Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2000 Source: MicrosoftOffice11

Level
Description
Accepted Safe Mode action : <Microsoft Office product>.
Comments
 
From a support forum: "One of my Microsoft Office applications (Word, Outlook, excel, Powerpoint) keeps coming up in safe mode on my Windows Terminal Server. How do I prevent this?

Recommended solution:

When you start Microsoft Outlook (or another Office application on Windows Terminal Services you may receive the following error message:

Outlook failed to start correctly last time. Starting Outlook in safe mode will help you correct or isolate a startup problem in order to successfully start the program. Some functionality may be disabled in this mode.

Do you want to start Outlook in safe mode?

You can click either Yes or No and Outlook opens. The next time you launch Outlook you are not given the prompt. However, at the next launch of Outlook you are given the prompt. On the following logon, you are not given the prompt. This loop of Outlook 2002/3 prompting for Safe Mode every other time you launch Outlook continues indefinitely.

Cause:
HKEY_LOCAL_MACHINE\Windows NT\Current Version\Terminal Server\Install\Software\Microsoft\Office\10.0\Outlook\Resiliency
with the key TermSrvCopyKeyOnce with a value of 0x1 exists in the Registry on the Windows 2000 Terminal Server in one of the subkeys under Resiliency.

When Outlook 2002/3 starts, the following Registry key is created:
HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Resiliency.

NOTE: The Resiliency registry key for Outlook is new for Outlook 2002.

If no problems are encountered, the Resiliency key is deleted. If one of the many tests that Outlook makes at startup fail, subkeys are written under the Resiliency key and the Resiliency key is not deleted. If the key remains, the next start of Outlook 2002 gives the prompt.

If a subkey is deleted by an application from HKEY_CURRENT_USER (HKCU) -- specifically a subkey from HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Resiliency while the server is in Terminal Server Install mode, the data is copied to HKEY_LOCAL_MACHINE (HKLM):

HKLM\Software\Microsoft\Windows NT\Current Version\Terminal Server\Install\Software\\Microsoft\Office\10.0\Outlook\Resiliency

When the application attempts with the server in Terminal Server Application Mode to access the key again and finds it missing, the application looks in this location (HKLM) for the key. If the Resiliency key is there and has the key TermSrvCopyKeyOnce under one of the subkeys of the Resiliency key, the Resiliency key is written back to HKCU.

In this case, the Resiliency key was written with subkeys while in install mode. Once the terminal server goes back to application mode every user is affected since Outlook 2002 always looks for the Resiliency key, thus causing the loop.

Resolution:

Deleting

HKLM\Software\Microsoft\Windows NT\Current Version\Terminal Server\Install\Software\Microsoft\Office\10.0\Outlook\Resiliency

resolves the problem.

If you are running Citrix Metaframe Presentation Server, check to see if speedscreenApi.dll is listed as the faulting module. You may run into this issue after installing Metaframe and installing the lastest batch of Microsoft Updates for Windows 2000/3.

To fix this remove the keys for iexplore.exe and outlook.exe under

hklm\software\citrix\ctxhook\AppInit_Dlls\SpeedScreen

which should resolve the error message.

After that run the SpeedScreen manager to add those two applications to the list.
From a support forum: "Ran the Office Diag, which found a problem & repaired it, but no joy. Ran Scanpst.exe, which fixed it. See EV100375 (Cannot start Microsoft Office Outlook, Unable to open the Outlook window.)
In my case, Word would not open properly, creating issues when opening Outlook. In Word, I created a new "normal.dot" and the problem disappeared.
See the link to "Outlook does not start" and try tip 2. If this does not solve your problem, try disabling/uninstalling BCM (Business Contact Manager).

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...