Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2011 Source: MSMQClusterReDLL

Message Queuing objects cannot be created in Active Directory (Error: <error code>). Please verify your permissions and network connectivity.
Error 0xC00E0025 - This error is caused by the cluster service account not having sufficient permissions to access all objects in Active Directory. Specifically, when installing MSMQ with Routing support the cluster service account must have enterprise administrative permissions. The easiest way to get this permission is to add the cluster service account to the Enterprise Admins group. See the link to "Routing Support in MSMQ requires Enterprise Administrator privileges".
The error codes listed in the event description provide additional clues in regards to this issue:
- Error 0xc00e0040 = "MQ_ERROR_MACHINE_EXISTS"

From a Microsoft engineer post: "What is happening is MSMQ is trying to create an MSMQ object for itself but there is already an MSMQ object there for a computer object with the same network name. Basically the existing computer object in AD is not the one that the cluster is expecting to use or it does not have permissions to change it.

You can try to grant full control permission to the computer object for the cluster service's domain account. To do this, run AD Users and Computers, locate the computer object for this cluster server, right click it and select Properties, then go to the Security tab, grant the domain account (which runs the cluster service) Full Control permission to this computer object. Restarting MSMQ should make the necessary changes.

If you still have no luck then you could try:
1. Deleting the network name computer object and let the cluster create a fresh one. This would delete any MSMQ queues you've defined so you would have to recreate those.
2. Deleting the network name and MSMQ resources from the resource group
3. Both steps 1 and 2

See also "How to troubleshoot the Cluster service account when it modifies computer objects" - M307532"

- Error 0xC00E0025 = "Access denied"

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.