Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9098 Source: MSExchangeSA

The MAD Monitoring thread was unable to read its configuration from the DS, error '<error code>'.
- Error: 0x800706ba - See the link to " Error code 0x800706ba" for information about this error.
As per Microsoft: "Event ID 9098 indicates that the Microsoft Exchange System Attendant service (Mad.exe) could not find a domain controller, did not have the required permissions to connect to a domain controller, or could not find the monitoring information for this server". See MSEX2K3DB for more details on this issue.

As per Microsoft: "This issue may occur if the Exchange Enterprise Servers security group does not have Manage auditing and security logs permissions on the domain controller. The Exchange Enterprise Servers group must have Manage auditing and security logs permissions on all the domain controllers in the domain". See ME328662 for more details.

- Error: 0x80041010 = wbemErrInvalidClass (Specified class does not exist) - See ME326011.
- Error: 0x80041001 = wbemErrFailed (Unspecified error) - See ME326305, ME328645, and ME896703.
- Error: 0x8000ffff - See ME867446 for a hotfix applicable to Microsoft Exchange Server 2003.
I fixed it with a batch file that contains this:

cd \exchsrvr\bin
regsvr32 /s cdowf.dll
regsvr32 /s exwmi.dll
mofcomp.exe "c:\winnt\system32\wbem\exwmi.mof"
mofcomp.exe -n:root\cimv2\applications\exchange "c:\winnt\system32\wbem\wbemcons.mof"
mofcomp.exe -n:root\cimv2\applications\exchange "c:\winnt\system32\wbem\smtpcons.mof".
This error showed up after an install of Exchange 2000. The install had failed midstream with a COM+ Error code 0xc103798a. The event log then produced these 9098 errors (if you choose to continue the install and not to abort). It indicates that there may have been a failure when registering "cdowfevt.dll", according to ME296095. I double-checked that it was the most up to date version from the latest Exchange 2000 Service Pack. I then manually registered this DLL from the command prompt with no problem. I then checked out the Exchange 2000 setup log and found this: “The command C:\WINNT\System32\WBEM\mofcomp.exe -n:root\cimv2\applications\exchange "C:\WINNT\System32\WBEM\wbemcons.mof" failed, returning Error code 1 (Incorrect function.)”.
I found that there were two files missing from the Exchange install, these two files, “wbemcons.mof” and “wbemcons.dll” belong in the “c:\winnt\system32\wbem” directory. I copied these two files over and ran the following command: “C:\WINNT\system32\wbem>mofcomp -N:root\cimv2\applications\exchange c:\winnt\syst em32\wbem\wbemcons.mof”. The outcome was the following: “Parsing MOF file: c:\winnt\system32\wbem\wbemcons.mof
MOF file has been successfully parsed
Storing data in the repository...”.
Then I rebooted the box, reran the Exchange 2000 setup and everything installed without error.
Additional information can be found in ME810861.

Error: 0x8004100 - As per Microsoft: "This issue can occur if the Exchange 2000 Server computer is unable to contact other Exchange 2000 Server computers or the domain controller in the domain." See link to ME266312. This can also occur if Mad.exe tries to "activate" Windows Management Instrumentation (WMI) classes that have not been created. This registration occurs during the Setup process. When MAD attempts this, WMI returns the error 80041010, WBEM_E_INVALID_CLASS. See link to ME296095. Also check ME285934.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.