Value: IRPStackSize, registry key: "lanmanserver/parameters" - As per Microsoft: "This behavior occurs if you set the IRPStackSize value (manually or programmatically) to less than 11. The IRPStackSize value is set to 15 by default in Windows 2000 and it is enforced as the minimum setting." However, we found that in some conditions (like after an unexpected shutdown) this event occurs even though the IRPStackSize was not altered. See ME238316 for more details.
Also per Microsoft: Ask your network administrator to remove the value from the Registry or to use the default for the Registry key.
It has been reported that can be caused by Norton Anti Virus overwriting the correct registry value. The suggestion is to open the following registry key HKey_Local_Machine/System/CurrentControlSet/Services/lanmanserver/parameters and set the IRPStackSize value to 6 (for Windows NT) or 11 (for Windows 2000).
- Value: IRPStackSize, registry key: "LanmanServer\Parameters" - See the links to "Symantec Knowledge Base Document ID: 2000021411512248" and "Symantec Knowledge Base Document ID: 1999102015170048" to solve this problem.
Value: UtilizeNTCaching, registry key: "LanmanServer\Parameters". UtilizeNTCaching is a Dword value that is for the workstation service. If it is in the Server parameters it will generate this event. UtilizeNTCaching indicates whether the redirector uses the cache manager to cache the contents of files. Disable this parameter only to guarantee that all data is flushed to the server immediately after it is written by the application. See ME102981.
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.