Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 101 Source: W3SVC

Source
Level
Description
The server was unable to add the virtual root '<virtual directory>' for the directory '<directory>' due to the following error: The system cannot find the file specified. The data is the error code.
Comments
 
As per Microsoft: "This problem may occur if you had an IIS virtual root resource defined and then you removed the Cluster service but did not first delete the resource". See the link to "Windows Cluster Service Troubleshooting and Maintenance" to download the original white paper.
The problem can arise if the IIS Home Directory property for the default Web site is invalid. Read "Citrix Support Document ID: CTX105019" for further details on this issue.
Using ME193888 as a guideline, I sucessfully made the W3SVC service depend on MSExchangeIS without any ill results. The warning events disappeared and I have seen no issues with this workaround. I did have to use regedt32 instead on regedit to make the nessessary changes because of the way regedit displayed the data.
This warning is logged for websites that have virtual directories that point to UNC paths (i.e. a share on the same or another computer in the network). IIS cannot resolve correctly to the share, and it generates this error on reboot or restart. Verify the path specified in the event description.
This event is generated when the home directory of IIS is corrupted or deleted without deactivating the web site first. If Exchange is installed then it may be the cause of the error. See the links below.


Do no try setting the W3SVC service to depend on the MSExchangeIS service. The results were disastrous: after restart the server was totally irresponsive, with several Exchange services in "start pending" mode. This is why Microsoft is not recommending putting the dependency, otherwise a simple and easy solution. Do not play with services dependencies as it is possible to create loops.
When the virtual root is '/Exchange' or /Exadmin see ME259373.
This event and others with sources related to Exchange (i.e. SMTPSVC W3SVC, etc..) are typical for Exchange 2000. This is caused by the Virtual Drive M: not being mounted before the Virtual Servers (OWA, SMTP and NNTP) are started with IIS. IIS is trying to locate the physical path of these virtual directories which doesn't exist until after the Exchange services start up. Once the services start, you can stop and restart the web service and refresh the IIS Manager screen and the STOP icons will disappear. I've confirmed this with Microsoft's Exchange team and they advised this is "normal" functionality.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...