Bienvenido! - Willkommen! - Welcome!

Bitácora Técnica de Tux&Cía., Santa Cruz de la Sierra, BO
Bitácora Central: Tux&Cía.
Bitácora de Información Avanzada: Tux&Cía.-Información
May the source be with you!
Showing posts with label event id. Show all posts
Showing posts with label event id. Show all posts

Wednesday, May 22, 2013

An I/O operation initiated by the Registry failed unrecoverably.

The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.
http://windowsitpro.com/windows-server/troubleshooting-infamous-event-id-333-errors
==================================
Troubleshooting the Infamous Event ID 333 Errors
Executive Summary:
Event ID 333 errors are some of the most difficult Windows System event log errors to troubleshoot. Learn how to diagnose and resolve event ID 333 errors more quickly, using Microsoft’s Performance Monitor, poolmon.exe, and dureg.exe tools and troubleshooting tips from a Microsoft support professional

Event ID 333 Symptoms
Event ID 333’s description is An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, write out, or flush, one of the files that contain the system’s image of the Registry. This means that the image of the registry held in memory could not be written to disk. Windows uses what’s called the lazy writer to periodically write modified pages of memory to disk. When the lazy writer fails, an event ID 333 is recorded in the System event log.
The symptoms that might accompany the event ID 333 errors include these:
  • Server hangs: Your server may completely stop responding to keyboard or mouse movements and appears completely locked up, requiring a hard reboot.
  • Server sluggishness: The server is extremely slow to respond at the console, and processing information is significantly delayed.
  • Delayed Terminal Services connections: Users trying to log on to a terminal server could experience slow or delayed logons. Once they log on, they may be able to work without a slow experience; however, the logon takes several minutes instead of a few seconds.
Generally, event ID 333 can be classified into three categories:
  • Memory resource depletion: At the time the lazy writer attempted to write the modified pages in cache to disk, there weren’t enough resources to complete the operation. Often this type of problem is accompanied by either an event ID 2020 or 2019.
  • Disk was too busy or inaccessible: Sometimes a busy disk might not respond quickly enough to handle the lazy writer’s request to commit modified pages of memory to disk.
  • Registry bloat: The registry suddenly grows in size, which makes it increasingly difficult for the lazy writer to commit the changes to disk, commonly occurring on terminal servers.
Especially frustrating is how the events continue to flood the System event log (many times per minute) until the server is rebooted. All it takes is one time for the lazy writer to fail for the event flooding to begin. Although the condition that caused the lazy writer to fail might have been brief (such as a short spike in memory usage), event ID 333 continues to be logged even during normal memory utilization. The event is still logged because the system recognizes that a failure to sync the registry has occurred and the registry version contained in memory is out of sync with the version on disk. As a result, the number and frequency of event ID 333 messages isn’t a good indicator of the problem’s severity. By default the lazy writer tries to flush to disk every five seconds.
Event ID 333 Troubleshooting Tools
When troubleshooting event ID 333 errors, first you must determine which general category the error falls into. Also it’s useful to check the System event log for any other event IDs that accompany the 333 error, such as event ID 2020, which indicates a lack of paged pool memory, or event ID 2019, which indicates a leak in nonpaged pool memory.
These tools can assist in further diagnosing event ID 333 messages:
  • Performance Monitor: The counters to track are the system, memory, disk, and process objects.
    • Memory object: Look for a rise in nonpaged or paged memory.
    • Process object: Look for continuous rises in a process’s handles just prior to the event ID 333’s being logged.
    • System object: The %Registry Quota In Use counter can be useful in displaying how much of the allowed registry quota is being utilized. The higher the percentage, the more likely that the problem is related to a growing registry.
    • Physical disk: Look for increases in the Avg Disk Queue Length counter, which tracks the average number of read and write requests to the selected disk. If this counter spikes during the problem, start investigating the filter drivers (i.e., antivirus or backup software) on your system.
  • Poolmon.exe: This tool, which is included in the Windows Debugging Tools, is used to track kernel pool memory usage by pool-allocation tag name. Using poolmon.exe can halve your troubleshooting time by enabling you to find the tag that’s leaking memory.
  • Dureg.exe: This tool lets you view the size of the entire registry per hive. Dureg.exe is great for finding which registry hive is consuming the most space, which helps to determine what software might be causing the problem.
Case 1: Finding a Memory-Leaking Driver
I recently worked on an issue where the customer’s Windows 2003 SP2 server completely hung. Accompanying the event ID 333 was also event 2019, The server was unable to allocate from the system nonpaged pool because the pool was empty. The addition of the 2019 error told me that this was a resource-depletion issue, so the next step was to determine which driver was leaking. As Figure 1 shows, the output that poolmon.exe captured helped to pinpoint which tag allocated the highest amount of memory.
Figure 1: Poolmon.exe output indicating a leaking tag

To help in quickly identifying the leaky tag, use the -b switch, which will sort the output based on byte usage for each tag. The tag at the top of the output is the tag that has consumed the most amount of memory (in bytes).
Our next step was to use the built-in Windows Findstr utility to find the driver associated with the NTID tag, by running this command:
C:\>findstr /m /s "NTID" *.sys The /m switch tells Findstr to list only the filename in the output, and the /s switch searches in only the current folder and its subfolders. The Findstr output yielded the driver C:\WINDOWS\SYSTEM32\DRIVERS\CPQTEAM.SYS.
Armed with the pool-allocation tag and name of the driver leaking memory, our final step was to do a simple search on "NTID CPQTEAM". In the search results, we found a link to HP's tech forum that discussed a memory leak associated with a specific version of the Cpqteam.sys driver.
Case 2: Tracking Heavy Registry Usage
Not all event ID 333 errors are a result of a resource problem, however. It’s possible to have event ID 333 errors and be unable to correlate them with any resource depletion. One such issue I worked on occurred on a Terminal Services server on which event ID 333 was flooding the System event log. Using Performance Monitor, we noticed that the counter %Registry Quota In Use was greater than 98 (i.e., the system was using more than 98 percent of the allowed system quota for registry size). Knowing that the system was heavily utilizing the registry, we took another look at the Application event log entries during the problem period and found an event ID 1517, which Figure 2 shows.
Figure 2: Event ID 1517
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: Date
Time: Time
User: NT AUTHORITY\SYSTEM
Computer: ComputerName
Description:
Windows saved user User_Name registry while an application
or service was still using the registry during log off. The memory
used by the user’s registry has not been freed. The registry will
be unloaded when it is no longer in use.
Event 1517 indicates that the registry isn’t being freed when users log off. Our Performance Monitor counter %Registry Quota in Use correlates this information. We searched Microsoft Help and Support for “1517” and “registry” and found an article at support.microsoft.com/kb/944984 that fixed our problem.
Dureg.exe is another utility that’s becoming increasingly popular to use for troubleshooting event ID 333 errors. Dureg.exe output needs to be collected once before users experience a problem and again during the problem period to determine whether the registry is becoming bloated. The first run of dureg.exe (before the problem) would look like this:
C:\>dureg.exe /a
Size of HKEY_CLASSES_ROOT : 11627272
Size of HKEY_USERS : 56739224
Size of HKEY_LOCAL_MACHINE : 47719408
Total Registry data size: 115985904
The second time you’d run dureg.exe would be when the slow logon and event ID 333 problems are occurring, like this:
C:\>dureg.exe /a
Size of HKEY_CLASSES_ROOT : 11879338
Size of HKEY_USERS : 335257592
Size of HKEY_LOCAL_MACHINE : 46006166
Total Registry data size: 392142994
Notice the large change in the HKEY_USERS key, from 56MB to 334MB. Although this size discrepancy doesn’t necessarily resolve the problem, the information provides a valuable starting point for tech support that can drastically reduce the time needed to resolve the problem.
For this particular example, you’d want to run regedit and navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software. Then look for duplicate registry keys associated a particular application because the values of this key are copied to a user’s profile (HKEY_USERS) when the user logs on to a terminal server. An application might be flooding the Software key with values that end up bloating the registry and causing the Event ID 333 errors. Merely deleting any duplicate values under the HKEY_USERS key would be inadequate because the next time the user logged on, all those duplicate keys would be copied from the Software key to the HKEY_USERS key, and the problem would continue.
Faster Problem-Solving
Although troubleshooting Event ID 333 errors can be tricky, you’ve now learned ways to make the process easier. With help from Performance Monitor, poolmon.exe, and dureg.exe, you can more easily spot causes of Event ID 333 problems and use that information to resolve such problems faster.

See also, "Collecting and Analyzing Event and System Logs."
====================================
http://blogs.technet.com/b/yongrhee/archive/2009/10/14/how-to-troubleshoot-event-id-333-in-windows-server-2003.aspx
how to troubleshoot “Event ID 333” on Windows Server 2003.
My team has written a blog regarding this issue:
Troubleshooting Event ID 333 Errors
http://blogs.technet.com/askperf/archive/2007/10/30/troubleshooting-event-id-333-errors.aspx
and
Michael Morales has written a nice article for Windows IT Pro about this issue.
Troubleshooting the Infamous Event ID 333 Errors
http://windowsitpro.com/Articles/ArticleID/101059/pg/1/1.html
SYMPTOMS
Event Type: Error
Event Source: Application Popup
Event Category: None
Event ID: 333
Computer: computer name
Description: An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.
Troubleshooting:
------------------
I wanted to bring to you this new item to your arsenal of tools to get to the bottom of this issue.
1)  You want to make sure to have the following kernel hotfix or a newer version is installed:
970054 Many events with ID 333 are added to the System log on a Windows Server 2003-based computer
http://support.microsoft.com/kb/970054
Updates Ntoskrnl.exe 5.2.3790.4497
2)  You want to setup the tools for gathering data for memory issues as described in:
http://blogs.technet.com/yongrhee/archive/2009/10/14/how-to-troubleshoot-the-use-of-paged-pool-kernel-memory-event-id-2020-in-windows-server-2003.aspx

=========================================
http://serverfault.com/questions/56121/an-i-o-operation-initiated-by-the-registry-failed-unrecoverably
I added the column "handles count" to the processes view. One process permanently keeps creating handles (SNMP). Performance Wizard shows, SNMP had over 2 Million handles before our last server crash.
It's definitely a handle leak. The eventlog entry is merely the result of system resource depletion. The question is which process is leaking handles? I recommend using perfmon to trace various system wide resources counters, so when the system crashed again, you've enough data to find out the root cause.
The following counters maybe helpful: Object, Memory, Process\Snmp
BTW: in your case, the culprit is obviously the snmp process
==================================

Windows cannot impersonate the user

(Insufficient system resources exist to complete the requested service. ) 
server become inaccessible (no access to shares, Home Server Console, or RDP), although I could still ping the machine.
http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/1961f079-2092-4ccb-9e70-8d8fb22f8393
1.Click Start, click Run, type regedit, and then click OK.
.Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
3.On the Edit menu, point to New, and then click DWORD Value.
4.In the New Value #1 box, type PoolUsageMaximum, and then press ENTER.
5.Right-click PoolUsageMaximum, and then click Modify.
6.In the Value data box, type 60, click Decimal, and then click OK.
7.If the PagedPoolSize registry entry exists, go to step 8. If the PagedPoolSize registry entry does not exist, create it.
To do this, follow these steps:
•On the Edit menu, point to New, and then click DWORD Value.
•In the New Value #1 box, type PagedPoolSize, and then press ENTER.
8.Right-click PagedPoolSize, and then click Modify.
9.In the Value data box, type ffffffff, and then click OK.
10.Exit Registry Editor, and then restart the computer.

Friday, May 17, 2013

Driver Microsoft Shared Fax Driver required

for printer Fax is unknown. Contact the administrator to install the driver before you log in again.

http://social.microsoft.com/Forums/en-US/whssoftware/thread/c8cb79d5-551e-4f9f-969c-6bfb95694a8a
When connecting to your server the session is (trying) to share your local printers om the server, however since you have no drivers installed you get these messages in the event log. If you don't want these messages (and if you want to print to a local pinter when from a terminal serrver session on your sever) you can install drivers for each of the local printers on the server.
If you don't want to print to you local printers from a remote desktop session on the server and you are using you should expand options from the remote desktop connection dialog, then local resources tab, then unselect printers. If you are using remote connection to your server from your server homepage in a browser session you should nornally get a dialog which allows you to select local resources before connecting


 http://social.technet.microsoft.com/Forums/en/winservergen/thread/9cbe028f-48dd-4ffd-bdcf-8a1213b3180d
Open Remote Desktop application , go to "Local Resources" tab and uncheck Printers located under "Local devices and resources"

How to Use Local Printers, Drives and Clipboard in Remote Desktop Session
OS: Windows XP/Vista/7/8/Server 2003/2008/2010
    Open "Remote Desktop Connection" , go to "Local Resources" tab .
    Select (tick) "Printers" to use local printers in remote desktop session,
    Select (tick) "Clipboard" to use Clipboard in remote desktop session
Remote Desktop Connection
    To use your local drives (c:, d: , e: etc) click "More..." button, click +Drives to show the drives list , and select drives to use in remote session and press "OK", then go to General tab , enter the IP address or hostname of the remote pc you want to connect and press "Connect ". Now local devices are available in the remote session.
Remote Desktop Session Drives
How to disable local printers, drives and other resources in remote desktop sessions?
    Open "Remote Desktop Connection" , go to "Local Resources" tab .
    Uncheck "Printers" to disable local printers in remote desktop session,
Remote Desktop Connection
    Uncheck  "Clipboard" to disable Clipboard in remote desktop session
Remote Desktop Session Drives
    To disable local drives (c:, d: , e: etc) click "More..." button, click +Drives to show the drives list , and uncheck drives you don't want  to use in remote session and press "OK", then go to General tab , enter the IP address or hostname of the remote pc you want to connect and press "Connect ".
How to Use/Disable Local Printers, Drives and Clipboard in Remote Desktop Session?


Enable Remote Desktop on Windows Server 2003
by Daniel Petri - January 8, 2009
With Remote Desktop on Windows XP Professional or Windows Server 2003 (in Windows 2000 Advanced Server, this feature was called Terminal Services in Remote Administration Mode), you can have access to a Windows session that is running on your computer when you are at another computer. Read What's Remote Desktop in Windows XP/2003? for more info.
To enable the RDP service on Windows Server 2003 follow the next steps:
  1. Go to Control Panel.
  2. Click System.
  3. Go to the Remote tab.
  4. Select the "Allow users to connect remotely to this computer" box.

  1. Click Ok.
BTW, next time you need to open the System applet you can do so much faster: instead of clicking your way to the System icon, you can just right click My Computer and choose Properties, or even better - press the Windows Logo key on your keyboard and then press Pause/Break at the same time.
Note: In order for the RDP connection to work you need to allow TCP port 3389 connections to the server. You also need the name and password of one of the local (or domain) administrators, because this type of connection is only allowed for administrative accounts.

Related articles

You might also want to read the following related articles:

Related Articles


Monday, April 15, 2013

event ID 4307 NetBT

Initialization failed because the transport refused to open initial Addresses
http://support.microsoft.com/kb/123981

CAUSE

These errors occur when you disable all WINS related bindings and Show Binding For is set to < All Components >. They may also occur due to an incorrect order of the bindings.

RESOLUTION

To correct this problem:

  1. In the Show Bindings For list box, choose WINS Client(TCP/IP).
  2. Select the WINS binding shown and choose Enable.
  3. Verify that the WINS bindings are above any RAS bindings in the list (lower all RAS bindings to the bottom of the list).
  4. Choose OK and then choose OK again.
If enabling the bindings does not correct the problem, remove the TCP/IP protocol completely, and then reinstall it.

Details
Product:Windows Operating System
Event ID:4307
Source:NetBT
Version:5.2
Symbolic Name:EVENT_NBT_CREATE_ADDRESS
Message:Initialization failed because the transport refused to open initial Addresses.
   
Explanation
Your computer cannot access the network because its name does not match an IP address.
This could be caused by an incorrect computer name, or your network adapter might need to be reset.
   
User Action
To determine whether your computer's name is correct, at the command prompt, type nbtstat -n, and then press ENTER.
If the computer name is correct, no further user action is required.
If the name is incorrect, try resetting the network adapter.
To verify that the WMI Performance Adapter service is enabled
  1. In Control Panel, double-click Network Connections.
  2. Double-click WMI Performance Adapter.In Control Panel, double-click Network Connections.
  3. On the shortcut menu, click Disable.
  4. Right-click the network adapter again, an then click Enable.


Saturday, March 16, 2013

event ID 6033 -LSA policy

An anonymous session connected from LOCALMACHINENAME has attempted to
open an LSA policy handle on this machine. The attempt was rejected
with STATUS_ACCESS_DENIED to prevent leaking security sensitive
information to the anonymous caller.
The application that made this attempt needs to be fixed.  Please
contact the application vendor. As a temporary workaround, this
security measure can be disabled by setting the
\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr  ol\Lsa\TurnOffAnonymousBlock
DWORD value to 1.
http://support.microsoft.com/kb/839569
http://www.antionline.com/showthread.php?249223-LSA-Policy-Windows-2003-Server
The LSA (Local Security Authority) stores alot of information known as 'LSA secrets' which include usernames,trust releationships,RAS information and tons of other stuff. There is a program called LSADUMP2 that can be run to dump these secrets but I believe this requires physical access and probably admin rights as well, however the log indicates to me someone tried to query an LSA policy object from your machine using an anonymous session which on a vulnerable NT machine could be used to dislose user account names but since you are using W2k3 I wouldnt worry about it, most likely an automated scanner looking for old NT boxes.
 I would however worry about getting a firewall.

Friday, March 15, 2013

event ID 11305 or System error 1008

Product: LogMeIn -- Error 1305.Error reading from file E:\- DLDs\LogMeIn.msi.  System error 1008. Verify that the file exists and that you can access it.
the solution of Smiling  Carvass
Change permissions on %temp% as well as C:\Documents and Settings\%username%\Local Settings as per this thread:
http://www.pcreview.co.uk/forums/showthread.php?p=6933111#post6933111
I recently had this problem installing third party software. Some software uses the c:\documents and settings\%username%\local settings\ temp folder to store files temporarily during install. I checked the permissions on this, set them to 'full' for my account and system, and everything went ok. It took me several days of 'googling' to realise this! It came to me as I sat quietly, thinking the problem through. I remembered I had used a virtual drive in memory to store this folder, amongst others to prevent persistent files staying or re-appearing there. It occasionally gave problems when installing programs if there was not enough room for a very large program or if a re-start was required, as all its temporary files would be gone. Having read the advice about folder permissions here, and finding that I had the necessary permissions where this thread indicated I suddenly realised the problem might lie here
OK, GO TO:
The "c:\documents and settings\%username%\local settings\"

SCROLL TO THE TEMP FOLDER AND SET THE
temp folder'Spermissions to 'full' on this for YOUR account and System, and everything WILL WORK ok

UNDER WIN7 RUN YOUR INSTALLATION AS ADMINISTRATOR 
C:\Documents and Settings\%username%\Local Settings\
FIND THE TEMP FOLDER AND RIGHT CLICK ON IT
ONCE
YOU WILL SEE A LIST OF OPTIONS
NOW LEFT CLICK "TAKE OWNERSHIP"


THIS SOLUTION REALLY WORKS,

Thursday, February 28, 2013

event ID 8003 -master browser for the domain on transport NetBT_Tcpip


Details
Product: Windows Operating System
ID: 8003
Source: MRxSmb
Version: 5.2
Symbolic Name: EVENT_BOWSER_OTHER_MASTER_ON_NET
Message: The master browser has received a server announcement from the computer %2 that believes that it is the master browser for the domain on transport %3. The master browser is stopping or an election is being forced.
Explanation
This computer is a master browser, and another computer has announced that it is the master browser. There can be only one master browser on a subnet at any given time. This message is logged for informational purposes only.
The existence of two browser masters occurs when a second computer cannot contact the master browser for some reason: for example, when there are name resolution problems or the master browser is too busy to respond. When the original master browser receives a master announcement from the second computer, the master browser tries to resolve the conflict by ending its status as a master server, forcing an election, or both.
The choice of these actions depends on the status of the two computers: for example, whether one or both are domain controllers, primary domain controllers or Windows for Workgroups computers, and whether this computer lost an election earlier. For more information about browsing, see Appendix I: Windows 2000 Server Browser Service on the Microsoft Technet Web site.
   
User Action
No user action is required.
Version: 5.0
Symbolic Name: EVENT_BOWSER_OTHER_MASTER_ON_NET
Message: The master browser has received a server announcement from the computer %2
   
Explanation
This computer is a master browser, and another computer has announced that it is the master browser. There can be only one master browser on a subnet at any given time. This message is logged for informational purposes only.
The existence of two browser masters occurs when a second computer cannot contact the master browser for some reason: for example, when there are name resolution problems or the master browser is too busy to respond. When the original master browser receives a master announcement from the second computer, the master browser tries to resolve the conflict by ending its status as a master server, forcing an election, or both.
The choice of these actions depends on the status of the two computers: for example, whether one or both are domain controllers, primary domain controllers or Windows for Workgroups computers, and whether this computer lost an election earlier. For more information about browsing, see Appendix I: Windows 2000 Server Browser Service on the Microsoft Technet Web site.
 =================================
http://www.hightechdad.com/2007/05/09/how-to-fix-master-browser-mrxsmb-event-id-8003-errors/
The master browser has received a server announcement from the computer [computer] that believes that it is the master browser for the domain on transport NetBT_Tcpip_{ 
The master browser is stopping or an election is being forced.

