| Windows Event ID List and Fixing |
|
Event ID 1000 and 1001: If a multihomed domain controller does not have File and Printer Sharing bound to it, the following multiple problems are logged or displayed when you attempt to work with Group Policy objects on the domain controller:
2) SceCli 1001 Security policy cannot be propagated. Cannot access the template. Error code = 3. \\domain name\sysvol\domain name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
3) UserEnv 1000 Windows cannot access the registry information at \\domain name\sysvol\domain name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\registry.pol with (51).
4) Attempting to gain access to the Group Policy objects by using the Domain Security policy and the Default Domain Controller Security policy displays a "Group Policy Error" error message. The text of the message states: "Failed to Open Group Policy Object. You may not have appropriate rights. Details: The network path not found."
5) Attempting to access the Group Policy objects by using the Active Directory Users and Computers snap-in or Group Policy Editor displays a "Domain Controller for Domain domain name not found" error message. There are several options, none of which work.
6) Attempting to open the Sysvol share by using \\domain name\sysvol causes a "Remote Computer not available" error message.
RESOLUTION:
1) Change the binding order of
the network adapters so that the adapter that is listed at the top of the
Connections list has File and Printer Sharing bound to it.
2) Make sure
File and Printer Sharing for Microsoft Networks is enabled on the
interface.
3) Disable unplugged network adapters if you have more than one
adapters in the computers.
4) Restore \\winnt\sysvol
from a backup.
Event ID 1051: The DHCP/BINL service has determined that it is not authorized to service clients on this network for the Windows domain: yourdomainname.com
RESOLUTIONS:
1. Delete the DHCP on the router if you have two
DHCP, one on the router and another one on your MS server.
2. Delete the DHCP servers from Active Directory Sites and Services, and then
reauthorize the DHCP servers.
3. Authorize the DHCP servers by using Adsiedit.msc, which is an
administrative tool included in the w2k support tools CD.
Event ID: 2011 When accessing shares on a server from a client, you may receive "Not enough server storage is available to process this command." error. .
Resolution: The registry value IRPstackSize may be not explicitly present. To increase the value of the parameter, go to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ LanmanServer\Parameters. If the key is not present, choose Add Value in the Registry Editor. The Value Name should be IRPStackSize and the Data Type is REG_DWORD. Refer to MS Q106167 and Q177078 for more details.
Event ID: 3095 - Source: NETLOGON - This Windows NT computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.
RESOLUTION:
1. Since the Netlogon service should not be configured to start automatically on a
server that is not a domain member (a stand-alone server ora non-networked
Windows NT-based computer), configure the Netlogon service so that its
startup type is set to "Manual."
2. Make workstation service is running and restart
Event ID 4319: Duplicate Names on the Network
SYMPTOMS: When you start the computer, the NetBIOS name resolution over your Transmission Control Protocol/Internet Protocol (TCP/IP)-based network may not succeed, and Event Viewer may report Event ID 4319 with the following error message: A duplicate name has been detected on the TCP network. The IP address of the machine that sent the message is in the data. Use nbtstat -n in a command window to check which name is in the conflict state.
RESOLUTION:
1) To resolve this issue, delete the static WINS mappings and
clean (scavenge) the WINS database. To delete the static mappings, go to
WINS Manager>Mappings Static Mappings>WINS
Static Mapping, and then click Delete Mapping.
To clean the WINS database, click Initiate Scavenging
in WINS Static.
2) If the server is a multihomed WINS server, disable
the WINS client on one of the network adapters. To disable the WINS
client, go to Control Panel>Network>Bindings,
In the Show Bindings For list, click All
Adapters, right-click WINS Client (TCP/IP),
and then click Disable.
3) If the WINS service on WINS
server stops unexpectedly or does not start again after it is stopped.
Obtain the latest service pack for Windows 2000.
Event ID 4320 - Source: NetBT. Description: Another machine has sent a name release message to this machine probably because a duplicate name has been detected on the TCP network. The IP address of the node that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state. This article may also apply to Event ID: 4319.
Resolutions:
1. If two computers on the Network with the same name, use the nbtstat -n
command to find out these two computers, for example, using nbtstat -n to
check the name and ip of the local computer, and then using nbtstat -a command with the IP address to get
the another computer name.
2. If identical username is logging on to multiple computers, the usernames will register with a <03h>, and that
may cause the name conflict in the network. Ask the user to log off of all computers and log back on to just one
computer.
3. This may be occurred because of inactive or duplicate names in the WINS Database.
Go to the WINS server, check the database and delete the inactive or
duplicated names.
4. This my be occurred because of a possibly corrupted DHCP database.
To clear DHCP related entries or clean out old settings in the
registry, delete any .mib files, and then reinstall DHCP.
5. This may be occurred because of conflicting NICs in a Multihomed Computer.
To fix this problem, you may want to stop Computer Browser service or uncheck
one of Client for MS Network.
6. This may be ocurred because IPCONFIG /ALL returns incorrect host name. To
change computer name in the TCP/IP parameters section, run regedit.exe, and
locate the HOSTNAME value in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
\Parameters, and then edit the string data.
Event ID: 7024 - Source: Service Control Manager - The Net Logon service terminated with service-specific error 3095.
Resolution: refer to Event ID: 3095
Event id: 8021 - Source: Browser - Description: The browser was unable to retrieve a list of servers from the browser master <PDC> on the network \device\<protocol_netcard>. The data is the error code. Resolution: Fixing Browser Problem.