Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 100 Source: vmauthd

HLM took longer than expected. (time:51)
Note: The description for this error in your event log may be different.

- Error: "Cannot find perfmon object in array returned by perfDLL, index=4" - From  a newsgroup post: "I had been troubled by the same error for a long while, and recently I finally found out the cause and got it fixed. It turned out that for some reason the performance counters in "PerfOS.DLL" were disabled. Once they were enabled, vmauthd has no problem to retrieve those "perfmon" objects it needs, and the error goes away. To see whether your performance counters in "PerfOS.DLL" are disabled, you will need a program called Extensible Performance Counter List (exctrlst.exe). It can be found in the Support Tools folder on Windows XP Pro CD, or the Windows 2000 Resource Kit CD. If you don't have the proper CD, you can download it from Microsoft, just follow the link below. After you install the program, run it and set the "Sort Order" to "Counter ID". You should see "PerfOS" near the top of the list. Click on it, and its status will be displayed at the bottom part of the dialog window. If the "Performance Counters Enabled" checkbox is unchecked, that means your PerfOS counters are disabled. You can simply check the box and press the "Refresh" button. Now start or restart your "VMware Authorization Service", and watch the "Application Event Log" to see whether the vmauthd error stops".

Some users suggested that stopping (or preventing from starting) the VMWare Authentication Service has helped them to get rid of this error. You can set this service to manual.
Error: Malformed perfmon object, index=5 - See EV100294 (Host CPU usage spikes to 100% and issues Event ID 100).
Error: Cannot connect to VMX: E:\vpcse\eos3c1\Clone of eos3c.vmx - From a support forum: I found a solution having struggled with this for some time and frequent uninstall/reinstall cycles which were driving me nuts. I'm running Vista 64-bit and Workstation 6.03.  

It's a permissions issue with the local user and the way you effect the solution may depend whether or not you are connected to a domain controller. Since I am, this is the solution you get:

First be aware that you will need elevated (aka administrator) permissions to be able to perform some of these actions.

If you go to Control Panel, Administrative Tools, Computer Management and browse to Local users and groups, you should find a user called __vmware_user__.  I opened up this user and copied the name to ensure no typing errors.

Now you need to find your Group Policy Editor which you can view, but possibly not be able to edit, locally by typing gpedit.msc into the Vista search box (Start button, Start search). Navigate down the tree: Local computer policy, Computer Configuration, Windows Settings, Security Settings, Local Policies, User Rights Assignments. At this point you may find a padlock on the User Rights Assignments folder. However since you're here, at least check out the problem. Go to Allow log on locally and check to see if __vmware_user__ is in the list. If it isn't that's part of the problem, so if you can edit this record, append the __vmware_user__. Then go to Log on as a service and check to see if the __vmware_user__ is in the list. Again, if that user is missing and you can edit it, then append it. If you've been able to edit, then that should sort it out.

If you haven't been able to amend the records that means you have to edit the Domain Group Policy for which you have to go to you domain controller (note: my domain controller is running Windows 2003 so I can't say what would happen on other platforms) and find Active Directory Users and Computers under Administrative Tools. Right-click on the domain object ( to get the context menu and then left-click on Properties. Click on the Group Properties tab and then the Open button (if that's not there, I can't help you).

Navigate down Group Policy Management, Forest:, Group Policy Objects, Default Domain Policy and then select the Settings tab. Click on Windows Settings, Security Settings, Local Policies/User Rights Assignment. Right-click on Allow log on locally and then left-click Edit. This takes you to a new dialogue box which you navigate down Default Domain Policy, Computer Configuration, Windows Settings, Security Settings, Local Policies, User Rights Assignment. Add the __vmware_user__ account to both Allow log on locally and Log on as a service.

There's probably a quicker way but I'm a software developer not an IT geek with tons of Group Policy experience. It worked for me, hopefully it will work for you.
In my case, the description of the event is "Cannot connect to VMX: C:\Virtual Machines\ReactOS-0.3.10-VMware\ReactOS.vmx". This error appears each time I try to login to VMWARE Server 2.x
The only solution I found is to disconnect from network then login to VMWARE.
In our case, the host computer (Server 2003 in a domain environment) did not authenticate with a domain controller. Restarting the host fixed the problem. Another indication that this is an authentication related issue is the VMware error #511 that comes up as a pop-up message, when attempting to start a VMware Server. Watch for authentication related errors from Schannel #36870.

* * *

Running VMware Server version 1.x.x. Event 100 from -vmauthd- service was accompanied by an error on the screen "511 error connecting to ..\VMwareServer\vmserverdWin32.exe process" try the following:

1. Check if you are authenticating to a domain controller or are you running with cached credentials.
2. In the ADU&C for your domain, in the "Users" container, add _VMware_user_ to a Domain Admin group. If this represents too much of security elevation, you may need to experiment with minimum security required for the _vmware_user_.
3. Must restart the "VMware Authorization Service"
4. If you are running in a multi-domain forest, you must make sure that your Global Catalogs are operational.

In general this error seems to be caused by _vmware_user_ authentication failure, so all other authentication troubleshooting steps apply
5. Make sure your time is synched with the PDC.

In my case, VMware was trying to access network adapters but the adapters were unfortunately missing the "VMware Bridge Protocol", thus, causing the vmauthd service to fail. In your Network Connections folder, go to the properties of each network adapter (except the virtual VMware adapters...VMnet1, VMnet8, etc). Under the "This connection uses the following items:" section, be sure you have "VMware Bridge Protocol" installed and that it is checked. If it is not installed, click "Install" --> "Service" --> "Add" --> "Have Disk" --> Browse to your "C:\Program Files\VMware\VMware Workstation". Click OK. This should find the netbridge.inf file and let you choose the Bridging protocol again.
In my case, simply restarting the "VMware Authorization Service" resolved the problem.
- Description: "Error 1326 authenticating user <user ID>" - This error stands for "Logon failure : unknown username or bad password".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.