error 3095.
Resolution: refer to Event ID: 3095
Resolutions: 1. Make sure Remote Access Connection Manager service, Remote Access Auto Connection Manager, and the Telephony service are enabled and running.
2. If the server is running IAS, you may have this issue if the Oledb32.dll and Oledb32r.dll files are incorrectly registered.
3. If the server is running ISA, it is better to use ISA instead of RRAS.
4. This can be caused by a third-party program installed on the computer. In this case, you may want to remove RRAS and Reinstall it.
5. You may try rarepair.exe download it here.
6. If you don't use IPX, delete IPX from HKEY_LOCAL_MACHINE>System>CurrentControlSet>Services>RemoteAccess>RouterManagers.
7. If you use IPX, manually set the internal network number and specify Manual Frame Type Detection for the properties of the NWLink IPX/SPX Compatible Transport.
Event id: 8021 - Source: Browser - Description: The browser was unable to retrieve a list of servers from the browser master <PDC> on the network \device\<protocol_netcard>. The data is the error code. Resolution: Fixing Browser Problem.
Event ID 20078 - The account for user <username> connected on port VPN# does not have Remote Access privilege. The line has been disconnected. Event ID 20189 - The user <username> connected from x.x.x.x but failed an authentication attempt due to the following reason: The user tried to connect using an unauthorized dial-in media.
Causes: 1. No dial-in permission. 2. Incorrected logon ID. 3. Check Error 649 resolution.
Event ID 20073 - The following error occurred in the Point to Point Protocol module on port %port%. There are no authentication protocols available for use.
Cause: 1. The RRAS
server's authentication and encryption settings are set to require
Microsoft encrypted authentication and you are using Remote
Authentication Dial-In User Service (RADIUS) as your authentication
provider.
2. Both client and server have different Authentication Methods.
Re: RAS/VPN Event ID 20049, Event ID 20073 and Error 619
Event ID 20097 -
A Demand Dial connection to the remote interface <interface name> on
port VPNx-y was successfully initiated but failed to complete
successfully because of the following error: The L2TP connection attempt
failed because security negotiation timed out.
Event ID 20111 -
1. A Demand Dial connection to the remote
interface ToChicagoTech on the port VPNx-### was successfully initiated
but failed to complete successfully because of the following error: No
more connections can be made to this remote computer at this time
because there are already as many connections as the computer can
accept.
2. A Demand Dial connection to the remote interface ToChicagoTech on the
port VPNx-### was successfully initiated but failed to complete
successfully because of the following error: The remote computer did not
respond.
3. A Demand Dial connection to the remote interface ToChicagoTech on the
port VPNx-### was successfully initiated but failed to complete
successfully because of the following error: There was no answer.
Cause: 1. The certificate on the VPN server is
not a valid machine certificate or is missing.
2. The IPSec Policy Agent service is stopped.
3. Enable the user to allow dial -in.
4. Too many connections.
5. No connections between two sites.
6. Incorrect routing table.
7. Also refer to RAS Error 792 or Error 781.
Event id 20106 - Unable to add the interface Internal with the Router Manager for the IP protocol.
Resolutions: 1. Make sure you have correct interface setup, for example, no NIC using 169.254.x.x IP and no 1394 interface.
2. Make sure no NIC of the RRAS is disabled.
3. If the RRAS server is configured only for LAN routing, you can ignore the event.
4. The interface type is not dedicated.
5. The loopback and router is configured in Lanonly mode
Post your questions, comments, feedbacks and suggestions
Related Topics
Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here!
Bob Lin Photography services
Real Estate
Photography services
|
This web is provided "AS IS" with no warranties.
Copyright © 2002-2021
ChicagoTech.net,
All rights reserved. Unauthorized reproduction forbidden.