Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 7024 Source: service control manager

Level
Description
The <service name> service terminated with service-specific error <error number>.
Comments
 
This event is generated when the Service Control Manager cannot properly terminate a service. The name of the service and the error generated by it are displayed in the event. So the 7024 is not specific to a particular service, or let's say it may occur no matter what service is failing.

When searching for troubleshooting information, use the service name and the error specified in the event. In most cases, the error is a Windows standard error and searching for the error code will reveal (in many cases) a more friendly description of the problem that in many cases will turn to be an important clue in solving the issue. For example, Error code 10048 is a standard network-related error that indicates that an IP address port is already in use and it may be recorded when an application is attempting to use a TCP/IP port that is already used by another application.
Service: Tomcat Error: 0 - When I try and start Tomcat, it fails to start and creates the log entry "Apache Tomcat service terminated with service-specific error 0 (0x0)". Copying msvcr71.dll from <jre install dir>\bin to <apache install dir>\bin fixed the problem.
- Service: DPMRA, error: 10048 - See ME947682.
- Service: WINS, error: 3758096386 - See ME943514.
- Service: Plesk Control Panel Service, error: 1 - See "SWSoft Support Article ID: 1326".
- Service: SoftGrid Virtual Application Server, error: 41479 - See ME931595.
- Service: SoftGrid Virtual Application Server, error: 41520 - See ME930983.
- Service: SoftGrid Virtual Application Server, error: 41476 - See ME931166.
- Service: SoftGrid Virtual Application Server, error: 41539 - See ME930990.
- Service: SoftGrid Virtual Application Server, error: 41495 - See ME931165.
- Service: SoftGrid Virtual Application Server, error: 41508 - See ME931116.
- Service: Windows Internal Database (MICROSOFT##SSEE), error: 3417 - See ME929665.
- Service: The Windows Deployment Services Server, error: 10048 - See ME954410.
- Service: The Windows Deployment Services Server, error: 9 - See ME927770.
- Service: The Windows Deployment Services Server, error: 19 - See ME927770.
- Service: Windows Management Instrumentation Driver Extension, error: 100 - See ME922729.
- Service: SNA Host Account Cache, error: 2147500036 - See ME909446.
- Service: Computer Browser, error: 2550 - See "Cisco Support Document ID: 49860".
- Service: Symantec SPBBCSvc, error: 4294967295 - See "Symantec Knowledge Base Document ID: 2005062413371648".
- Service: HP smart Lock Polling, error: 255 - See "Symantec Knowledge Base Document ID: 1998090407532312".
- Service: Independent Management Architecture, error: 2147483649 - See "Citrix Support Document ID: CTX110630".
- Service: Independent Management Architecture, error: 2147876917 - See "Citrix Support Document ID: CTX103287".
- Service: Independent Management Architecture, error: 2147483705 - See "Citrix Support Document ID: CTX104970".
- Service: Messenher, error: 2105 - See ME176029.
- Service: Protected Storage, error: 2148270091 - See ME244610 and ME321454.
- Service: Terminal Services Licensing, error: 31 - See ME302427.
- Service: Microsoft Web Proxy, error: 147942402 - See ME303019.
- Service: Microsoft Web Proxy, error: 2147942402 - See ME839494.
- Service: Microsoft Web Proxy, error: 2147952422 - See ME831492.
- Service: Microsoft Firewall, error: 213007 - See ME831492 and ME303019.
- Service: Net Logon, error: 2114 - See WITP74110.
- Service: Net Logon, error: 3097 - See ME167248.
- Service: Net Logon, error: 5737 - See ME297524.
- Service: Task Scheduler, error: 2148073478 - See ME193405.
- Service: Microsoft Exchange Information Store, error: 4294966767 - See ME246272.
- Service: Microsoft Exchange Information Store, error: 0 - See ME822579, ME303186, ME306629 and ME823163.
- Service: SNMP, error: 3 - See ME158770, ME888798 and WITP74661.
- Service: File Server for Macintosh, error: 2 - See ME153755.
- Service: Task Scheduler, error: 2148073478 - See ME174302.
- Service: Routing And Remote Access, error: 16389 - See ME840686.
- Service: Routing And Remote Access, error: 127 - See ME940231.
- Service: Routing And Remote Access, error: 1003 - See ME299013.
- Service: Routing And Remote Access, error: 499 - See WITP83703.
- Service: Routing And Remote Access, error: 234 - See WITP76121.
- Service: Distributed Transaction Coordinator, error: 3221229584 - See ME900216 and ME916926.
- Service: Microsoft Exchange Information Store, error: 2147500037 - See ME294881.
- Service: Microsoft Exchange Information Store, error: 4021 - See ME170810.
- Service: Microsoft Exchange Information Store, error: 1012 - See ME280770.
- Service: Microsoft ISA Server Control, error: 278540 - See ME840683.
- Service: Background Intelligent Transfer Service, error: 2147942405 - See EV100098.
- Service: Background Intelligent Transfer Service, error: 2147500053 - From a newsgroup post: "To fix the problem download the latest security template, apply it, and then try to start the BITS service (net start bits). Alternatively, you can add read permissions to the NetworkService account". Also, see ME926078 for additional information about this event.
- Service: IIS Admin Service, error: 2148073478 - To further Jay Younker's suggestion concerning this error, I simply restored the key (c2319xxx) in C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys from a previous backup and was then successfully able to start the IIS Admin service.)

