Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Comments for event ID 10021 currently in the processing queue.

Note: We have not reviewed this information yet so it is unfiltered, exactly how it was submitted by our contributors.

Event ID: 10021
Event Source: DCOM
Event Type: -
Event Description: -
Comment: I have this error on a win2k3 server, it is caused by SR manager an application to control scans and fax to mail and central management of MFP devices by Ricoh. went to administrative tools => component services =>computers =>my computer => DCOM Config => BDMTKCS.
Properties=> Security => launch and activation permissions and selected "Use default"

hopefully this will work :)



Index: 4523
Event ID: 10021
Event Source: SmsClient
Event Type: Error
Event Description:
Event Type: Error

Event Source: SmsClient
Event Category: None
Event ID: 10021
Date: MM/DD/YYYY
Time: hh:mm:ss AM/PM
User: N/A
Computer: <computer name>
Description:
The program for advertisement "<advertisement #>" failed ("<package #>" - "<package name>"). The program was able to be executed but the system was restarted unexpectedly before the program could be completed or before status could be recorded. No installation status MIF was found after the system restarted.

Possible cause: The program performs a restart of the client computer when it completes but the ''After running'' setting in the program''s properties is not set to Program restarts computer or the client machine was restarted while the program was running.
Solution: Verify the above. If the program does a restart when it completes even if it only requires a restart in some cases modify the program''s properties and set ''After running'' to ''Program restarts computer''.

For more information see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Comment:
Event ID: 10021
Event Source: Windows Search Service
Event Type: Error
Event Description: Unable to obtain registry information from performance counters for WSearchIdxPi for instance due to the following error: The operation completed successfully.   0x0.


Comment:
Event ID: 10021
Event Source: DCOM
Event Type: -
Event Description: -
Comment: Server 2003 if you're using McAfee on the server you will need to go to Administrative Tools-->Component Services-->Computer-->My computer-->DCOM
Right click on 'Frame Work Service' and select properties then the Security TAB. Under Launch and activation permissions click edit and add the user and give appropriate permissions E.G Administrator or John Doe. Index: 4523
Event ID: 10021
Event Source: MSFTESQL$Exchange
Event Type: -
Event Description: -
Comment: I got the same problem spontaneously: although my MSSQL server is running it's steadily emerges. My registry for corresponding branch is like this:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesqlFD]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesqlFD\Performance]
"Open"="PerfmonFDOpen"
"Close"="PerfmonFDClose"
"Collect"="PerfmonFDCollect"
"Library"="C:\\Program Files\\Microsoft SQL Server\\MSSQL.1\\MSSQL\\Binn\\msfte.dll" Index: 9728
Event ID: 10021
Event Source: MSFTESQL$Exchange
Event Type: -
Event Description: -
Comment: event id 10021 source:MSFTESQL$TEST
Description:

Could not get performance counter registry info for msftesql for instance TEST_STREAMSERV  due to the following error: The system could not find the environment option that was entered.   0x800700cb.


This occurs after the error
Could not get performance counter registry info for msftesqlFD for instance TEST_STREAMSERV  due to the following error: The operation completed successfully.
Index: 9728
Event ID: 10021
Event Source: MSExchangeMailboxAssistants
Event Type: Error
Event Description: Log Name:      Application
Source:        MSExchangeMailboxAssistants
Date:          9/19/2012 5:00:16 PM
Event ID:      10021
Task Category: Managed Folder Assistant
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      xxxxxxxxxxxxx
Description:
The MRM Assistant will skip processing mailbox ''xxxxx B:ec421686-9034-4df0-b353-0a0afda29369:d42a41c9-be00-4641-8ce0-939aa6c21a52:''. Exception details: ''Microsoft.Exchange.Assistants.SkipException: Couldn''t get user information for mailbox ''xxxxx@test.co.com'' from the Active Directory.
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ElcUserInformation..ctor(MailboxSession session)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ElcUserTagInformation..ctor(MailboxSession session Dictionary`2 allAdTags)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.SysCleanupSubAssistant.BuildMailboxData(MailboxSession mailboxSession)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.SysCleanupSubAssistant.Invoke(MailboxSession mailboxSession MailboxDataForTags& mailboxDataForTags)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ELCAssistant.<>c__DisplayClass6.<InvokeInternal>b__0()
   at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(TryDelegate tryDelegate FilterDelegate filterDelegate CatchDelegate catchDelegate)''.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MSExchangeMailboxAssistants" />
    <EventID Qualifiers="49156">10021</EventID>
    <Level>2</Level>
    <Task>10</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-09-19T15:00:16.000000000Z" />
    <EventRecordID>890585</EventRecordID>
    <Channel>Application</Channel>
    <Computer>xxxxxxxxxxx</Computer>
    <Security />
  </System>
  <EventData>
    <Data>xxxxx:ec421686-9034-4df0-b353-0a0afda29369:d42a41c9-be00-4641-8ce0-939aa6c21a52:xxxxxxxxxxx</Data>
    <Data>Microsoft.Exchange.Assistants.SkipException: Couldn''t get user information for mailbox ''xxxxxxxx'' from the Active Directory.
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ElcUserInformation..ctor(MailboxSession session)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ElcUserTagInformation..ctor(MailboxSession session Dictionary`2 allAdTags)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.SysCleanupSubAssistant.BuildMailboxData(MailboxSession mailboxSession)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.SysCleanupSubAssistant.Invoke(MailboxSession mailboxSession MailboxDataForTags& mailboxDataForTags)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ELCAssistant.<>c__DisplayClass6.<InvokeInternal>b__0()
   at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(TryDelegate tryDelegate FilterDelegate filterDelegate CatchDelegate catchDelegate)</Data>
  </EventData>
</Event>
Comment:
Event ID: 10021
Event Source: Search
Event Type: Error
Event Description: Die Registrierungsinformationen der Leistungsindikatoren für WSearchIdxPi für die Instanz   konnten wegen des folgenden Fehlers nicht abgerufen werden: Der Vorgang wurde erfolgreich beendet.   0x0.


- System

  - Provider

   [ Name]  Microsoft-Windows-Search
   [ Guid]  {CA4E628D-8567-4896-AB6B-835B221F373F}
   [ EventSourceName]  Windows Search Service

  - EventID 10021

   [ Qualifiers]  32768

   Version 0

   Level 2

   Task 1

   Opcode 0

   Keywords 0x80000000000000

  - TimeCreated

   [ SystemTime]  2013-03-16T05:56:53.000000000Z

   EventRecordID 24125

   Correlation

  - Execution

   [ ProcessID]  0
   [ ThreadID]  0

   Channel Application

   Computer HPENVY

   Security


- EventData

  Driver WSearchIdxPi
  InstanceName  
  InstanceNum  
  ErrorMessage Der Vorgang wurde erfolgreich beendet. 0x0



- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
  <EventID Qualifiers="32768">10021</EventID>
  <Version>0</Version>
  <Level>2</Level>
  <Task>1</Task>
  <Opcode>0</Opcode>
  <Keywords>0x80000000000000</Keywords>
  <TimeCreated SystemTime="2013-03-16T05:56:53.000000000Z" />
  <EventRecordID>24125</EventRecordID>
  <Correlation />
  <Execution ProcessID="0" ThreadID="0" />
  <Channel>Application</Channel>
  <Computer>HPENVY</Computer>
  <Security />
  </System>
- <EventData>
  <Data Name="Driver">WSearchIdxPi</Data>
  <Data Name="InstanceName" />
  <Data Name="InstanceNum" />
  <Data Name="ErrorMessage">Der Vorgang wurde erfolgreich beendet. 0x0</Data>
  </EventData>
  </Event>
Comment:
Event ID: 10021
Event Source: MSExchangeMailboxAssistants
Event Type: Error
Event Description: Event Source  : MSExchangeMailboxAssistants
Event ID   :  10021
Message   : The MRM Assistant will skip processing mailbox ''USER:GUID:SERVER''. Exception details: ''Microsoft.Exchange.Assistants.TransientMailboxException ---> Microsoft.Exchange.InfoWorker.Common.IWTransientException: Unable to find a matching retention policy tag in Active Directory for tag ''CN=RETENTIONTAGNAMECN=Retention Policy Tag ContainerCN=COMPANYCN=Microsoft ExchangeCN=ServicesCN=ConfigurationDC=DOMAINDC=com''. Please recycle the MSExchangeMailboxAssistants service or wait 24 hrs for the cache to be refreshed.
   at Microsoft.Exchange.InfoWorker.Common.ELC.AdTagReader.GetTagsInPolicy(MailboxSession session ADUser aduser Dictionary`2 allAdTags)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ElcUserTagInformation.GetAdData()
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ElcUserTagInformation.Build()
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.SysCleanupSubAssistant.BuildMailboxData(MailboxSession mailboxSession)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.SysCleanupSubAssistant.Invoke(MailboxSession mailboxSession MailboxDataForTags& mailboxDataForTags ElcParameters parameters)
   at Microsoft.Exchange.MailboxAssistants.Assistants.ELC.ELCAssistant.<>c__DisplayClass6.<InvokeInternal>b__0()
   at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(TryDelegate tryDelegate FilterDelegate filterDelegate CatchDelegate catchDelegate)
   --- End of inner exception stack trace ---''.

Comment: As described in the event restart the Microsoft Exchange Mailbox Assistants service on the affected server. This event occurred when a new retention tag was created applied to a new retention policy then that policy applied to a mailbox. Apparently the service caches retention tag information from Active Directory and queries once daily rather than querying on every mailbox being managed.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...