Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 257 Source: PlugPlayManager

Level
Description
Timed out sending notification of target device change to window of "C:\WINDOWS\Explorer.EXE"
Comments
 
In our case, we had this on a Windows Server 2003 Enterprise SP2. The error appeared 40 times per minute in event log and we had problems with performance of the server and with replication through RecoverPoint. We fixed it by killing the explorer.exe process and starting it again using Task Manager.
These events may be logged if high-volume disk I/O operations are performed AND a time-out occurs while the LDM (Logical Disk Manager) is interacting with PNP (Plug and Play).

These messages can be safely ignored as they DO NOT indicate a problem with your computer. The time-out DOES NOT adversely affect your computer.

Solution
This event appeared in parallel with another one "handshake failed with Error code 0x80090311 while establishing a connection with integrated security, the connection has been closed" after regular maintenance

I had fixed this problem as follows:

1. Logged off all another users logged on computer
2. Restarted related service to Logical disk management
3. Implemented hotfix below "Event ID 257 is logged in the System event log several times on a Windows Server 2003-based computer" See ME924390 ( does not require reboot ).

Issue does not appear any more.
As per Microsoft: "The specified program is taking too long to respond to notifications about the device. This can decrease system performance". See MSW2KDB for more information.

As per Microsoft: "This issue may occur if you do not update McAfee VirusScan to the latest version. This issue is resolved in McAfee VirusScan version 7.1.0 and later versions". See ME836788 and ME835473 for more details.

From a newsgroup post: "I am running SBS 2003 Standard with SP1 that was recently restored from a disaster. Every 85 seconds I received this event in the System log. This started after I removed an old version of the APC PowerChute UPS software.
I noticed another warning about the serial port that occurred when this problem started happening. I went to the Registry and saw that there was only \Device\Serial1 with value COM1 in the HKEY_LOCAL_MACHINE\Hardware\DEVICEMAP\SERIALCOMM key. I deleted this key (\Device\Serial1) and went to Add Hardware. This found two serial ports and entered the keys into the registry. I then rebooted the machine and I no longer get the messages. I think this had to do with the fact that the old UPS was attached to the serial port and when I removed the software for it, the port somehow was corrupted in the registry".

From a newsgroup post: “I managed to fix the problem I encountered. I noticed another warning about the serial port that occurred when this problem started happening. I went to the registry and saw that there was only \Device\Serial1 REG_SZ COM1 in the Local_Machine\Hardware\DEVICEMAP\SERIALCOMM key. I deleted this key (\Device\Serial1) and went to Add Hardware. This found two serial ports and entered the keys into the registry. I then rebooted the machine and no longer received the messages. I think this problem was related with the fact that the old UPS was attached to the serial port and when I removed the software for it, the port somehow got corrupted in the registry”.
This error was appearing exactly every two minutes in the event log on one of our Windows 2003 SP2 servers. The cause was that one of our network administrators had an RDP session to this server and also had his local drives mapped. He had a USB thumb drive connected to his laptop that was one of the connected drives to the server. He removed the USB drive from his laptop and the errors stopped.
This problem occurs because the Dmadmin.exe process is not responding. When you add a disk device to the computer, the Plug and Play service deletes a volume object and then creates a new volume object that has different name. However, the Dmadmin.exe process waits for the volume object that the Plug and Play service deleted. See ME924390 for a hotfix applicable to Microsoft Windows Server 2003.

This event may be logged if high-volume disk I/O operations are performed and a time-out occurs while the LDM (Logical Disk Manager) is interacting with PNP (Plug and Play). See WITP80579 for details on this situation.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...