Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1023 Source: Perflib

Source
Level
Description
Windows cannot load extensible counter DLL <counter>, the first DWORD in data section is the Windows error code.
Comments
 
From a newsgroup post: "When you use the System Monitor tool, some counters may be missing or do not contain counter data. The base set of performance counter libraries may become corrupted and may need to be rebuilt along with any extensible counters. This behavior can occur if certain extensible counters corrupt the registry or if some Windows Management Instrumentation (WMI)-based programs modify the Registry". See the ME300956 - How to Manually Rebuild Performance Counter Library Values" for more information on this issue.
Counter : MSSQL$MS_ADMT - This issue is most likely caused by a permission issue. Try
following steps to confirm it:
1. Ensure permissions of C:\Windows\ADMT are set as following:
   Authenticated Users: Read & Execute
   Server Operators: Modify
   Administrators: Full Control
   SYSTEM: Full Control
   CREATOR OWNER: Full Control

2. Give Read & Execute permission to Everyone account and full control permission to Administrators group for following file:

C:\Windows\ADMT\MSSQL$MS_ADMT\Binn\sqlctr80.dll

This solved the problem for me.
Counter MSSCNTRS - It only happened after updating our Exchange server (Hub and CAS)  with Windows Update. We noticed that Windows Search was installed along with the updates. Uninstalling windows Search V4.0 solved the issue.
As mentioned by others, this is a known issue when running VMWare server on SBS. I resolved it by adding a DWORD "Disable PerformanceCounters" with a value of 1, to the following registry key: HKLM\SYSTEM\CurrentControlSet\Services\VMware\Performance.
- Counter: VMware - This is a known issue if VMWare server is installed on a Small Business Server 2003 machine. So far, a fix has not released for the issue. The error can be ignored, or you can rename the registry key KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMware\Performance to stop the DLL from trying to load, and therefore to stop the error from appearing in the event viewer.


- Counter: MSSQLSERVER - In our case, giving "Performance Log Users" and "Performance Monitor Users" the "Read" and "Read & Execute" permissions on \Microsoft SQL Server\MSSQL\Binn\sqlctr80.dll solved the problem.
- Counter: TermService - Run "lodctr tslabels.ini".
- Counter: MSSQL$SHAREPOINT and MSSQL$SBSMONITORING - Inspired by PaulD's solution and a newsgroup post, I did a search in "program files" for sqlctr80.dll. I found two copies, one for each MSSQL instance listed above, in the following locations:
C:\Program Files\Microsoft SQL Server\MSSQL$SBSMONITORING\Binn
C:\Program Files\Microsoft SQL Server\MSSQL$SHAREPOINT\Binn

For each file, I modified the Properties, selected the Security tab and added "Everyone" with "Read & Execute" rights. My application event log stopped recording these events immediately.
- Counter: McAfee GroupShield - McAfee Solution ID kb43499 states that incorrect or missing permissions for the "Network Service" account on the "GroupShield\Bin" Directory seems to cause this problem. Go to the "McAfee Knowledge Search" page and search for the specified solution to read the article.

This problem can also appear if BlackBerryRouterPerf.dll is not referenced in the HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services\BlackBerry Router\Performance registry key. See "BlackBerry Support Article Number: KB-05443" for details on fixing this issue.

See ME912399 for additional information about this event.
- Counter: MSSQLSERVER - Ensure that the "SYSTEM" account has Full Control access to the "C:\MSSQL" directory.
- Counter: MSSQL$MSAC - See ME891330 for a hotfix applicable to Microsoft Windows Server 2003 Service Pack 1 and Microsoft Application Center 2000 Service Pack 2.
In my case the <counter> was “MSSQL$INSTANCE1”, and the DWORD data section was 05000000 i.e. 0x5 = “Access denied”. I fixed this by doing the following:
1. Found registry entry HKLM\SYSTEM\CurrentControlSet\Services\MSSQL$INSTANCE1\Performance
”Library”=C:\PROGRA~1\MICROS~1\MSSQL$~2\BINN\SQLCTR80.DLL.
2. Granted user (for which the error was generated) rights at least “Read” for MSSQL$~2, BINN and for SQLCTR80.DLL.

Convert the DWORD data into decimal and use "net helpmsg <decimal>" to obtain a more detailed error description.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...