Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8021 Source: BROWSER

The browser was unable to retrieve a list of servers from the browser master \\CORPFS01 on the network \Device\NetBT_N1001. The data is the error code.
Usually this occurs when a PDC has more than one netowrk card (multihomed) The following situations can cause this symptom:
- Your computer network cards are linked to the same subnet.
- Your computer network cards are not linked directly to the same subnet, but are linked indirectly through other subnets that they are connected to.
- The master browser is using an incorrect subnet mask.
See ME135404, ME224834 and ME176321 links.
If you have issues browsing your domain from the Microsoft Windows Network (you may get an error message "DOMAIN is not accessible) you might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions. The parameter is incorrect."
I suggest you look the ME968389 update. Try uninstalling it and rebooting your server. The update is for Extended Protection for Authentication.
In my case I fixed the problem by just restarting the Netlogon service.
You can try using the NetBIOS Browsing Console to troubleshoot this issue. See ME818092 for a complete description of this utility.
This error occurred on one of our DHCP/WINS/DNS servers (Win2k) due to replacement of hardware (NIC card). After the replacement, Windows recognized a hidden NIC with the same IP configuration. The old NIC was not visible when showing hidden devices in device manager. After removing the old card by using devcon.exe (see ME269155), the message disappeared.

I had this problem on a Windows 2003 R2 Server x32 running in Microsoft Virtual Server 2005. The server was multihomed and running a teaming load balance between the two NICs. The server itself had no problems but the Virtual Server running on it did. I performed the following registry tweak to resolve the problem.
Change the following registry key value to False and reboot the computer: “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList”.
I was seeing this event along with Event ID 8032 from the same source. I ran Netdiag and found that the Messenger service was disabled. Windows Domain Controllers need this service running. I started this service and both errors did not return.
I was getting this event on a Win2K server. Looking into this, I saw that there were 2 nics installed.  The first one built in that was disabled and the second one that was in a slot and connected to the network with a static IP. To correct this error I did the following:
1. Ensured that the unused internal nic was disabled.
2. Right clicked on "My Network Places" and selected PROPERTIES.
3. Selected the ADVANCED menu item and then ADVANCED SETTINGS
4. Changed the order of the nics so that the first nic to be in use. (Selecting the nic in use and selecting the up arrow)

This seems to have cleared it up.

I was also getting a 1007 DHCP error.  And looking I noticed that the DHCP client was enabled and started for the unused nic. This was not normal for me in a server environment, so I made sure that it was disabled. This may have contributed to the browser error as well.
I started noticing this event in the System log on our second DC every morning when scheduled backups began. While checking some of the causes, I noticed that the Local Area connections in Network and Dial up connections were no longer visible. I checked Microsoft Support site and found article ME269019 that fixed the event in the System log and restored the icons for the network connections.
I was receiving both 8021 and 8032 errors. In the last few months, I have been setting up seven Windows 2003 servers with one using RRAS for VPN. I started getting 8032 errors after setting up RRAS and some of the info provided helped resolve the issue. This 2003 server is a PDC running DNS, DHCP, WINS, RRAS, etc. A few weeks ago, I changed RRAS from Static IP to DHCP provided IP. I checked a box called "enable broadcast name resolution". I have had so much going on that I did not notice that my browser service on all workstations and servers was not working. I went back to this board and started researching these errors again. Article ME839880 got me to look at dcdiag and netdiag; netdiag showed failed NetBT name tests. After some research in the registry, the failed device pointed to RRAS. Then I unchecked the "enable broadcast name resolution" and my browser service starting working again. I reran netdiag and everything was fine.
This event appears because this computer could not retrieve the browse list from the master browser four times consecutively. Possible causes include network outages, name resolution problems, an overloaded master browser, or a master browser that is unavailable. See MSW2KDB for more details on this issue.

From a newsgroup post: "Whenever a server starts up, it calls for the Master Browser. If none is found, an election is held. The "winner" is based on who best can fulfill this role; O.S. is first rank. WINNT Server beats WINNT Workstation, which beats WIN98SE which beats out WIN98 which beats out WIN95. Also, when a WINNT Workstation boots up and finds that a WIN98 client is the Master Browser, the WINNT Workstation client forces an election. There are also two registry entries that can be edited, depending on what you want to do:
(1) MaintainServerList is located at HKLM\Sytem\CurrentControlSet\Services\Browser\Parameters. There are three settings: no (can not be a browser), yes (very detailed, basically this would be the favored child in a tie if it got that far, for example, if two WINNT Servers were equal as far as everything to that point goes, the one with this registry entry would win the tie, and auto (will act as browser if asked by Master Browser). NT Workstations have it set to NO and NT Servers have it set to YES by default.
(2)IsDomainMasterBrowser, which is located in the same location. Here there are two possibilities: yes or no. The default is NO for all computers. If this key is set to YES there are two things to consider: the first is that this machine will have an advantage in an election and the second is that when this machine boots up it will always force an election".

From a newsgroup post: "I also had this problem. My work around was to setup one of my DC's with the WINS service and add the Wins address to my DHCP Service. I no longer have the errors and local network browsing has improved, as has AD".

See ME888816 for additional information on this event.
In my case, I (accidentally) had 2 servers running the WINS service, the one that was supposed to be running it (a domain controller) and a stand-alone server outside of the domain but connected at times via NetBIOS for backup purposes. Once I turned off the WINS service on the stand-alone server, the errors stopped and my backups quit failing as well.
Having an unconnected network card can sometimes cause this error. To rectify this problem, disable or remove the unused network card.
For troubleshooting the Microsoft computer Browser Service see ME188305. For more information on Browser Service see ME102878 and MS Windows NT Browser link below.

Data code Definitions:
0000: 00000002 = ERROR_FILE_NOT_FOUND.
0000: 00000035 = ERROR_BAD_NETPATH.
0000: 00000040 = ERROR_NETNAME_DELETED.
0000: 00000047 = ERROR_REQ_NOT_ACCEP.

I found that this error was causing Veritas Backup 2000, to have OFO (Open File Option) errors. I also couldn't browse the Domain. I had 2 NIC's each with NetBIOS over TCP/IP enabled. I disabled Netbios over TCP/IP on one NIC and the errors stopped and Veritas could then browse the LAN and hence allow the Open File Option module to run correctly.
I had the same issue after I had to move a modem out of a failed modem pool and hook up to my Domain Controller. I had also turned on RRAS to accept incoming calls. This made the DC multi-homed.  Removal of the modem and RRAS. Restarting netlogon service didn’t clear up the issue.  However a reboot of the server did.
In my cluster case I turned off the option for using NetBIOS over TCP/IP on the backup network segment on all servers and I kept enabled NETBIOS over TCP/IP on the network adapters connected to the regular network segment. The problem was solved.
In my cluster case I disabled NetBIOS over TCP/IP on the private (secondary) network connection shared exclusively by the cluster. I disabled on both nodes and the issue was solved.
See ME136712 on how to hide a server from the browser.
Check RESTRICTANONYMOUS Registry Setting. A setting of 2 might cause this problem. See ME246261.
I've seen this ID in conjunction with EventID 8032, and have found that the Domain Master Browser no longer responds to it's own requests.  You can duplicate this by doing BROWSTAT VIEW <TRANSPORT> on the Domain Master Browser and observing an RPC error binding to itself.  Simply restarting the NETLOGON service clears this up.
In our case, our Win2k print server was unreachable by some clients. We discovered that WINS was misconfigured on the server. Once it was set correctly, those clients could then ping the server and add printers from its shares.
This event also seems to occur on a network that has several computers, including the PDC, configured to use the NWLink IPX/SPX protocol and have the same Internal Network Number. Configuring the computers to have different Internal Network Numbers rectifies the issue.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.