Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 14526 Source: DfsSvc

DFS could not contact the <server> Active Directory. DFS will be using cached data. The return code is in the record data.
I could find no reason why these events were being logged in the first place and the server had been completely rebooted a few hours beforehand, but the events still persisted. Restarting the Netlogon service fixed this for me straight away.
I started seeing this error after incorrectly using SETSPN.EXE on another machine. The mistake I made was that I gave another machine the same HOST name as the Domain Controller, which caused several machine to be looking at the wrong server for the DfsSvc Service. I discovered my problem by restarting the NetLogon Service, which produced an event stating that I had two machines with the same name. I removed the entries and everything went back to normal.
The Volume Shadow Copy Service was the trigger for this event in my case. I received the 14526 event after I received EventID 5 from source VolSnap. Follow the instructions posted for EventID 5 from Source VolSnap. I applied SP1 for W2k3 Server as ME887827 is included in SP1, and the problem was solved.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.