Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8003 Source: MRxSmb

Source
Level
Description
The master browser has received a server announcement from the computer <computer name> that believes that it is the master browser for the domain on transport NetBT_Tcpip_{B7545DFC-BA6C-4712-81. The master browser is stopping or an election is being forced.
Comments
 
Here are some steps you can follow:

1. Look at the System Event log on your server and look for the error 8003. Within that log, identify the “computer” that is announcing itself as a master browser.
2. Go on to the computer identified in step 1, go to the Services Administration panel. You can usually find this by going to Control Panel -> Administrative Tools -> Services.
3. Once you have Services open, look for an entry called “Computer Browser”. If that service is “started, ” you have found your culprit. If not, you may have to try the registry hack listed in step 6.
4. Double click on the “Computer Browser” service to edit it. Stop the service and then change the type to „Disabled” (from either Manual or Automatic). Click OK to apply your changes.
5. That should have resolved the issue. You should check your main servers event logs periodically to be sure that the error does not show up. If the error continues to appear read step 6.
6. Check the following registry value on the computer: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\IsDomainMaster". Ensure that it is set to false. You probably have to reboot the machine to make the change take place.
As per Microsoft: "This computer is a master browser, and another computer has announced that it is the master browser. There can be only one master browser on a subnet at any given time. This message is logged for informational purposes only". See MSW2KDB for more details on this issue.

See ME191611 for details on symptoms of multihomed browsers.
See ME190930 if IP Helper has been enabled on a Cisco switch.
See ME188305 for information on troubleshooting the Microsoft Computer Browser service.

From a newsgroup post: "I just resolved a similar issue. My IP address and netmask were correct so according to TechNet I should not be getting this error message. I did an "ipconfig /release" followed by a "/renew" and received the 8003 message again. Therefore, I disabled the adapter then enabled it and everything is fine. Did another "ipconfig /release, /renew" and no message came up on the server. Note: This adapter had a static IP configuration at one time when it was connected to another network. Perhaps that was not cleaned up 100% when I changed it to DHCP. Disabling and enabling the adapter seemed to reset the configuration completely".

See the links to "EventID 8003 from source Rdr", "EventID 8003 from source Browser" and "Computer Browser and Browsing Roles" for additional information on this event.
Make sure the routers on the network are not forwarding UDP broadcasts, keeping browser elections on NetBT local to each subnet, and enable WINS or lmhosts on the network for netbios name resolution.
In my case, I have a Windows 2003 Standalone server. Once I installed ISA Server 2006, I started to get these errors about once per hour. I disabled the Computer Browser service and the Print Spooler service since neither of these are necessary on an ISA Server, and the messages ceased. This error will occur in the same circumstances on ISA Server 2004 also.
I resolved this issue by stopping and disabling the Browser service on the remote host.


This error can occur if the computer forcing the election has an incorrect subnet mask.
This event occurred when we had to computers with the same name in the same domain. Giving one PC some other name and joining both PCs again in the domain solved the problem.
In my case, all I had to do was to restart the Netlogon Service on the PDC.
I had this problem after disabling the Sygate personal firewall. It seems that sygate needs to be uninstalled if you do not want to use it anymore. In my case, Sygate blocked all incoming and outgoing data without any warnings or something else. After reactivating it, everything worked fine again.
I used the answers from Anonymous about DNS entries and from Dave Murphy to solve this problem:
1. I had several entries listed as “(same as parent folder)” that were incorrect so I deleted them. There should only be an entry for each DC on your network.
2. I changed the "IsDomainMaster" key that Dave Murphy mentions above to “TRUE”.
I got this error after a W2k3 migration. There was still old information in the lmhost-file (c:\windows\system32\drivers\etc\). After a correction (correct domain name, correct ip address), the problem was solved. As an alternative, you can turn off the use of the lmhost-file (in the nic-properties).
This event started to occur every hour on our DC1 about the DC2. Solutions already listed here and in MS KB were not applicable to us. (Disabling/re-enabling NIC stopped the error for one day but then it showed up again) I believe the browser elections were being caused by DNS misconfig. (We use MS DNS AD-Integrated zones) Someone changed the IP address of the DC1 NS record (the record marked "same as parent folder"). When I finally noticed, I also noticed that the Host record for DC1 in DomainDNSZones disappeared entirely (replicated out). I manually changed the NS record back to the correct IP. I also manually added the Host record back in, under DomainDNSZones. (I allowed for replication time but the Host record did not come back on its own). Since then the error has not reoccurred.
This issue was found on a Windows 2000 domain with two subnets connected by a Cisco router that has the ip helper command enabled. See the link to "Cisco Support Document ID: 49860" for a solution to this problem.
We were getting this event frequently on our PDC Emulator DC which is Windows 2003. It turned out that the offending Windows XP PC had two enabled network cards, both with valid IP addresses, only one of which was connected to the network. Disabling the second network card solved the problem.


I got this error because in my W2k3 migration, supplying the personal firewall with the new server IP address had been missed. I supplied the address and the event disappeared.
If 2 servers are involved, and one server appears in the others’ event log, check the DHCP scope options on the server whose name appears in the event log. This error is most commonly attributed to the subnet mask but if the domain name in the scope options is different on one of the servers it will cause this error to appear. Correcting the domain name in the scope options fixes the error message.
There is a hotfix available for Windows 2003 member server if a workstation becomes the master browser instead. See ME843517 for the hotfix.
We had this occurring on our network from an XP machine and within 30 minutes the server would crash. We called Microsoft and we were told that XP could cause servers running Win2k or NT 4.0 to crash because of the forced election. We were instructed to set the “Computer Browser” service on the culprit machine to Disabled and to recreate the Paging File on the server. We did both and the server has been up and running since.
In my case I had an open pair in my cat5 cabling. Repaired the cable and the error message stopped.
This is a common event when you have multiple computers in a local workgroup and no domain.
Windows XP Pro clients with the inbuilt firewall enabled on the LAN interface cause this event to appear in the server logs. Disabling this sorted the problem.
Some considerations and ways to keep this from happening. As one other post mentioned, stopping the browser service on the workstation can clear this out. Other options to look into also consist of editing the "IsDomainMaster" key, under HKLM\System\CCS\Service\Browser\Parameters, on the domain controllers and changing the key to TRUE. This gives an extra boost the election process to help ensure the domain controllers retain the master browser status. Also on the domain controllers, change the "MaintainServerList" key to "Yes" instead of Auto, and on the workstation, change the entry to "No" instead of Auto. This should resolve a number of browsing issues.

There is also a tool, called the NetBIOS Browsing Console to help with browsing issues. The software and instructions can be found via ME818092 article.
Setting MaintainServerList to False will cause 2550 errors from the Browser service on restarts. The Browser service consequently fails every time. The solution to this can be to remove the Browser service with "instsrv browser REMOVE" at the command prompt.


Client desktop or workstations using Win XP Pro can cause this issue if the built in Internet Connection Firewall is active.  Because this feature interferes with the network browsing, the client will attempt to become the Master Browser. Disabling the setting under browser/parameter will block the attempt to become master, but the client will still have difficult seeing and being seen in the workgroup/domain.
In order to stop this error from occuring, use Regedit and set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList from Auto or YES to FALSE

This will prevent the computer from attempting to become a Domain Master Browser and compete with Domain Controllers. If the server is a domain controller it is advisable to leave it with the default settings.
Look for NT 4.0 Domain controller that is hosting DHCP and Cisco routers that have IP helper statements that point back to the DHCP server. The default IP helper setings cause master browser elections.
Related to Cisco routers that have IP helper statements that point back to the DHCP server: This also occurs with "ip-helpering" if the DHCP server is a Windows 2000 Domain Controller holding the PDC Emulator Role (as it is the Domain Master Browser).
The actual commands to be applied to the Cisco router are:
"no ip forward-protocol udp NetBIOS-ns"
and
"no ip forward-protocol udp netbios-dgm"
This will prevent each VLAN or segment from seeing the others when sending out NetBIOS broadcasts.  You should end up with a valid master browser in each segment and no longer have these Events on your DC.
See also Microsoft W2K Resource Kit link.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...