Here are some steps you can follow (no guarantee that they will work, but it worked for me and for others based on the various things that I read).
  1. Look at the System Event log on your Server and look for the Error 8003 (like the one listed above). Within that log, identify the “computer” that is announcing itself as a master browser.
  2. Go on to the computer identified in step 1 and go to the Services Administration panel. You can usually find this by going to Control Panel - Administrative Tools - Services.
  3. Once you have Services open, look for an entry called “Computer Browser”. If that Service is “started,” you have found your culprit. If not, you may have to try the registry hack listed in step 6 a few steps
  4. Double click on the “Computer Browser” service to edit it. STOP the service and then change the type to Disabled (from either Manual or Automatic). Click OK to apply your changes.
  5. That should have resolved the issue. You should check your main servers event logs periodically to be sure that the error doesn’t show up. If it continues to show…
  6. …you have to check the registry value on the computer. You do this by launching your registry editor and going to the following key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\IsDomainMaster
    and ensure that it is set to FALSE. If it isn’t, you can change it to FALSE. Caution: registry edits are dangerous so only do this if you are sure you know what you are doing and the previous fix didn’t work. You probably have to reboot the machine to make the change take place.
I have also read that you need to be sure that all of your computers should be on the same subnet. If the above doesn’t work, be sure to check that.

More detail on the Computer Browser Service can be read here at Microsoft.
Steps 1-5 worked for me. I hope that this was a useful tip (given that it is so hard to find the solution).
========================
http://social.technet.microsoft.com/forums/es-ES/windowsserveres/thread/8f48a98c-7d23-4889-8046-10b55684815f
El evento es cuando el serviico de Browser se encuentra detenido o cuando existen dos master browsers en la red y sólo puede haber uno.
Te dejo más información:
Te recomendaría que fuerces que tu DC sea master browser.
 =======================
http://www.eventid.net/display.asp?eventid=8003&eventno=680&source=mrxsmb&phase=1
Here are some steps you can follow:

1. Look at the System Event log on your server and look for the error 8003. Within that log, identify the “computer” that is announcing itself as a master browser.
2. Go on to the computer identified in step 1, go to the Services Administration panel. You can usually find this by going to Control Panel -> Administrative Tools -> Services.
3. Once you have Services open, look for an entry called “Computer Browser”. If that service is “started, ” you have found your culprit. If not, you may have to try the registry hack listed in step 6.
4. Double click on the “Computer Browser” service to edit it. Stop the service and then change the type to „Disabled” (from either Manual or Automatic). Click OK to apply your changes.
5. That should have resolved the issue. You should check your main servers event logs periodically to be sure that the error does not show up. If the error continues to appear read step 6.
6. Check the following registry value on the computer: "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\IsDomainMaster". Ensure that it is set to false. You probably have to reboot the machine to make the change take place.
Click if the comment is good! x 109

EventID.Net
As per Microsoft: "This computer is a master browser, and another computer has announced that it is the master browser. There can be only one master browser on a subnet at any given time. This message is logged for informational purposes only". See MSW2KDB for more details on this issue.

See M191611 for details on symptoms of multihomed browsers.
See M190930 if IP Helper has been enabled on a Cisco switch.
See M188305 for information on troubleshooting the Microsoft Computer Browser service.

From a newsgroup post: "I just resolved a similar issue. My IP address and netmask were correct so according to TechNet I should not be getting this error message. I did an "ipconfig /release" followed by a "/renew" and received the 8003 message again. Therefore, I disabled the adapter then enabled it and everything is fine. Did another "ipconfig /release, /renew" and no message came up on the server. Note: This adapter had a static IP configuration at one time when it was connected to another network. Perhaps that was not cleaned up 100% when I changed it to DHCP. Disabling and enabling the adapter seemed to reset the configuration completely".

