Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2504 Source: Server

Source
Level
Description
The server could not bind to the transport \Device\NetBT_Tcpip_{86EF436E-588D-4F57-B488-FFADD55FE422}.
Comments
 
This problem can be caused by:
1.A lack of memory,
2.A malfunctioning network interface, or
3.A network device that became unavailable during startup.
See MSW2KDB, ME317140 and "JSI Tip 3044" for additional information about this event.
See also ME314872
Error 2504 can also be caused by a Macintosh running DAVE, with an LMHOSTS file pointing to the NT Server. If such a Macintosh is running when the NT Server is restarted, the 2504 error is generated. Shutdown all Macs and the problem goes away. We tried everything mentioned in MS Knowledge Base, removed and reinstalled adapters and protocols, and ended up spending seven hours on this until we discovered a Mac that was still on.  The NT server fails to register the netbios name in the domain. Another computer on the network claims to be the owner of the netbios name, and thereby rejects the registration of the NT server. One work around to bring the NT server on-line was to remove the network cable reboot the NT server and reconnect the network cable. The problem showed out to be a MAC computer on the same IP subnet. There is an error in some software called "DAVE" for MAC computers. This software gives the MAC access to NT shares over a TCP/IP network. An error in this software means that when a LMHOST file is created on the MAC, the MAC claims to be the owner of all the netbios names in the LMHOST file. DAVE software was in version 2.0. The error is verified to be in version 2.1 as well. The computer causing the problem can be found with the NetMon tool (from the MS-SMS kit) the log will show you the IP address of the computer rejecting the netbios name registration.
I got this event in an environment with two Windows 2000 domain controllers in mixed mode with WINS service running and two NT4 backup domain controllers. This event appeared on one of the NT4 backup domain controllers. There was an entry in the WINS database for this backup domain controller pointing to a wrong IP address. After I removed all references to this backup domain controller in the WINS database, the server service was able to bind.
You can configure multiple network interface cards (NICs, also called network adapters) in a computer (multihomed) for use on the same network segment, but no two network adapters on the same segment in the computer can use NetBIOS. When you install NetBEUI on a multihomed computer, it violates this restriction.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...