Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Name Registration Response could not be sent due to some error. This error was encountered by the Name Challenge Thread.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is the role of the WINS service?
As per Microsoft: "This event record usually indicates a database problem. Additional research will need to be conducted to verify the database problem". See MSW2KDB for additional information about this event.
- Ensure both servers are NetBIOS over TCP/IP enabled.
- Ping IP of WINS
- Ping FQDN of WINS
- Performed NBTSTAT - RR on W2K server.
- Ipconfig /all
- jetpack the database
- nltest /sc_query:mad5
We mapped error messages to:
4187 - WINS_EVT_CHLSND_REG_RSP_ERR
4224 - WINS_EVT_DATABASE_ER
You will have a corrupt WINS database. We have also seen the event occur by a WINS server getting overwhelmed by replication attempts & if you have a wrong subnet mask in your WINS server. Now let's look at how we can resolve this problem:
It is important to follow this action plan for each server. Don't recommend that you do it on all servers at the same time. We only want to make one change at a time and verify that it resolves the problem. We suggest that you do this operation out of hours due to the nature of WINS and because client would need to resolve name during the day.
- Export your static entries, so you can import them after you have a new db.
- Note the time and date when you start the work (We will use this later for check of event logs, if something goes wrong).
- Remove all replication Partners on the server (Nothing should be replicating to or from the server you work with)
- Stop replication partners in WINS Manager
- Stop the WINS service if is up and running
- Archive & remove the files in the %SystemRoot%\System32\Wins folder but do not delete the folder. (If you do delete the folder, simply recreate a Wins folder in this location. The folder is automatically created only when WINS is installed.)
- We do this to clean out the WINS database
- Restart the WINS server service
- Windows 2000 automatically recreates the files and registers the services that the WINS server uses.
- Check for any errors in the event log.
- If you get any error at this time, make sure to note them and If everything looks fine configure Pull Push replication against the server you want it to replicate with
- Finally choose "replicate now" for the server and let the replication occur
- Check your event logs for any errors that might occur.
You need to do this for each server. You need to be aware that it might take some time for WINS to replicate. this would depend on your environment (Server resources & Network).
This error occurs when you try to load an additional computer into a domain and it has not been cleared out of the WINS table. This error occured when I loaded another NT server onto a domain using a name that was previously used but wasn't cleared out of the WINS table. I cleared the entries, rebooted, and the error never came back.
|Private comment: Subscribers only. See example of private comment|
|Links: ME246533, MSW2KDB|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated