Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
File Server Resource Manager Service error: Unexpected error.
Running email action.
Handling a file screen audit event.
Processing File Server Resource Manager event
Action type: Email Action
Action name: Email Action0
SMTP server: <server>
Mail-from address: <address>
Mail-reply-to address: <address>
Mail-to address: <address>
Mail subject: <subject>
Mail message text: The system detected that user failed
File screen path: <path>
Error: IMessage::Send 0x80040211.
|English: Request a translation of the event description in plain English.|
In my case, I received the following description:
Starting File Server Resource Manager Service.
Error: IWbemDecoupledRegistrar::Register, 0x80041011
In order to solve this problem I ran the following from a command prompt
cd /d "%windir%\system32\wbem"
net stop srmsvc
net start srmsvc
When you define quotas, File Server Resource Manager (FSRM) stores information about these quotas in the quota.xml, quota.md, and databasefilescreen files in the \System Volume Information\SRM folder on the drive that the quotas were imposed initially. During a clean uninstallation of the FSRM, these files are removed. However, if the uninstallation was not completed successfully and you re-installed FSRM on the same computer, these files still remain and are not over-written by a subsequent re-installation of FSRM. See ME555941 for information on how to solve this problem.
This problem may occur if you are using Basic authentication together with NTLM or together with anonymous authentication on the SMTP server. See ME914678 for a hotfix applicable to Microsoft Windows Server 2003.
|Private comment: Subscribers only. See example of private comment|
|Links: ME555941, ME914678|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated