Application error ID: 1030 and 1065 Source: Userenv

You may receive the following error events in the Application log:

Log: Application
Type: Error
Event: 1030
Source: Userenv
Description: Windows cannot query for the list of Group Policy objects. A message that describes the reason for this was previously logged by the policy engine.

Log: Application
Type: Error
Event: 1065
Source: Userenv

Description: Windows cannot perform filter check for Group Policy object CN={<GUID>}CN=PoliciesCN=SystemDC=DOMAINDC=local. Group Policy processing aborted.

Cause:

“gPCWQLFilter” attribute has Incorrect Domain name value

Resolution 1:

In my case, the event was related to the “gpresult.exe” file. The “framedyn.dll” file in c:\windows\system32\wbem, was corrupt and prevented the updating of policies. I replaced the file with a copy from another computer, and the event disappeared.

Resolution 2:

We checked the gPCWQLFilter Attribute value using Adsiedit Tool for CN={AF28D61E-2708-4100-AA38-0754B709A042}, CN=Policies, CN=System, DC=Domain, DC=local, gPCWQLFilter has attribute Value [OEMSBSDN-3380.local;{A4B1B2CE-FD58-40FC-9B17-7BB1888DD03A};0] so we Changed it to [Domain.local;{A4B1B2CE-FD58-40FC-9B17-7BB1888DD03A};0]

After making these changes we were able to Link Small Business Server Internet Connection Firewall Policy to PreSp2 WMI Filter under Group Policy Management Console

Run Gpupdate/force to apply the Group Policy Changes

Related Articles:

·         http://support.microsoft.com/kb/2003581

Read More

Application error ID: 3015 and 3024 Source: Server ActiveSync

You may receive the following error events in the Application log:

Log: Application
Type: Error
Event: 3015

Source: Server ActiveSync

Description: IP-based AUTD failed to initialize because the processing of notifications could not be setup. Error code [0x80004005]. Verify that no other applications are currently bound to UDP port [2883], or try specifying a different port number.

Log: Application
Type: Error
Event: 3024

Source: Server ActiveSync

Description: IP-based AUTD failed to initialize. Error code: [0x80004005].

Cause:

This event indicates that more than one application is attempting to use the User Datagram Protocol (UDP) listen port.

Resolution 1:

In my case the DNS process ID was using UDP port 2883.

You can check this by running "netstat -ano|more" looking for UDP 0.0.0.0:2883 and cross-reference the PID in the Task Manager.

After restarting DNS service, the port returned to the w3wp service and the error message will despair immediately (reboot is no required)

Resolution 2:

To resolve this problem, navigate to this registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

and edit the "ReservedPorts" value by ADDING the following lines:

645-1646
1701-1701
1812-1813
2883-2883
4500-4500

This change requires a reboot, and the fix resolved the problem immediately after the reboot.

Related Articles:

·         http://blogs.technet.com/b/sbs/archive/2008/07/17/some-services-may-fail-to-start-or-may-not-work-properly-after-installing-ms08-037-951746-and-951748.aspx

·         http://www.myeventlog.com/search/show/582

·         http://support.microsoft.com/default.aspx?scid=kb;en-us;956189

Read More

Application Log ID: 12302 Source: VSS

Symptoms: When you run the vssadmin list writers command on a Windows Server 2003-based computer, you may experience any of the following symptoms.

o    You receive the following error message: Error: 0x8000FFFF

o    The following event may be logged in the Application log:

Event Type: Error
Event Source: VSS
Event ID: 12302
Description: Volume Shadow Copy Service error: An internal inconsistency was detected in trying to contact shadow copy service writers. Please check to see that the Event Service and Volume Shadow Copy Service are operating properly.

o    The list is blank.

Cause: This problem may occur if the following registry key is corrupted:

HKLM\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions

Resolution: To have Microsoft resolve this problem for you, go to the following site: http://support.microsoft.com/default.aspx?scid=kb;en-us;940184#FixItForMeAlways.

If you prefer to fix this problem yourself, follow these steps:

1.    Click Start, click Run, type Regedit, and then click OK.

2.    Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\Subscriptions

3.    On the Edit menu, click Delete, and then click Yes to confirm that you want to delete the subkey.

4.    Exit Registry Editor.

5.    Click Start, click Run, type services.msc, and then click OK.

6.    Right-click the following services one at a time. For each service, click Restart:

o    COM+ Event System

o    COM+ System Application

o    Microsoft Software Shadow Copy Provider

o    Volume Shadow Copy

7.    Click Start, click Run, type cmd, and then click OK.

8.    At the command prompt, type vssadmin list writers, and then press ENTER.

9.    If the VSS writers are now listed, close the Command Prompt window. You do not have to complete the remaining steps.

