Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Comments for event ID 4001 currently in the processing queue.

Note: We have not reviewed this information yet so it is unfiltered, exactly how it was submitted by our contributors.

Event ID: 4001
Event Source: Health Service Script
Event Type: Error
Event Description: Microsoft.Windows.Server.NetworkAdapterDiscovery.ModuleType.vbs :
The class name ''Win32_NetworkAdapter Where NetConnectionID <> Null And NetConnectionStatus <> 0''
did not return any valid instances.  Please check to see if this is a valid WMI class name.. Generic failure

For more information see Help and Support Center at
Comment: This event come up each hour on different servers.
I tried to fix with rundll32.exe setupapiInstallHinfSection WBEM 132 C:\Windows\inf\wbemoc.inf but it didn't solve for 2 of 5 servers (the 3 others are now ok)
Event ID: 4001
Event Source: UAC-FileVirtualization
Event Type: Information
Event Description: Virtual file "\Device\HarddiskVolume3\Program Files\New folder" renamed to "\\C:\Program Files\fixie"
Event ID: 4001
Event Source: LPDSVC
Event Type: Information
Event Description: LPD Service Stopped Successfully
Event ID: 4001
Event Source: MSExchange AuditLogSearch
Event Type: Error
Event Description: A runtime exception occurred in AuditLogSearchServicelet while processing a request. Exception:
Microsoft.Exchange.Data.Directory.ADTransientException: Kan geen beschikbare Globale catalogus vinden in forest fmi-e.local.
   bij Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType ADObjectId domain String serverName Int32 port NetworkCredential credential)
   bij Microsoft.Exchange.Data.Directory.ConnectionPoolManager.GetConnection(ConnectionType connectionType)
   bij Microsoft.Exchange.Data.Directory.ADSession.GetConnection(String preferredServer Boolean isWriteOperation Boolean isNotifyOperation String optionalBaseDN ADObjectId& rootId ADScope scope)
   bij Microsoft.Exchange.Data.Directory.ADGenericReader.GetNextResultCollection(Type controlType DirectoryControl& responseControl)
   bij Microsoft.Exchange.Data.Directory.ADPagedReader`1.GetNextResultCollection()
   bij Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.GetNextPage()
   bij Microsoft.Exchange.Data.Directory.ADGenericPagedReader`1.<GetEnumerator>d__4.MoveNext()
   bij System.Linq.Buffer`1..ctor(IEnumerable`1 source)
   bij System.Linq.Enumerable.ToArray[TSource](IEnumerable`1 source)
   bij Microsoft.Exchange.Servicelets.AuditLogSearch.AuditLogSearchServicelet.WorkInternal()
   bij Microsoft.Exchange.Servicelets.AuditLogSearch.AuditLogSearchServicelet.Work()

Comment: Preceded by eventID 2103 source MSExchange ADAccess description Process MSEXCHANGEADTOPOLOGYSERVICE.EXE (PID=2028). All Global Catalog Servers in forest DC=domainnameDC=local are not responding: dc01.domainname.local
Event ID: 4001
Event Source: MSExchange Availability
Event Type: Error
Event Description: Process 2564[w3wp.exe:/LM/W3SVC/1/ROOT/EWS-4-131052614308720374]: Microsoft.Exchange.InfoWorker.Common.Availability.ProxyWebRequestWithAutoDiscover failed. Exception returned is Microsoft.Exchange.InfoWorker.Common.Availability.AutoDiscoverFailedException: A cross-forest Availability service that can fill request for mailbox <Fabio Antonio Maiocco Ursini>SMTP:[email protected] could not be found.. This event may occur when Availability Service cannot discover an Availability Service in the remote forest.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.