Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
|Source: NTDS General|
Internal event: Exception <exception code> has occurred with parameters <parameter1> and <parameter2> (Internal ID <ID code>).
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is NTDS and what are the roles of its components?
As per Microsoft: "An LDAP version 2 client that performs a search that generates two or more referrals may cause the domain controller on which the search is running to stop responding (hang). The occurrence of the domain controller hanging is random. This is because it depends on the actual size of the buffer that is allocated for the referrals and the size of the referrals". See ME324184 for a hotfix applicable to Microsoft Windows 2000 Server.
This event can occur when you run an LDAP script that queries for Active Directory information after you bind to a Windows Server 2003-based domain controller because of a memory issue. See ME934407 for a hotfix applicable to Microsoft Windows Server 2003.
See ME943576 and ME948925 for hotfixes applicable to Microsoft Windows Server 2003.
You may experience this issue if you install a Windows Server 2003-based domain controller into an existing domain that contains Windows Server 2008-based domain controllers and Microsoft Windows 2000 Server Service Pack 4 (SP4)-based domain controllers. See ME947020 for information on solving this problem.
See ME914036 and the link to "EventID 1173 from source Active Directory" for additional information on this event.
As per Microsoft: "This problem may occur if you have installed Windows 2000 Service Pack 4". See ME824226 to find out how to fix this problem. Also check ME265090, ME279093, ME289612, ME306091, ME825952, ME832851 and the link to Error code 0xC0000005 for more information about this event.
According to Microsoft, this issue may occur when destination domain controllers that are performing remote procedure call (RPC)-based replication do not receive replication changes from a source domain controller within the time that the RPC Replication Timeout (mins) registry setting specifies. See ME830746 for information on what causes this problem and how to fix it.
See ME834926 for a hotfix applicable to Microsoft Windows Server 2003.
ME828297 replaces ME824226.
|Private comment: Subscribers only. See example of private comment|
|Links: ME265090, ME279093, ME289612, ME306091, ME324184, ME824226, ME825952, ME828297, ME830746, ME832851, ME834926, ME914036, ME934407, ME943576, ME947020, ME948925, Error code 0xC0000005, EventID 1173 from source Active Directory|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated