Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 20027 Source: Rasman

Remote Access Connection Manager failed to start because NDISWAN could not be opened. Restart the computer. The system cannot find the file specified.
From a newsgroup post: "Remove and reinstall TCP/IP and the NIC. If this machine is a Domain controller, follow ME299451 for information on how to remove and reinstall TCP/IP".
This seems to be a common problem. On a Windows 2000 machine with lots of resources, one is suddenly no more able to connect with a modem.  The Microsoft ME117304 gives an explanation for the error but that is not the case here. Installing SP1 does not help.
The problem is that ndiswan.sys is either missing or corrupt. Copy a fresh ndiswan.sys into winn\system32\drivers and this should sought the problem out. Apparently, SP1 removes this file without replacing it, so copy back the file from the SP uninstall folder.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.