Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1103 Source: TermServDevices

Level
Description
An internal communication error occurred.  Redirected printing will no longer function. 0000: ba 0b 00 00 be 05 00 00
Comments
 
Open the Event Viewer, find the message and double-click the event id 1103.. If the date string contains "be 05" then this message should be ignored as it does not affect printing. Its due to printer name change notifications. If the string contains "376" then the problem is "real". In order to fix the missing registry keys that cause this problem follow this procedure:
1. Connect to a "good" server
2. Export with regedit  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\RDPDR key.
3. Connect to the server experiencing the problem.
4. Import the rdpdr.reg file into the registry.
5. Reboot.
I had this problem with a W2k Server that had SP3 installed. After applying SP4, the problem was solved.
As Microsoft specifies in ME324956 installing Service Pack 3 in Windows 2000 will stop the generation of this event.
In our case we got this error when users tried to create printing sessions. The cause was that Workstation98's printer name and win2k's printer name were not exactly the same. In our case the difference was a  blank space: "Minolta Pi1800" instead of "MinoltaPi1800". I changed "Minolta Pi1800" to "MinoltaPi1800" and the problem was solved.
In some forum topics it is suggested to reinstall Terminal Services.... i tried it, it didn't work. I've looked for answers everywhere, but this is the solution I've found and it worked! In the MS Technet there is a article - Windows 2000 Terminal Server Reports Event ID 1103 in the System Event Log (ME276532 - see the link below) but it does not provide a solution. Like Citrix is suggesting, it is an MS problem because the source is TermServDevices. What I have encountered is that there are a lot of registry hives missing. You can email me if you want me to provide the registry files to get this problem fixed. Look in the registry for these hives (they MUST exist):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\RDPDR]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E97D-E325-11CE-BFC1-08002BE10318}\0026]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\root#rdpdr]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdpdr]


There is one way of avoiding the reboot until a scheduled shutdown is performed: Configure service recovery options in services window to restart service 1, 2, 3 and all subsequent stoppages. Not a fix by any means, but users don't lose printing services during the day.
I uninstalled and reinstalled Terminal Services as suggested in the Microsoft Knowledge Base article Windows 2000 Terminal Server Reports Event ID 1103 in the System Event Log (ME276532).
This error is caused during client printer auto creation when the client printer driver name is different from the server printer driver name. Microsoft provides a solution for this by "re-mapping" the printer driver name on the server. When users do not require client printer mapping, it is much quicker to disable this function per user or for all ICA connections. See ME214593 for more details.
Note that the code 5be became 5d6 with SP2 and that this event with this code is harmless except if you use Citrix Metaframe and autocreated printers, in which case you might want to give a look to ME214593 or the Citrix document cited in that MS article.
Exporting the registry key from a "good" server worked great, with one small addition. I found it necessary to use regedt32 to alter permissions for the key in question before the reg file would import.
If you don't have a printing problem, add a DWORD value in the registry to delete the error message.
The registry setting should be:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TerminalServer\Wds\rdpwd\fEnablePrintRDR = 0x0
After that restart the Print Spooler. The errors should stop occuring.
We also had this event on our W2K server with Citrix server. We only had one application at that server, and it couldn't print. I checked Terminal Services Configuration: properties ICA-tcp, tab Client Settings. There's an option "Windows printer mapping"; it was checked and so disabled. I unchecked it and the error was solved.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...