Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8003 Source: Browser

Source
Level
Description
The master browser has received a server announcement from the computer <Windows NT client> that believes that it is the master browser for the domain on transport <NetBT>. The master browser is stopping or an election is being forced.
Comments
 
This problem occurs when network logon validation is prevented over a network switch. The network switch prevents the server from authenticating the client. The two-way communication session necessary for logon validation is prevented. The Windows NT client computer that cannot successfully communicate with the Windows NT server acting as the subnet master browser may cause a browser election, which causes this error to be registered on the PDC. See ME224131 for details.

As per Microsoft: "The subnet mask of the Windows 2000 client computer is incorrect or is different from the primary domain controller. The client computer has attempted to promote itself to the master browser of the subnet and has failed because only one computer in a domain can be running as the master browser". See MSW2KDB for additional information about this event.
See the links to "EventID 8003 from source MRxSmb" and "EventID 8003 from source Rdr" for details on this event.

ME188305 provides information on troubleshooting the Microsoft Computer Browser Service.
We configured a home network for a laptop user as a favour. Whenever he brings his laptop back into the office after being connected on the home network, it thinks it is still master browser, forcing an election. The W2K domain controller throws up several MRXSMB warnings and one error, then invokes the election which sorts everything out.
In my case this error was right after I installed a new machine with Win2kPro. On the Event Viewer of the DC this error started to appear. To fix this I configured the WINS in my DC. But you can resolve this error with lmhosts on the network for netbios name resolution. If you do not want to configure WINS on your server, Microsoft has related information about this problem and how to resolve this with your network Routers. Just make sure the routers on the network are not forwarding UDP broadcasts. See ME190930.
If the event occurs in the domain controller's system log see ME135464.


The subnet mask of the Windows 2000 client computer is incorrect or is different from the primary domain controller. The client computer has attempted to promote itself to the master browser of the subnet and has failed.
To Fix: Change the TCP/IP protocol configuration to the correct subnet mask. See ME143153 and Microsoft Messages links.

This can also be caused when routers or switches are misconfigured and propagate UDP port 137 and 138 broadcasts. In this case large numbers of event 8003 appear in the event log. Also check ME190930 for more information.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...