Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1006 Source: Dhcp

Your computer was unable to automatically configure the IP parameters for the Network Card with the network address <MAC address>. The following error occurred during configuration: WSAStartup cannot function at this time because the underlying system it uses to provide network services is currently unavailable. .
0000: 6b 27 00 00
This type of event can be recorded with various error messages and each of them has a different cause. The data portion of the event can be used to obtain the actual error code. For example, data like 6b 27 00 00 translates to Error code 0x0000276b. For each error type, a different troubleshooting approach is required and the suggestions for one may not necessarily apply to other similar events (but with different error codes).

Reported error messages and their corresponding error codes:
- The parameter is incorrect. - Error code 87 or Error code 0x80070057
- The requested service provider could not be loaded or initialized. - Error code 10106

T774802 provides some generic information about this event, suggesting ways to verify your network configuration.
Data: 6b 27 00 00 -  See EV100223 (a link to "The WSAStartup function") to find out what is the role of the WSAStartup function. This also corresponds to Error code 0x0000276b.
In my case, I found out that the Symantec AV updates were causing the problem. I did an AV update on a working computer, only to find out after the reboot that winsock was damaged. Running the "netsh winsock reset" command fixed my problem.

See ME811259 for information on how to determine and recover from Winsock2 corruption.
The Windows Sockets registry subkeys might be corrupted or a third-party program is using Windows Ssockets and the ipconfig, release, and renew commands. See MSW2KDB for additional information on this event.
I have seen this warning on laptops that have not been connected to the network for a while. The first time they boot while back on the network, this warning is logged together with DHCP event 1003. It is repaired automatically so the warning can be ignored.

See ME163055 if you have a Windows NT 4.0 Service Pack 2 (SP2) DHCP server.

See ME246784 for further details on this problem.
Uninstalling and reinstalling the TCP/IP stack will not work for XP Pro as IP is the basis for the OS. You can try the following obtained from MS Knowledge Base ME817571. This did NOT fix my problem but might work for you.
1) Open a command prompt.
2) Type netsh int ip reset resetlog.txt, and then press ENTER.
This is supposed to recreate the winsock and winsock2 reg keys.

I resolved this problem by exporting the Reg keys from an XP pro installation that was working properly, same patch level, and NOT running the IPv6 patch. Afer rebooting, was able to release and renew the adapter normally again.

2 keys to export from known good registry:

Import these 2 keys into the affected machine and reboot. The adapter began to function normally again.
I resolved this problem this way:
1.Uninstall TCP/IP protocol.(DO NOT restart after uninstalling!!)
2.Delete following regestry key:
4.Install TCP/IP protocol again.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.