These are system files and will need to be restored from a shadow copy backup. After which a restart is necessary.
Service: Apache web server. - I found that the Apache service was unable to access a log-file. I changed the path in the conf-file and the problem was fixed.


- Service: Routing and Remote Access, error: 505 - When you try to start Routing and Remote Access on your Microsoft Windows 2000 Server-based computer, the service may not start. This can be caused by a third-party program installed on the computer or if the Oledb32.dll and Oledb32r.dll files are incorrectly registered. See ME329719 for the fix.
- Service: Routing and Remote Access, error: 234 - See ME317158.
- Service: Routing and Remote Access, error: 110 - See ME178272.
- Service: Routing and Remote Access, error: 87 - See ME840686.
- Service: Routing and Remote Access, error: 711 - See ME842696.
- Service: Terminal Services Licensing, error 3221291009 - See ME296146 and ME312028.
- Service: MSDTC, error: 3221229574 - See ME252641.
- Service: Microsoft Winsock Proxy, error: 213003 - See ME286237.
- Service: Microsoft Web Proxy service, error: 2148074253 - See ME293101.
- Service: Microsoft Exchange Information Store, error: 0 - See ME283179, ME298429, and ME328645.
- Service: Microsoft Exchange Information Store, error: 4294966090 - See ME260230.
- Service: Microsoft Exchange Information Store, error: 4294966786 - See ME327904.
- Service: Microsoft Firewall - See ME837864.
- Service: Messenger, error: 2270 - See ME314094.
- Service: SNA Host Account Cache, error: 3781166337 - See ME276681.
- Service: Net Logon, error: 2114 - See ME284850.
- Service: Task Scheduler, error: 2147750678 - See ME223170.
- Service: IMA Service, error: 2147483670 - See "Citrix Support Document ID: CTX101877" and "Citrix Support Document ID: CTX103345".
- Service: IMA Service, error: 2147483695 - See "Citrix Support Document ID: CTX114480".
- Service: Microsoft Firewall, error: 213005 - See ME813915.
- Service: Protected Storage, error: 2148270091 - See ME201865.
- Service: Terminal Server Licensing, error: 3221225489 - See ME268602.
- Service: Terminal Server Licensing, error: 31 - See ME273566.
- Service: Computer Browser, error: 2550 - See ME875362.
- Service: File Server for Macintosh, error: 1722 - See ME842715.
- Service: MetaFrame-COM Server - See "Citrix Support Document ID: CTX105844".
- Service: Independent Management Architecture - See "Citrix Support Document ID: CTX104734".
- Service: workstation, error: 2250 - See ME887416.
- Service: SNA Host Account Cache - See ME327235.
- Service: IIS Admin Service - See ME903072.
- Service: Trend ServerProtect - Read "Trend Micro Support Solution ID 1028537".
- Service: Secure Gateway - See "Citrix Support Document ID: CTX109600".

