The master browser has received a server announcement from the computer <Windows NT client> that believes that it is the master browser for the domain on transport <NetBT>. The master browser is stopping or an election is being forced.
This problem occurs when network logon validation is prevented over a network switch. The network switch prevents the server from authenticating the client. The two-way communication session necessary for logon validation is prevented. The Windows NT client computer that cannot successfully communicate with the Windows NT server acting as the subnet master browser may cause a browser election, which causes this error to be registered on the PDC. See ME224131 for details.
As per Microsoft: "The subnet mask of the Windows 2000 client computer is incorrect or is different from the primary domain controller. The client computer has attempted to promote itself to the master browser of the subnet and has failed because only one computer in a domain can be running as the master browser". See MSW2KDB for additional information about this event.
We configured a home network for a laptop user as a favour. Whenever he brings his laptop back into the office after being connected on the home network, it thinks it is still master browser, forcing an election. The W2K domain controller throws up several MRXSMB warnings and one error, then invokes the election which sorts everything out.
In my case this error was right after I installed a new machine with Win2kPro. On the Event Viewer of the DC this error started to appear. To fix this I configured the WINS in my DC. But you can resolve this error with lmhosts on the network for netbios name resolution. If you do not want to configure WINS on your server, Microsoft has related information about this problem and how to resolve this with your network Routers. Just make sure the routers on the network are not forwarding UDP broadcasts. See ME190930.
The subnet mask of the Windows 2000 client computer is incorrect or is different from the primary domain controller. The client computer has attempted to promote itself to the master browser of the subnet and has failed.
To Fix: Change the TCP/IP protocol configuration to the correct subnet mask. See ME143153 and Microsoft Messages links.
This can also be caused when routers or switches are misconfigured and propagate UDP port 137 and 138 broadcasts. In this case large numbers of event 8003 appear in the event log. Also check ME190930 for more information.
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.