Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The value named <value name> in the server's Registry key <registry key> was invalid. The value was ignored, and processing continued.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of the Server service?
|Our approach: This information is only available to subscribers. An example of Our approach|
Value: IRPStackSize, registry key: "lanmanserver/parameters" - As per Microsoft: "This behavior occurs if you set the IRPStackSize value (manually or programmatically) to less than 11. The IRPStackSize value is set to 15 by default in Windows 2000 and it is enforced as the minimum setting." However, we found that in some conditions (like after an unexpected shutdown) this event occurs even though the IRPStackSize was not altered. See ME238316 for more details.
Also per Microsoft: Ask your network administrator to remove the value from the Registry or to use the default for the Registry key.
It has been reported that can be caused by Norton Anti Virus overwriting the correct registry value. The suggestion is to open the following registry key HKey_Local_Machine/System/CurrentControlSet/Services/lanmanserver/parameters and set the IRPStackSize value to 6 (for Windows NT) or 11 (for Windows 2000).
- Value: IRPStackSize, registry key: "LanmanServer\Parameters" - See the links to "Symantec Knowledge Base Document ID: 2000021411512248" and "Symantec Knowledge Base Document ID: 1999102015170048" to solve this problem.
See ME167869 if this event appears on Microsoft Windows NT Server 4.0.
See "Veritas Support Document ID: 244156" for additional information.
Patrick M. Moffatt
Value: UtilizeNTCaching, registry key: "LanmanServer\Parameters". UtilizeNTCaching is a Dword value that is for the workstation service. If it is in the Server parameters it will generate this event. UtilizeNTCaching indicates whether the redirector uses the cache manager to cache the contents of files. Disable this parameter only to guarantee that all data is flushed to the server immediately after it is written by the application. See ME102981.
As per Microsoft, this can happen when SQL server 2000 is installed on a Windows 2000 cluster, and can be ignored. See MSKB ME289683.
Make sure a decimal value is entered in the DWord edit dialog, and set the value to 15 for Windows 2000.
|Private comment: Subscribers only. See example of private comment|
|Links: Veritas Support Document ID: 244156, Symantec Knowledge Base Document ID: 2000021411512248, Symantec Knowledge Base Document ID: 1999102015170048|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated