Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Comments for event ID 38 currently in the processing queue.

Note: We have not reviewed this information yet so it is unfiltered, exactly how it was submitted by our contributors.

Event ID: 38
Event Source: W32Time
Event Type: Information
Event Description: The time provider NtpClient has not received response from server xxx.xxx.co.uk (ntp.d|192.168.1.194:123->192.168.1.204:123).

For more information see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Comment:
Event ID: 38
Event Source: TerminalServices-Licensing
Event Type: Error
Event Description: The Terminal Services license server cannot issue a Terminal Services client access license (TS CAL) to the client because of following error: Can''t add certificate to store error c0010020.

Comment: Problem:

Users that were previously able to connect to a terminal server are now unable to connect.  When you open the TS licensing manager and view the properties of the license server you get the following error:

"The Licensing Wizard encountered an internal error from the license server. Message Number: 0xc0110011"

Cause:

The license server database is corrupted.

Resolution:

To fix a corrupted license server database you will need to uninstall and reinstall the TS Licensing service.  When  you reinstall the Licensing service you will have an unactivated License server with no TS CALs installed.  You will need to call the Microsoft Clearinghouse to reactivate so make sure you have your licensing documentation!

Go into Administrative Tools Services and stop the Terminal Server Licensing service.  Then go to c:\winnt\system32 and look for the Lserver folder.  Rename it to LserverOLD.

Now go into add/remove programs add/remove windows components and uncheck the terminal server licensing option and click next.  If the terminal server is install on the same machine make sure you do not change the mode of the terminal server.  Then finish the uninstall.  Reboot.

After the reboot go back to add/remove and check the TS licensing box again.  Once again do not change the mode of the TS if installed on this box.  Finish the install and reboot.

Check your system event log for two informational event logs: Event ID 5 (TermServLicensing) and Event ID 0 (TermServLicensing).  If you see these proceed to opening the licensing console.  You should see your server and that it is unactivated.  You will then need to call the Microsoft Clearinghouse to activate the server and to reissue your TS license keypacks.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...