EventID.Net LogoEventID.Net

EvLog Event Analyzer

Monitor unlimited number of servers
Filter log events
Create email and web-based reports

EventID.Net Subscription

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 2506 Source: Server

Source
Server
Level
Error
Description
The value named <value name> in the server's Registry key <registry key> was invalid. The value was ignored, and processing continued.
English
Request a translation of the event description in plain English.
Concepts to understand
What is the role of the Server service?
Comments
 
EventID.Net
Value: IRPStackSize, registry key: "lanmanserver/parameters" - As per Microsoft: "This behavior occurs if you set the IRPStackSize value (manually or programmatically) to less than 11. The IRPStackSize value is set to 15 by default in Windows 2000 and it is enforced as the minimum setting." However, we found that in some conditions (like after an unexpected shutdown) this event occurs even though the IRPStackSize was not altered. See ME238316 for more details.
Also per Microsoft: Ask your network administrator to remove the value from the Registry or to use the default for the Registry key.

It has been reported that can be caused by Norton Anti Virus overwriting the correct registry value. The suggestion is to open the following registry key HKey_Local_Machine/System/CurrentControlSet/Services/lanmanserver/parameters and set the IRPStackSize value to 6 (for Windows NT) or 11 (for Windows 2000).
EventID.Net
- Value: IRPStackSize, registry key: "LanmanServer\Parameters" - See the links to "Symantec Knowledge Base Document ID: 2000021411512248" and "Symantec Knowledge Base Document ID: 1999102015170048" to solve this problem.
EventID.Net
See ME167869 if this event appears on Microsoft Windows NT Server 4.0.

See "Veritas Support Document ID: 244156" for additional information.
Patrick M. Moffatt
Value: UtilizeNTCaching, registry key: "LanmanServer\Parameters". UtilizeNTCaching is a Dword value that is for the workstation service. If it is in the Server parameters it will generate this event. UtilizeNTCaching indicates whether the redirector uses the cache manager to cache the contents of files. Disable this parameter only to guarantee that all data is flushed to the server immediately after it is written by the application. See ME102981.
Greg Sommers
As per Microsoft, this can happen when SQL server 2000 is installed on a Windows 2000 cluster, and can be ignored. See MSKB ME289683.


Stein Waalen
Make sure a decimal value is entered in the DWord edit dialog, and set the value to 15 for Windows 2000.
Private comment
Subscribers only. See an example of private comment
Links
Veritas Support Document ID: 244156, Symantec Knowledge Base Document ID: 2000021411512248, Symantec Knowledge Base Document ID: 1999102015170048
Search
Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...
Feedback
Send comments or solutions - Notify me when updated
 
Printer friendly

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...