Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 3 Source: WinSockProxyClient

Level
Description
Application [<application exe>]. The application was started while the service manager was locked and NtLmSsp wasn't running. If the application will try to remote via WinSock Proxy it can cause a deadlock with the service manager. For this reason the remoting is disabled. If the application is a service, and you want it to be able to remote, make it dependent on NtLmSsp.
Comments
 
- Application: Svchost.exe - From a newsgroup post: "Svchost.exe is a sort of "helper" service that other "services" run on top of because they cannot run as a service on their own, such as services running from DLL files instead or EXE files. You may see a whole list of svchost.exe's running in the Task Manager. See ME314056 for a description of svchost.exe.
The problem is that this one particular "unknown" application started up at boot time before the NtLmSsp (I believe it means "NT LAN Manager Service Provider") was started. This means that if this particular Application needs to use the WSP Client to get to the Internet it will fail. All Applications that use the WSP Client must start up *after* the WSP Client is fully initialized. When this occurs in the wrong order, the WSP Client will not take care of communication from that Application. You can often overcome it by stopping and restarting the affected service, and then the WSP Client will acknowledge its presents and will work with it properly.
In the case of an easily identifiable service (one that does *not* use svchost.exe) you simply set its dependencies so that it does not start up until after the NtLmSsp. However, with one like this I am not sure how to approach it. I have in the past attempted to set the dependency for scvhost.exe but it did not seem to help".

See ME193888 for information on how to delay loading of specific services.
From a Usenet post:
"I had the same problem.  I fixed it by setting the NT LM Security Support Provider Service (NtLmSsp) to start automatically:
1. Go to the control panel (Start - Settings - Control Panel).
2. Double click on Services.
3. Scroll down to and select "NT LM Security Support".
4. Click the "Startup..." button.
5. Set the "Startup Type" to automatic.
6. Click OK.
7. Click Close."

Also check ME268009 for more details.

Reported applications:
- MSTask.exe
- lsass.exe
- svchost.exe
- ismserv.exe
- msdtc.exe
- llssrv.exe

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...