Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1168 Source: NTDSDatabase

Error <error> (<error>) has occurred (internal ID <id>).
- Error: 8 - This problem occurs if the virtual memory address space of the Lsass.exe process is fragmented. Error code 8 in event ID 1168 indicates that insufficient memory is available. See ME842382 for a hotfix applicable to Microsoft Windows 2000 Server.
- Error: -1507(fffffa1d) - See ME303077 for details.
- Error: 997, 0 and 53 - If dcpromo runs on a DC with an LDAP server on it, it will complete the dcpromo with no errors. The Intersite Messaging Service will fail upon restarting. See ME266657 for details.
I called PSS and found that SP4 adds some additional AD database consistency checks. This particular error is caused by orphaned objects in AD. The PSS tech commented that a few of these in the event log should not be cause for concern, but if they start cropping up over and over, then there might be a more serious problem. The fix is to reboot a DC (preferably the one logging the errors) into directory services restore mode, run ntdsutil, and do a semantic check. Details of performing this check can be found in ME814202 (this article has nothing to do with the errors at hand; it just shows how to do the check). If ntdsutil cannot fix the errors it finds, it will report the offending objects, which you will then need to delete with ADSIedit.
See ME827531, a hotfix is available from Microsoft.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.