Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4187 Source: WINS

Source
Level
Description
Name Registration Response could not be sent due to some error. This error was encountered by the Name Challenge Thread.
Comments
 
As per Microsoft: "This event record usually indicates a database problem. Additional research will need to be conducted to verify the database problem". See MSW2KDB for additional information about this event.
Further troubleshooting:
- Ensure both servers are NetBIOS over TCP/IP enabled.
- Ping IP of WINS
- Ping FQDN of WINS
- Performed NBTSTAT - RR on W2K server.
- Ipconfig /all
- jetpack the database
- nltest /sc_query:mad5

See ME246533.

We mapped error messages to:
4187 - WINS_EVT_CHLSND_REG_RSP_ERR
4224 - WINS_EVT_DATABASE_ER

You will have a corrupt WINS database. We have also seen the event occur by a WINS server getting overwhelmed by replication attempts & if you have a wrong subnet mask in your WINS server. Now let's look at how we can resolve this problem:

It is important to follow this action plan for each server. Don't recommend that you do it on all servers at the same time. We only want to make one change at a time and verify that it resolves the problem. We suggest that you do this operation out of hours due to the nature of WINS and because client would need to resolve name during the day.

ACTION PLAN:
- Export your static entries, so you can import them after you have a new db.
- Note the time and date when you start the work (We will use this later for check of event logs, if something goes wrong).
- Remove all replication Partners on the server (Nothing should be replicating to or from the server you work with)
- Stop replication partners in WINS Manager
- Stop the WINS service if is up and running
- Archive & remove the files in the %SystemRoot%\System32\Wins folder but do not delete the folder. (If you do delete the folder, simply recreate a Wins folder in this location. The folder is automatically created only when WINS is installed.)
- We do this to clean out the WINS database
- Restart the WINS server service
- Windows 2000 automatically recreates the files and registers the services that the WINS server uses.
- Check for any errors in the event log.
- If you get any error at this time, make sure to note them and If everything looks fine configure Pull Push replication against the server you want it to replicate with
- Finally choose "replicate now" for the server and let the replication occur
- Check your event logs for any errors that might occur.

You need to do this for each server. You need to be aware that it might take some time for WINS to replicate. this would depend on your environment (Server resources & Network).
This error occurs when you try to load an additional computer into a domain and it has not been cleared out of the WINS table. This error occured when I loaded another NT server onto a domain using a name that was previously used but wasn't cleared out of the WINS table. I cleared the entries, rebooted, and the error never came back.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...