Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Source: NTDS Database|
Error <error> (<error>) has occurred (internal ID <id>).
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is NTDS and what are the roles of its components?
- Error: 8 - This problem occurs if the virtual memory address space of the Lsass.exe process is fragmented. Error code 8 in event ID 1168 indicates that insufficient memory is available. See ME842382 for a hotfix applicable to Microsoft Windows 2000 Server.
- Error: -1507(fffffa1d) - See ME303077 for details.
- Error: 997, 0 and 53 - If dcpromo runs on a DC with an LDAP server on it, it will complete the dcpromo with no errors. The Intersite Messaging Service will fail upon restarting. See ME266657 for details.
I called PSS and found that SP4 adds some additional AD database consistency checks. This particular error is caused by orphaned objects in AD. The PSS tech commented that a few of these in the event log should not be cause for concern, but if they start cropping up over and over, then there might be a more serious problem. The fix is to reboot a DC (preferably the one logging the errors) into directory services restore mode, run ntdsutil, and do a semantic check. Details of performing this check can be found in ME814202 (this article has nothing to do with the errors at hand; it just shows how to do the check). If ntdsutil cannot fix the errors it finds, it will report the offending objects, which you will then need to delete with ADSIedit.
See ME827531, a hotfix is available from Microsoft.
|Private comment: Subscribers only. See example of private comment|
|Links: ME266657, ME303077, ME814202, ME827531, ME842382, Error code 8, EventID 1168 from source NTDS General|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated