Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8003 Source: Rdr

The master browser has received a server announcement from the computer CORPSHR01 that believes that it is the master browser for the domain on transport NetBT_N1001. The master browser is stopping or an election is being forced.
This event may be generated in various conditions - some of them are not errors per se. For example a PDC is started and it will send announcements to the network that it is the Master Browser  (a PDC is always the Master Browser). In this case, the existing Master Browser will generate an 8003 message in the event log. Sometimes, an improperly configured computer (i.e. wrong subnet mask) does not detect the existing Master Browser so it announces itself as the Master Browser.
You may see this event if you have a router that is forwarding UDP broadcasts. See "JSI Tip 0585" for more information on this situation.

See "F-Secure Support" if you received this event after installing F-Secure Antivirus.
See the links to "EventID 8003 from source Browser" and "EventID 8003 from source MRxSmb" for details on this event.
From a newsgroup post: "The error references a specific Win 98 client and is occurs repeatedly despite the fact that both the client and the NT Server are both running continuously. A Win98 machine will do this when File and Print Sharing has been enabled. Even if you don't share anything, by simply installing F&P Sharing, you'll cause elections to occur. This is because by default, Win9x machines have Browse Master set to Automatic. When Win98 starts, it first checks to see if a master browser is already present for its designated workgroup. If a master browser server does not exist, or if some problem exists that prevents the Win9x machines from determining who the browse master is, an election occurs.

To use F&P Sharing, but stop the elections from occurring, go into the Properties for F&P Sharing and set Browse Master to Disabled. Then, reboot for the changes to take effect."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.