Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 26 Source: ApplicationPopup

Application popup:<application name> - <message>
This is a very generic message. Any application that generates a pop-up message using the Windows Application Pop-up interface will create such event log entries. The content of the message varies widely and this message may provide information on the cause of the error. Typically event ID 26 itself does not help in troubleshooting the problems that generated such events so one should look for other events pointing to this problem.
- Message: "System Shutdown - The system is shutting down" - See ME911185 for a hotfix applicable to Microsoft Windows Server 2003.
- Message: "Windows - No Disk: There is no disk in the drive.  Please insert a disk into drive" - From a newsgroup post: "Try cleaning the recent documents folders".

- Application: ntvdm.exe, error: "System Error : NTVDM encountered a hard error" - See ME937932 for a hotfix applicable to Microsoft Windows Server 2003.
- Application: winlogon.exe, error: "Unable To Locate Component : This application has failed to start because WINHTTP.dll was not found. Re-installing the application may fix this problem" - See ME914061 for a hotfix applicable to Microsoft Windows Server 2003.
- Application: DUMPEL.EXE, error: "Bad Image : The application or DLL C:\WINDOWS\System32\win32k.sys is not a valid Windows image. Please check this against your installation diskette" - See ME907300.
- Application: mspadmin.exe, error: "The application failed to initialize properly (0xc0000142)" - See ME838857.
- Application: applnch.exe, error: "Ordinal Not Found : The ordinal 21 could not be located in the dynamic link library MAPI32.dll" - From a newsgroup post: "I had something similar happen on a W2K Pro machine that had had Eudora Pro 4.3 installed on it. For some reason, the user had run the Eudora utility that installed a non-Microsoft MAPI32.dll. I was able to find a "good" copy of the .DLL and when I replaced the offender, this message went away". Several newsgroup posts suggests that Mozilla can also replace the MAPI32.DLL file during its installation proccess.
- Application: svchost.exe, error: "The application failed to initialize properly (0xc0000142)" - From a newsgroup post: "Might be worthwhile to review MS KB article ME824422".
- Application: RTHDCPL.EXE, error: “Illegal System DLL Relocation: The system DLL user32.dll was relocated in memory. The application will not run properly. The relocation occurred because the DLL C:\WINDOWS\system32\HHCTRL.OCX occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL” - This error message was displayed immediately after startup on a Windows XP Pro SP2 system. This problem started on April 5, 2007 when the machines were turned on for first time of the day. The problem manifested itself with errors caused by Cisco CallManager Agent. Looking at recently released Microsoft critical updates I found one released on April 3, 2007 that had modified User32.dll. Uninstalling update ME925902 seems to have cleared up the error message.
- Message: "RunDLL32 entry point not found. Procedure IcfDisconnect could not be located in DLL HNetCfg.dll" - See ME913409 for a hotfix applicable to Microsoft Windows Server 2003.
Message: "Microsoft Visual C++ Runtime Library Buffer overrun detected!" - This kept occurring in a Small Business Server 2003 with CRM 3.0 installed. The pop appeared on top the login screen several times a day. There is a hotfix from Microsoft that addresses this issue. See ME915343 for details.

- Message: "Windows - System Error : The system has detected an IP address conflict with another system on the network. Network operations on this system may be disrupted as a result. More details are available in the system event log. Consult your network administrator immediately to resolve the conflict" - Change the IP address on this computer, or on the other computer that is conflicting with it.
- Application: ntbackup.exe, error: "Entry Point Not Found" - In one case, this issue was caused by trying to run a program that was written specifically for Windows 2003, on a Windows 2000 computer. Obtain the correct version.
- Message: "The evaluation period for this installation of Windows NT has expired. This system will shutdown in one hour. To restore access to this installation of Windows NT, please upgrade this installation using a licensed distribution of this product". See ME173507 for more details.
- Message: "Windows - License Violation". See ME326306 for information.
- Message: "Unable to Load Device Driver: SystemRoot\System32\drivers\tcpip.sys device driver could not be loaded. Error Status was <error>". The file TDI.SYS is missing from %systemroot%\system32\drivers folder. See ME816743 for information on fixing this issue.
- Message: "Unable to Load Device Driver" - See MSW2KDB for information on "Unable to Load Device Driver" errors.
- Message: "Windows - System Error: Insufficient system resources exist to complete the API" - From a newsgroup post: "This only happens when I try to hibernate. The only change I can remember making just before this started happening was to add 512MB of RAM to bring the total up to 1GB of RAM. I think this appears because I do not have enough space on my HDD to accommodate the new memory size when the computer goes into hibernation".
- Message: "SYSTEM SHUTDOWN : System is shutting down in 60 seconds" - See ME829395.