If the VSS writers are not listed, type the following commands at the command prompt. Press ENTER after each command.

o    cd /d %windir%\system32

o    net stop vss

o    net stop swprv

o    regsvr32 ole32.dll

o    regsvr32 oleaut32.dll

o    regsvr32 /i eventcls.dll

o    regsvr32 vss_ps.dll

o    vssvc /register

o    regsvr32 /i swprv.dll

o    regsvr32 es.dll

o    regsvr32 stdprov.dll

o    regsvr32 vssui.dll

o    regsvr32 msxml.dll

o    regsvr32 msxml3.dll

o    regsvr32 msxml4.dll

Note: The last command may not run successfully.

10. At the command prompt, type vssadmin list writers, and then press ENTER.

11. Confirm that the VSS writers are now listed.

Related Articles:

• http://www.eventid.net/display.asp?eventid=12302&eventno=4519&source=VSS&phase=1
• http://support.microsoft.com/default.aspx?scid=kb;en-us;940184
• http://support.microsoft.com/default.aspx?scid=kb;en-us;940032

Read More

Application Error ID: 108 and 114 Source: EXOLEDB

You may receive the following error events in the Application log:

Log: Application
Type: Error
Event ID: 108
Source: EXOLEDB
Description: Microsoft Exchange OLEDB was unable to either create an event sink object or get necessary interface(s) from the sink class specified by ExSchema.XmlPromotion.1, HRESULT = 0x80070005.

Log: Application
Type: Error
Event ID: 114
Source: EXOLEDB
Description: Microsoft Exchange OLEDB has disabled the event binding due to the problems in the event sink. Binding ID = {CD16762F-654A-4874-A34B-0D0046BD9B08}. You may need to contact the event sink author and get a fixed or updated copy.

Cause:

This issue may occur when the following conditions are true:

·         In the DCOM Configuration utility (Dcomcnfg.exe), the default permissions have been modified. They have been modified in the Default Access Permissions area of the Default Security tab in the DCOM Configuration utility.

·         The System account and the Interactive special group have not been explicitly added. They must be granted Allow Access permissions.

Resolution:

To resolve the problem, add the system account and the Interactive special group. Grant them Allow Access permissions. To do this, follow these steps:

1.    From the Start menu, click Run and type Dcomcnfg.exe in the Open box, and then click OK.

2.    In Component Services, click Console root, expand Component Services, expand Computers, and then click My Computer

3.    On the Action menu, click Properties

4.    Click the Default Security tab, and then click Edit Default under Default Access Permissions.

5.    Click Add to add SYSTEM and INTERACTIVE and to grant them Allow Access permissions.

6.    Click OK.

Related Articles:

·         http://support.microsoft.com/default.aspx?scid=kb;en-us;324645

·         http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Exchange&ProdVer=6.5.6940.0&EvtID=114&EvtSrc=EXOLEDB&LCID=1033

·         http://www.eventid.net/display.asp?eventid=114&eventno=2548&source=EXOLEDB&phase=1

·         http://www.eventid.net/display.asp?eventid=108&eventno=2547&source=EXOLEDB&phase=1

Read More

Application Error ID: 1000 Source: Windows SharePoint Services 2.0

Symptoms:

The following event ID is logged (one or more times) in the Application log on the server:

Log: Application
Type: Error
Event ID: 1000

Source: Windows SharePoint Services 2.0

Description: #50070: Unable to connect to the database DatabaseName on SQLServerComputerName. Check the database connection information and make sure that the database server is running

Cause:

This issue may occur if the user account to which the Windows SharePoint Services Timer Service is configured to log on does not have permissions to the configuration database.

Resolution 1:

To resolve this issue, synchronize the Windows SharePoint Services Timer Service together with the new user account information. To do this, follow these steps:

1.    Start Windows SharePoint Services Central Administration.

2.    On the Windows SharePoint Services Central Administration page, click Configure virtual server for central administration under Server Configuration.

3.    On the Configure Administrative Virtual Server page, click Use an existing application pool, click the existing application pool that you are already using, and then click OK

Resolution 2: (work for me)

The "SharePoint Timer Service" service was running Log On As "NT AUTHORITY\NETWORK SERVICE".

This was changed to the service account to Log On As "Local System".

The problem is now gone.

Related Articles:

·         http://support.microsoft.com/kb/900498

·         http://www.eventid.net/display.asp?eventid=1000&eventno=3491&source=Windows%20SharePoint%20Services%202.0&phase=1

Read More

Application Warning ID: 213 Source: LicenseService

Symptoms:

After you demote the first domain controller in a site, the following error message appears in the target server's application log:

Log: Application

Type: Warning

Event ID: 213

Source: LicenseService

Description: Replication of license information failed because the License Logging Service on server ServerName could not be contacted.

Cause:

The licensing computer for the site cannot be contacted by the server on which the event is generated.

Resolution:

1. Open Active Directory Sites and Services.

2. Click the site on which the server is located.

3. In the details pane, click License Site Settings.

4. On the Action menu, click Properties.

5. Under Licensing Computer, select a different site license server, and then click Change.

Related Articles:

·         http://support.microsoft.com/default.aspx?scid=kb;en-us;296681

·         http://www.eventid.net/display.asp?eventid=213&eventno=52&source=LicenseService&phase=1

Read More