- Service: Background Intelligent Transfer Service - Try running “bitsadmin.exe /UTIL /REPAIRSERVICE” to repair a corrupted BITS installation. The bitsadmin.exe tool is part of Windows XP Service Pack 2 Support Tools. See ME838079 for information on Windows XP Service Pack 2 Support Tools.

- Service: MSSQLServerADHelper - From a newsgroup post: "If you try to start the MSSQLServerAdHelper service through control panel, you will get an error. SQL Server will start and stop this service when it needs to. For example this service is started when adding a server to the Active Directory using Enterprise Manager". See the link to "MSSQLServerADHelper Service" for more details on this service.

Also check ME231439 and MSW2KDB for more details.
- Service: BlackBerry Controller error 5003 - If the BlackBerry server is also a DNS server, stop the DNS service, start the BlackBerry Controller service (it should start fine now) and then start the DNS again.
- Service: IMA, error 2147483649 - According to Citrix Document ID CTX101667, you may get this problem if some of the Microsoft Access Driver registry settings are missing. See the article for details on recreating these settings.
Service: VMware VirtualCenter Server, Error 2: Everytime I reboot the server I received this event id - The VMware VirtualCenter Server service terminated with service-specific error 2 (0x2). Eventually I am able to manually start the service and everything is fine. It's probably a case of the VC service starting before SQL starts. If you leave it alone, the VC service should automatically try to restart after 5 minutes.

If you want to avoid the problem altogether, you'll need to do the following:
- Obtain the service name for your SQL Service. In Registry Editor, browse to HKLM\System\CurrentControlSet\Services and look for entries starting with MSSQL. In all likelyhood, yours will be called either MSSQL or MSSQL$SQLEXPRESS (ignore MSSQLServerADHelper)
- Browse to HKLM\System\CurrentControlSet\Services\vpxd
- Open the REG_MULTI_SZ value called DependOnService
- Add a line called "MSSQL$SQLEXPRESS" (or whatever value you determined above)
- Ensure that the last line in the value is blank

See also the VMWare Communities Link below, in the Links section.
Service: Office Communications Server Front-End, Error: 3287186749. As per ME968100, this problem occurs because the cross-database chaining option has been disabled for the RTC database and for the RTCDyn database. The article describes how to allow cross-database ownership chaining for the RTC database and for the RTCdyn database.

Service: Windows Deployment Services (WDS) Server, Error: 3238332162. This can happen if the Windows Deployment Server has not been configured. The service is unable to start until the server has been configured. See ME969368 for details.
- Service: Background Intelligent Transfer Service, error 2147944102: ME326460.
- Service: Computer Browser, error 2250: "This network connection does not exist." - I have seen this error occuring on domain controllers that had VMWare virtual network interfaces. Once these were set to "disabled" the Computer Browser service started fine.
- Service: DHCP Relay Agent, error 1: See ME191984.
- Service: Directory Replicator: See ME133475.
- Service: Messenger, error 2270: This behavior occurs when the computer's name is not unique on the network. Sometimes a computer will be given a name that is also a user name. See ME101355.
- Service: Microsoft Exchange Connector for POP3 Mailboxes,   error 2332296290: See ME267846.
- Service: Microsoft Exchange Information Store, error 0: See ME285116.
- Service: Microsoft Exchange Information Store Service, error 1276: See ME251173
- Service: Microsoft Firewall, error 212994: See ME300215.
- Service: Microsoft Firewall, error 213000: See ME293286.
- Service: Microsoft Firewall, error 213005:
Comments from newsgroup posts:
- "If you can, you should uninstall ISA, disable RRAS, reboot the machine, reinstall ISA (it is going to configure RRAS by itself) and apply appropriate patches in order to work with W2K3."
- "Install the latest service packs for both the operating system and ISA (SBS if ISA is part of SBS)."
- "Disable RRAS and see if the problem stops. Chances are, you've set up RRAS as a NAT router. ISA NAT and RRAS NAT can't coexist on the same server."
- Service: Microsoft Web Proxy, error 2147950650: See ME282035.
- Service: Microsoft Web Proxy, error 2148081668: See ME306687.
- Service: MSDTC, error 3221229574: See ME223397.
- Service: Protected Storage, error 2148270091: See ME317218.
- Service: Remote Access Connection Manager, error 1114: See ME168683.
- Service: Remote Access Connection Manager, error 620: See ME170029.
- Service: Remoteboot Service, error 2612: See ME122200.
- Service: Routing and Remote Access Service, error 1003: See ME171401, ME180602.
- Service: Terminal Services Licensing, error 29: See ME277917.
- Service: Terminal Server Licensing, error 3221487623: See ME190233 and ME216159.
- Service: Terminal Server Licensing, error 3221225489: From a newsgroup post: "Cases of this error indicates there is Registry Corruption;caused by an
installation error of TS or third party products. Unfortunately the only remedy outlined is to reinstall the Terminal server." You may try the articles from Error code 3221487623 (above).
- Service: Workstation, error 5728: See ME250262.
- Service: Windows Media Station Service, error 2147943732 - Some newsgroup post suggested reinstalling the latest service pack and in some cases removing and reinstalling the WMS service.
- Service: Microsoft Exchange Information Store, error 0: See ME295623.
- Service: Microsoft Search, error 2147746132: According to a newsgroup post, this error has been fixed by Service Pack 2. See also the information for Error code 2147746132.
- Service: SQL Server (SQLEXPRESS), Error: 17058 (0x42A2) - The SQL error log may contain additional information about this problem. This event in itself just indicates that the SQL Server service crashed but not the reason why. Some support forums comments indicate that somethis this is caused by problems with the SQL error log itself (i.e. the log being too big for SQL Express ~ 300 MB). Moving or renaming the log file fixed the problem.
- Service: Windows Firewall - See ME943996
- Service: DPMRA, error: 10048 - See ME947682.
- Service: WINS, error: 3758096386 - See ME943514.
- Service: Plesk Control Panel Service, error: 1 - See "SWSoft Support Article ID: 1326".
- Service: SoftGrid Virtual Application Server, error: 41479 - See ME931595.
- Service: SoftGrid Virtual Application Server, error: 41520 - See ME930983.
- Service: SoftGrid Virtual Application Server, error: 41476 - See ME931166.
- Service: SoftGrid Virtual Application Server, error: 41539 - See ME930990.
- Service: SoftGrid Virtual Application Server, error: 41495 - See ME931165.
- Service: SoftGrid Virtual Application Server, error: 41508 - See ME931116.
- Service: Windows Internal Database (MICROSOFT##SSEE), error: 3417 - See ME929665.
- Service: The Windows Deployment Services Server, error: 10048 - See ME954410.
- Service: The Windows Deployment Services Server, error: 9 - See ME927770.
- Service: The Windows Deployment Services Server, error: 19 - See ME927770.
- Service: Windows Management Instrumentation Driver Extension, error: 100 - See ME922729.
- Service: SNA Host Account Cache, error: 2147500036 - See ME909446.
- Service: Computer Browser, error: 2550 - See "Cisco Support Document ID: 49860".
- Service: Symantec SPBBCSvc, error: 4294967295 - See "Symantec Knowledge Base Document ID: 2005062413371648".
- Service: HP smart Lock Polling, error: 255 - See "Symantec Knowledge Base Document ID: 1998090407532312".
- Service: Independent Management Architecture, error: 2147483649 - See "Citrix Support Document ID: CTX110630".
- Service: Independent Management Architecture, error: 2147876917 - See "Citrix Support Document ID: CTX103287".
- Service: Independent Management Architecture, error: 2147483705 - See "Citrix Support Document ID: CTX104970".
- Service: Messenher, error: 2105 - See ME176029.
- Service: Protected Storage, error: 2148270091 - See ME244610 and ME321454.
- Service: Terminal Services Licensing, error: 31 - See ME302427.
- Service: Microsoft Web Proxy, error: 147942402 - See ME303019.
- Service: Microsoft Web Proxy, error: 2147942402 - See ME839494.
- Service: Microsoft Web Proxy, error: 2147952422 - See ME831492.
- Service: Microsoft Firewall, error: 213007 - See ME831492 and ME303019.
- Service: Net Logon, error: 2114 - See "JSI Tip 2791".
- Service: Net Logon, error: 3097 - See ME167248.
- Service: Net Logon, error: 5737 - See ME297524.
- Service: Task Scheduler, error: 2148073478 - See ME193405.
- Service: Microsoft Exchange Information Store, error: 4294966767 - See ME246272.
- Service: Microsoft Exchange Information Store, error: 0 - See ME822579, ME303186, ME306629 and ME823163.
- Service: SNMP, error: 3 - See ME158770, ME888798 and WITP74661.
- Service: File Server for Macintosh, error: 2 - See ME153755.
- Service: Task Scheduler, error: 2148073478 - See ME174302.
- Service: Routing And Remote Access, error: 16389 - See ME840686.
- Service: Routing And Remote Access, error: 127 - See ME940231.
- Service: Routing And Remote Access, error: 1003 - See ME299013.
- Service: Routing And Remote Access, error: 499 - See WITP83703.
- Service: Routing And Remote Access, error: 234 - See WITP76121.
- Service: Distributed Transaction Coordinator, error: 3221229584 - See ME900216 and ME916926.
- Service: Microsoft Exchange Information Store, error: 2147500037 - See ME294881.
- Service: Microsoft Exchange Information Store, error: 4021 - See ME170810.
- Service: Microsoft Exchange Information Store, error: 1012 - See ME280770.
- Service: Microsoft ISA Server Control, error: 278540 - See ME840683.
- Service: Background Intelligent Transfer Service, error: 2147500053 - From a newsgroup post: "To fix the problem download the latest security template, apply it, and then try to start the BITS service (net start bits). Alternatively, you can add read permissions to the NetworkService account". Also, see ME926078 for additional information about this event.
- Service: Citrix XTE Server - See "Citrix Support Document ID: CTX115096" for information on this problem.
- Service: IIS Admin Service, error: 2148073478 - This error started after a hard boot of our Citrix server. It turned out to be a problem with the MachineKey used to encrypt the IIS metabase. I simply restored the key (c2319xxx) in C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys from a previous backup and was then successfully able to start the IIS Admin service.


