Event ID: 3 Source: WinSock Proxy Client

Event ID/Source search

Keyword search

Example: Windows cannot unload your registry file

EventID.Net Splunk Add-on

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.

Event ID: 3 Source: WinSock Proxy Client

Source: WinSock Proxy Client

Type: Warning

Description:
Application [<application exe>]. The application was started while the service manager was locked and NtLmSsp wasn't running. If the application will try to remote via WinSock Proxy it can cause a deadlock with the service manager. For this reason the remoting is disabled. If the application is a service, and you want it to be able to remote, make it dependent on NtLmSsp.

English: Request a translation of the event description in plain English.

Concepts to understand:
What is the Winsock proxy client?
What is NTLM authentication?
What is a deadlock?

Comments:
EventID.Net
- Application: Svchost.exe - From a newsgroup post: "Svchost.exe is a sort of "helper" service that other "services" run on top of because they cannot run as a service on their own, such as services running from DLL files instead or EXE files. You may see a whole list of svchost.exe's running in the Task Manager. See ME314056 for a description of svchost.exe.
The problem is that this one particular "unknown" application started up at boot time before the NtLmSsp (I believe it means "NT LAN Manager Service Provider") was started. This means that if this particular Application needs to use the WSP Client to get to the Internet it will fail. All Applications that use the WSP Client must start up *after* the WSP Client is fully initialized. When this occurs in the wrong order, the WSP Client will not take care of communication from that Application. You can often overcome it by stopping and restarting the affected service, and then the WSP Client will acknowledge its presents and will work with it properly.
In the case of an easily identifiable service (one that does *not* use svchost.exe) you simply set its dependencies so that it does not start up until after the NtLmSsp. However, with one like this I am not sure how to approach it. I have in the past attempted to set the dependency for scvhost.exe but it did not seem to help".

See ME193888 for information on how to delay loading of specific services.
Click if the comment is good!

^{x
6}

EventID.Net
From a Usenet post:
"I had the same problem. I fixed it by setting the NT LM Security Support Provider Service (NtLmSsp) to start automatically:
1. Go to the control panel (Start - Settings - Control Panel).
2. Double click on Services.
3. Scroll down to and select "NT LM Security Support".
4. Click the "Startup..." button.
5. Set the "Startup Type" to automatic.
6. Click OK.
7. Click Close."

Also check ME268009 for more details.

Reported applications:
- MSTask.exe
- lsass.exe
- svchost.exe
- ismserv.exe
- msdtc.exe
- llssrv.exe
Click if the comment is good!

^{x
8}

Private comment: Subscribers only. See example of private comment

Links: ME193888, ME268009, ME314056

Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...

Feedback: Send comments or solutions - Notify me when updated

Printer friendly