Monitor unlimited number of servers
Filter log events
Create email and web-based reports
Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content
Event ID: 2506 Source: Server
English
Request a translation of the event description in plain English.
Concepts to understand
Comments
Value: IRPStackSize, registry key: "lanmanserver/parameters" - As per Microsoft: "This behavior occurs if you set the IRPStackSize value (manually or programmatically) to less than 11. The IRPStackSize value is set to 15 by default in Windows 2000 and it is enforced as the minimum setting." However, we found that in some conditions (like after an unexpected shutdown) this event occurs even though the IRPStackSize was not altered. See ME238316 for more details.
Also per Microsoft: Ask your network administrator to remove the value from the Registry or to use the default for the Registry key.
It has been reported that can be caused by Norton Anti Virus overwriting the correct registry value. The suggestion is to open the following registry key HKey_Local_Machine/System/CurrentControlSet/Services/lanmanserver/parameters and set the IRPStackSize value to 6 (for Windows NT) or 11 (for Windows 2000).
Also per Microsoft: Ask your network administrator to remove the value from the Registry or to use the default for the Registry key.
It has been reported that can be caused by Norton Anti Virus overwriting the correct registry value. The suggestion is to open the following registry key HKey_Local_Machine/System/CurrentControlSet/Services/lanmanserver/parameters and set the IRPStackSize value to 6 (for Windows NT) or 11 (for Windows 2000).
- Value: IRPStackSize, registry key: "LanmanServer\Parameters" - See the links to "Symantec Knowledge Base Document ID: 2000021411512248" and "Symantec Knowledge Base Document ID: 1999102015170048" to solve this problem.
See ME167869 if this event appears on Microsoft Windows NT Server 4.0.
See "Veritas Support Document ID: 244156" for additional information.
See "Veritas Support Document ID: 244156" for additional information.
Value: UtilizeNTCaching, registry key: "LanmanServer\Parameters". UtilizeNTCaching is a Dword value that is for the workstation service. If it is in the Server parameters it will generate this event. UtilizeNTCaching indicates whether the redirector uses the cache manager to cache the contents of files. Disable this parameter only to guarantee that all data is flushed to the server immediately after it is written by the application. See ME102981.
As per Microsoft, this can happen when SQL server 2000 is installed on a Windows 2000 cluster, and can be ignored. See MSKB ME289683.
Make sure a decimal value is entered in the DWord edit dialog, and set the value to 15 for Windows 2000.
Windows Event Log Analysis Splunk App
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Cisco ASA Log Analyzer Splunk App
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.