- Service: Routing and Remote Access, error: 505 - When you try to start Routing and Remote Access on your Microsoft Windows 2000 Server-based computer, the service may not start. This can be caused by a third-party program installed on the computer or if the Oledb32.dll and Oledb32r.dll files are incorrectly registered. See ME329719 for the fix.
- Service: Routing and Remote Access, error: 234 - See ME317158.
- Service: Routing and Remote Access, error: 110 - See ME178272.
- Service: Routing and Remote Access, error: 87 - See ME840686.
- Service: Routing and Remote Access, error: 711 - See ME842696.
- Service: Terminal Services Licensing, error 3221291009 - See ME296146 and ME312028.
- Service: MSDTC, error: 3221229574 - See ME252641.
- Service: Microsoft Winsock Proxy, error: 213003 - See ME286237.
- Service: Microsoft Web Proxy service, error: 2148074253 - See ME293101.
- Service: Microsoft Exchange Information Store, error: 0 - See ME283179, ME298429, and ME328645.
- Service: Microsoft Exchange Information Store, error: 4294966090 - See ME260230.
- Service: Microsoft Exchange Information Store, error: 4294966786 - See ME327904.
- Service: Microsoft Firewall - See ME837864.
- Service: Messenger, error: 2270 - See ME314094.
- Service: SNA Host Account Cache, error: 3781166337 - See ME276681.
- Service: Net Logon, error: 2114 - See ME284850.
- Service: Task Scheduler, error: 2147750678 - See ME223170.
- Service: IMA Service, error: 2147483670 - See "Citrix Support Document ID: CTX101877" and "Citrix Support Document ID: CTX103345".
- Service: IMA Service, error: 2147483695 - See "Citrix Support Document ID: CTX114480".
- Service: Microsoft Firewall, error: 213005 - See ME813915.
- Service: Protected Storage, error: 2148270091 - See ME201865.
- Service: McShield, error 5011 - See NAI Solution ID: nai20996, NAI Solution ID: nai22335, and NAI Solution ID: nai22337 for help in resolving this problem.
- Service: McShield, error: 5050 - See "Network Associates Support Solution ID: nai25201".
- Service: Terminal Server Licensing, error: 3221225489 - See ME268602.
- Service: Terminal Server Licensing, error: 31 - See ME273566.
- Service: Computer Browser, error: 2550 - See ME875362.
- Service: File Server for Macintosh, error: 1722 - See ME842715.
- Service: MetaFrame-COM Server - See "Citrix Support Document ID: CTX105844".
- Service: Independent Management Architecture - See "Citrix Support Document ID: CTX104734" and "Citrix Support Document ID: CTX109626".
- Service: workstation, error: 2250 - See ME887416.
- Service: SNA Host Account Cache - See ME327235.
- Service: IIS Admin Service - See ME903072.
- Service: Trend ServerProtect - Read "Trend Micro Support Solution ID: 127186" and "Trend Micro Support Solution ID 1028537".
- Service: Secure Gateway - See "Citrix Support Document ID: CTX109600".

