Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 20035 Source: RasMan

Source
Level
Description
Remote Access Connection Manager failed to start because it could not create Buffers. Restart the computer. Access is denied.
Comments
 
I encountered this event on Windows XP SP2 after un-installation of Symantec EndPoint Protection 11 build 11.0.1000. I had problems with SEP, and after removal, I encountered these errors, which in turn, caused the Remote Access Connection Manager to fail with Event ID 7023.
To solve the problem, I had to edit the registry and remove the following keys, which referenced a SymRasMan.dll file: (always back it up/export before altering)

HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13
HKLM\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\25.
In addition to checking out the MS KB842696 article regarding RRAS errors, if you have Veritas BE installed on a SBS2000 server get the latest tape drivers for the version of BE you are running. Refer to “Veritas Support Document ID: 275924” for further information.
From a newsgroup post: "Delete the NextID value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Telephony\Cards\NextID, and then restart the computer". This seemed to do the trick for me. See the link to "WinDrivers Forums" for the original post.
I solved this problem in Windows 2000 by reinstalling the latest Service Pack.
As per Microsoft: "Remote Access Connection Manager (RasMan) cannot initialize a mutex object. Typically, this event is logged when the computer is low on memory". See MSW2KDB for details on this event.

As per Microsoft: "This problem may occur if the Veritas Backup Exec program is installed on your computer. A conflict between the Veritas tape device driver and the Routing and Remote Access service may prevent the service from starting". See ME842696 to fix this problem.


I had this error on a Win2K SP3 machine. Deleting the registry keys as mentioned in the ME329441 fixed it, even though article only mentions the problem under XP.
If the error occurs on Windows XP the solution is to reinstall SP1. See ME329441 for other details.
Look for a missing ntlsapi.dll (NT Licensing Service) in the \WINNT\System32 directory. You can copy the missing dll from another system (same SP level) without registering it. This missing dll will also affect the WWW service and other services to run (won't run).

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...