- Application: sqlservr.exe, error: "Entry Point Not Found" - See ME303034.
- Application: Terminal Services, warning: "Your terminal services temporary client license will expire in N days. Please contact your system administrator to get a permanent license" - See ME822134.
- Application: Windows - Windows Evaluation Notification, message: "The evaluation period for this installation of Windows has expired" - See ME250920.
- Application: cmd.exe, error: "The application failed to initialize properly (0xc0000142)" - See ME824422.
- Application: Connection Error, error: "The desktop you are trying to open is currently available only to administrators" - See the link to "Citrix Support Document ID: CTX104106".
- Application: Host Integration Server, error: "1004 : SnaBase didn't find any Host Integration Server computers in your domain <subdomain>" - See ME893010.
- Application: WOWEXEC - See ME841238.
- Application: sitemgr.exe, error: "Application has generated an exception that could not be handled" - See "Citrix Support Document ID: CTX108552".

- Message: "Windows - Registry Recovery : One of the files containing the system's Registry data had to be recovered by use of a log or alternate copy. The recovery was successful" - From a newsgroup post: "We have seen this on NT 4 domains. The source of this problem is an orphaned Windows NT4 policy, which may be in place but no longer applicable. To resolve this problem look for an old NT 4 policy that has an entry of "**del", which is to delete a single entry. After removing the problematic policy, the problem should be resolved".

If you receive this error after you install Microsoft Visual Studio on a Microsoft Windows 2000-based computer, see ME260513 to resolve the problem.

If you receive this error along with Event ID 4199 from source: TCP/IP, see ME178550 to fix this problem.

- Message: "Windows - System Error : Object Name already exists" - No information.
Message: Windows - System Error : Insufficient system resources exist to complete the API - This event occurred on a Windows XP SP2 Professional laptop with 2GB of memory. When trying to hibernate and running 1GB or more of memory, this event can occur and will remove the hibernate button from the Shutdown screen until a system restart has been completed. Article ME909095 has a hotfix to correct the problem.
- Application: spoolsv.exe, error: "Entry Point Not Found : The procedure entry point GetPrinterA could not be located in the dynamic link library SPOOLSS.dll" - See WITP79266 for information on fixing this problem.
- Application: userinit.exe - See ME272142 to resolve this problem.
- Application: cmd.exe, error: "The application failed to initialize properly (0xc0000142)" - This error occurred on mobile computer using multiple hardware profiles (e.g. docked/undocked) and it happened only when the computer was in docked state. To resolve the problem start the computer in “undocked” profile and delete the corrupted “docked” hardware profiles.
- Application: Citrix ICA Logon Message, error: "The system was not able to acquire a Citrix Product License. The IMA Service may not be running. Please contact your System Administrator" - Be sure that you have activated the license server and connection pack on the mycitrix web site. See "Citrix Support Document ID: CTX103211" and "Citrix Support Document ID: CTX103266" for more details.
- Application: "dwwin.exe", message: "DLL Initialization Failed: The application failed to initialize because the window station is shutting down" - An application was started after the user has chosen to shutdown Windows.
Application popup: KIX32.EXE – "No Disk: There is no disk in the drive. Please insert a disk into drive \Device\Harddisk1\DR1". Reason: Your kix script is attempting to write a file to the temp directory or to the drive that the zip drive or CD-ROM drive is on. Solution:
1. Make sure Kix32.exe is in your \winnt\system32 folder.
2. Change the default TEMP and TMP directories to c:\temp and c:\tmp respectively, or remove the reference in your script to the zip or CD-ROM drive.

Message: "Windows - EXCEPTION : Possible deadlock condition." - no info.
Application: "Citrix ICA Logon". Seen in conjunction with Event ID 1000. See ME312026.
Message: "16 bit MS-DOS Subsystem drive:\program path XXXX. An installable Virtual Device Driver failed DLL initialization. Choose 'Close' to terminate the application." See ME312026.
Message: "Windows - System Error : Insufficient system resources exist to complete the API" - This error happens on Windows XP with Servicepack 1 installed, if you try to hibernate. Unfortunately, Windows XP turns off hibernating after this (Without SP1 it didn't). As far as I know, it happens usually on machines with AMD Athlon MP processors. No solution yet for this.
Message: "System Process - Low on Registry Quota : Your system is running low on registry quota." - Start the System option in the Control Panel and choose the Virtual memory button to increase the registry quota.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.