- Service: Background Intelligent Transfer Service - Try running “bitsadmin.exe /UTIL /REPAIRSERVICE” to repair a corrupted BITS installation. The bitsadmin.exe tool is part of Windows XP Service Pack 2 Support Tools. See ME838079 for information on Windows XP Service Pack 2 Support Tools.

- Service: MSSQLServerADHelper - From a newsgroup post: "If you try to start the MSSQLServerAdHelper service through control panel, you will get an error. SQL Server will start and stop this service when it needs to. For example this service is started when adding a server to the Active Directory using Enterprise Manager". See the link to "MSSQLServerADHelper Service" for more details on this service.

Also check ME231439 and MSW2KDB for more details.
- Service: IIS Admin Service, error: 2149648394 - See the link to "The IIS Admin Service service terminated with service-specific error 2149648394" for information on this problem.
- Service: MSDTC - This event appeared repeatedly on all of my Windows 2003 R2 Servers. I was able to start the service by typing "msdtc -resetlog" and then "net start msdtc" at a command prompt, but anytime a group policy object was pushed to the servers, the service would fail again.
I resolved the issue by adding the "NETWORK SERVICE" with Full Access permissions to HKLM\SYSTEM\CurrentControlSet\Services\MSDTC. I have not received the error since.
- Service: Background Intelligent Transfer Service, error: 2147500053 - This is due to the ACL on the BITS service being incorrect by a group policy. To reset the ACL run:
sc sdset bits "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)".
- Service: Live Communications IM Archiving Service, error 2147747792 (0x800407D0) - This could happen if the connection to the SQL backend is down or if permissions to the service account are altered. Resolution: Make sure that the connection to the SQL backend is functional and the account the service is running under has proper privileges.
- Service: Live Communications IM Archiving Service, error 2147942405 (0x80070005) or error 2147975172 (0x80078004) - If there is something wrong with the archiving service and your archiving configuration is set to critical, the Live Communications Server service is automatically shutdown when archiving fails. You can disable critical archiving in the properties of the LCS pool –> Archiving –> Shut down server if archiving fails.
- Service: Live Communications Server, error 3286913032 (0xC3EA5008) – Install MSMQ on all servers you wish to archive, not only on the archiving server.
- Service: HP Insight Event Notifier - McAfee VirusScan v8.0 had been recently installed along with Access Protection. Access Protection was blocking local port 25 (SMTP). After adding “cimntfy.exe” and “lwconfig.exe” to the exclusions list, the service started with no errors and I was able to complete its configuration.
- Service: IIS Admin Service - This problem might appear if the Machine Keys are corrupted. Uninstall IIS, rename C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys to MachineKeys.old, and then re-install IIS.
- Service: Distributed Transaction Coordinator, error 3221229584 - I had this error on a Windows 2003 server. I tried to reset the log by following MS article ME205069, but the instructions for Windows 2000 did not work on Win2003. However, renaming the similar MsDtc folder to MsDtc.old and creating a new MsDtc folder allowed me to start the service properly.
- Service: Background Intelligent Transfer Service, error: 2147500053 - The Remote Procedure Call service was using a different account than the Local System Account. I changed the Log On as Local System Account, rebooted, then started The Background Intelligent Transfer Service.


- Service: Routing and Remote Access, error: 930 - I started getting this error when a partition was deleted and disk space relocated with Partition Magic. RRAS log file was configured to point to the deleted partition and prevented RRAS from starting. Reconfigure RRAS to change log path somewhere else. See the link to Error code 930 for additional information on this event.
- Service: Independent Management Architecture, error: 2147483655 - See "Citrix Support Document ID: CTX102894".
- Service: Microsoft Exchange Information Store, error: 0 - In my case this problem was caused by Symantec Antivirus for Exchange. See ME319754 for information on how to resolve this problem.
- Service: Terminal Server Licensing, error: 2 - I solved this error by installing File and Printer Sharing for Microsoft Networks.
- Service: Performance Logs and Alerts, error 2003 - As per ME315690, change the "Performance Logs and Alerts" service to run under the Local System account.
- Service: Routing and Remote Access, error 127 - I got this error when I was upgrading a server that had Microsoft ISA installed to Windows Server 2003. It turned out that during the upgrade the “C:\program files\common files\system\ole db\oledb.dll” file did not upgrade and this was preventing remote access from accessing its datastore. I had to restart in safe mode, replace the file with the current version, and re-register it from the command line with "regsvr32 oledb.dll". There were 2 other dlls that failed to register as well. They all seemed to be tied together. If you have this problem look for a file named “setuperr.log” in the “c:\winnt” directory. It will list all of the files that failed. Setup will not directly inform you if there was an error like this. It did however log an event in the event log to look at the “setuperr.log” file.
- Service: "Live Communications Server" - The Microsoft KB provides article ME832209 that describes a permissions related fix. However, this did not solve my issue. The issue was finally resolved when I discovered that an application upgrade done the previous night had uninstalled MSXML4. I re-installed the MSXML4 package and the service responded to the start request.
Service: RRAS Routing and Remote Access, error 691 (for win 2003)- I fixed it by copying ias.mdb and dnary.mdb from another machine to %windir%\system32\ias\.
Service: Computer Browser, error 2550: The system is configured in the registry not to maintain a server list while still having the Computer Browser service active. Workaround:
While having the Computer Browser service stopped, just set the key
HKLM\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList to 'Yes' or 'Auto' and start the Computer Browser service. See also ME112595.
Service: NetLogon, error 5737 on Win2000 SP2 Servers: See ME303330: This issue can occur if the Rsaenh.dll file is missing or damaged after you upgrade to Windows 2000 SP2. The Rsaenh.dll file is the Microsoft Enhanced Cryptographic Provider. When you install Windows 2000 SP2, Setup automatically converts your computer to 128-bit encryption and updates your computer with the Rsaenh.dll file.

Service: McShield, Error 5050: If you are not running the McShield service under the system context, the account you are using needs the following rights:
Administrator on the machine:
- Log on as a service
- Act as part of the Operating System


- Service: "Messenger", error 2119 - My laptop had the CAT5 and Wireless enabled and had 2 entries in DHCP (and DNS). The messenger service would not start until one of the interfaces was disabled.
- Service: "Routing and Remote Access", error: 16389 - Caused by RRAS service trying to access “C:\winnt\system32\system.mdb” which was surprisingly dated 1997 on a Windows 2000 SBS server. I renamed the file and RRAS now starts.
- Service: IIS Admin, error: 2148073478 (0x80090006) - This error typically signifies that the metabase is corrupt.
- Service: FTP server, error 10047. See ME120105.
- Service: PATROL Agent, error 1. - This will occur if you delete the PFCUser account. The PFCUser account is installed by the (BMC) PATROL agent, which is part of the OS-management functionality of the compaq Insight Agents (CIA) that Compaq licensed from BMC Software. CIA explicitly prompts you for PATROL Agent option during setup process.
- Service: Network Associates McShield, error: 5022 - If you look in the application event log, there will be an event id 5022 the same id as the error code (5022). It will tell you in more detail what went wrong. 5022 means the McShield could not start the virus-scanning engine. This usually means your ".dat" files have become messed up (a version mismatch in the ".dat" files --> "scan.dat" is a different version to "names.dat" for example). Try running the latest superdat again.
This event apeared when I migrated my Citrix Metaframe server to a new domain. The Metaframe server could no longer access the license data store. Running "dsmaint config" will allow you to renew/update the stored username/password credentials.
- Service: The Distributed Transaction Coordinator, error: 3221229627 - Happened on a Win2K server after installing Softrax Business Server.
- Service: The Distributed Transaction Coordinator, error: 3221229584 - You can try "msdtc -resetlog" from the command line.
- Service: Messenger, error 2119 -This happens on a network using WINS when your computername and login name are the same. When your machine boots, and you login, a WINS record [03h] is created for a destination to send net messages to. If your machine name and login are the same but you login to a different machine, the WINS record for messages will be a different IP address to that of your workstation of the same name. Thus the messenger service cannot create a record in WINS.

Resolution: Delete the WINS record [03h] with the conflicting name (you should verify why another IP address has that record) and restart the messenger service. Notes: This behaviour was observed on Win2K SP3 on a network running WINS.


- Service: "Messenger", error 1066. Occurs under W2K Server if Plug and Play service disabled.
- Service: "Messenger", error 2119 - Rename the computer to a unique name.
- Service: "Background Intelligent Transfer Service", error 2147944102. - I resolved this error by starting the Terminal Server Service and then started the Background Intelligent Service and the problem was resolved.
- Service: "Microsoft Exchange Information Store", error 4294966767 - Check the C: drive for space issues.
- Service: RRAS Routing and Remote Access, error 16389 - In my case, I fixed it by copying ias.mdb and dnary.mdb (located in %windir%\system32\ias\) from a machine where it worked.
- Service: Routing and Remote Access, error 1068 (Dependency group failed). - You may receive this is you only have TCP/IP installed and attempt to start Routing and Remote Access under Windows XP Pro. Install the NWLINK/NetBIOS protocol (remember to set your Address to something unique, other than 00000000 if you have multiple NICs) and restart the service.
- Service: Boot Information Negotiation Layer, error 20001 - No info.
- Service: Microsoft Exchange Information Store, error 4294966264 - No info.
- Service: Remote Access Connection Manager, error 615 - No info.
- Service: Routing and Remote Access,   error 2 - No info.
- Service: Routing and Remote Access,   error 1060 - No info.
- Service: Event Notifier, error 3 - No Info.
- Service: McShield, error 5011 - No info.
- Service: Routing and Remote Access, error 32797 - No info.
- Service: Remote Access Server, error 1066 - See ME106204.
- Service: Routing and Remote Access, error 16389 - From a newsgroup post: "I had the same problem on my RRAS server. The error 16389 just means that the service can not create temp-files. The service usualy runs in the local system account and try to use C:\WINNT\TEMP as the temp folder. In the NTFS permissions for this folder there has to be the user "SYSTEM" with full control permissions. I added this and it worked fine for me."
- Service: Microsoft Exchange Information Store, error 1011 - From a newsgroup post: "Error 1011 usually occurs at the last stage of a store recovery. Isinteg patch usually fixes this. Make a backup of the current store file before you run the command." See ME149238.
- Service: Certificate Services, error 2148081668. According to a Microsoft Support Engineer from a newsgroup post the solution is to remove and reinstall the Certificate Services. For details regarding Certificate Services installation see ME231881.
- Service: Messenger, error 2119. From a newsgroup post: "I had the computer name the same as a login. Once my computer name was changed the error went away."
Service: NetLogon, error 2114 - This was due to a Dependency service not being set. See ME269375.


- Service: Distributed Transaction Coordinator, error 3221229584. ME205069 suggestion may work. If it does not work, open regedt32 and go to the following registry key: HKEY_LOCAL_MACHINE\Cluster\Resources
You will have to check each resource until you find the one for the Distributed Transaction Coordinator. Expand this folder out and click on the the 1st folder listed (all numbers). You will see the value DTCLogPath: REG_SZ: x:\DtcLog, where x is the drive letter that the msdtc.log file is located on. Verify that this is correct. If not then change it.
- Service: Routing and Remote Access, error 711 - Following the suggestions on ME272978 fixed this problem.
- Service: computer Browser, error 2550: The error code means: "The network connection could not be found." This event can occur at startup, when the the order in which the services start is perventing the Computer Browser to startup correctly. The error may indicate another problem, but if not, there is nothing wrong with the service and you can simply start it manually after the computer has booted.
- Service: Messenger, error 2105: As per ME157815, NetBIOS needs to be running for this service to start.
- Service: Netlogon, error 3095 - See ME182720

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...