See the links to "EventID 8003 from source Rdr", "EventID 8003 from source Browser" and "Computer Browser and Browsing Roles" for additional information on this event.
Click if the comment is good! x 15

NBJ
Make sure the routers on the network are not forwarding UDP broadcasts, keeping browser elections on NetBT local to each subnet, and enable WINS or lmhosts on the network for netbios name resolution.
Click if the comment is good! x 9

David Fosbenner
In my case, I have a Windows 2003 Standalone server. Once I installed ISA Server 2006, I started to get these errors about once per hour. I disabled the Computer Browser service and the Print Spooler service since neither of these are necessary on an ISA Server, and the messages ceased. This error will occur in the same circumstances on ISA Server 2004 also.
Click if the comment is good! x 11

James
I resolved this issue by stopping and disabling the Browser service on the remote host.
Click if the comment is good! x 13

Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here!

Robert H.
This error can occur if the computer forcing the election has an incorrect subnet mask.
Click if the comment is good! x 13

Lingod
This event occurred when we had to computers with the same name in the same domain. Giving one PC some other name and joining both PCs again in the domain solved the problem.
Click if the comment is good! x 14

Nebil Ben Jeddou
In my case, all I had to do was to restart the Netlogon Service on the PDC.
Click if the comment is good! x 13

Steve Marek
I had this problem after disabling the Sygate personal firewall. It seems that sygate needs to be uninstalled if you do not want to use it anymore. In my case, Sygate blocked all incoming and outgoing data without any warnings or something else. After reactivating it, everything worked fine again.
Click if the comment is good! x 12

Shaun Smallwood
I used the answers from Anonymous about DNS entries and from Dave Murphy to solve this problem:
1. I had several entries listed as “(same as parent folder)” that were incorrect so I deleted them. There should only be an entry for each DC on your network.
2. I changed the "IsDomainMaster" key that Dave Murphy mentions above to “TRUE”.
Click if the comment is good! x 12

Matthias Kock
I got this error after a W2k3 migration. There was still old information in the lmhost-file (c:\windows\system32\drivers\etc\). After a correction (correct domain name, correct ip address), the problem was solved. As an alternative, you can turn off the use of the lmhost-file (in the nic-properties).
Click if the comment is good! x 11

Anonymous
This event started to occur every hour on our DC1 about the DC2. Solutions already listed here and in MS KB were not applicable to us. (Disabling/re-enabling NIC stopped the error for one day but then it showed up again) I believe the browser elections were being caused by DNS misconfig. (We use MS DNS AD-Integrated zones) Someone changed the IP address of the DC1 NS record (the record marked "same as parent folder"). When I finally noticed, I also noticed that the Host record for DC1 in DomainDNSZones disappeared entirely (replicated out). I manually changed the NS record back to the correct IP. I also manually added the Host record back in, under DomainDNSZones. (I allowed for replication time but the Host record did not come back on its own). Since then the error has not reoccurred.
Click if the comment is good! x 8

EventID.Net
This issue was found on a Windows 2000 domain with two subnets connected by a Cisco router that has the ip helper command enabled. See the link to "Cisco Support Document ID: 49860" for a solution to this problem.
Click if the comment is good! x 10

Doug Hall
We were getting this event frequently on our PDC Emulator DC which is Windows 2003. It turned out that the offending Windows XP PC had two enabled network cards, both with valid IP addresses, only one of which was connected to the network. Disabling the second network card solved the problem.
Click if the comment is good! x 11

Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here!

Anonymous
I got this error because in my W2k3 migration, supplying the personal firewall with the new server IP address had been missed. I supplied the address and the event disappeared.
Click if the comment is good! x 11

Timothy Riegel
If 2 servers are involved, and one server appears in the others’ event log, check the DHCP scope options on the server whose name appears in the event log. This error is most commonly attributed to the subnet mask but if the domain name in the scope options is different on one of the servers it will cause this error to appear. Correcting the domain name in the scope options fixes the error message.
Click if the comment is good! x 11

Maikel Martens
There is a hotfix available for Windows 2003 member server if a workstation becomes the master browser instead. See M843517 for the hotfix.
Click if the comment is good! x 9

Benjamin Turner
We had this occurring on our network from an XP machine and within 30 minutes the server would crash. We called Microsoft and we were told that XP could cause servers running Win2k or NT 4.0 to crash because of the forced election. We were instructed to set the “Computer Browser” service on the culprit machine to Disabled and to recreate the Paging File on the server. We did both and the server has been up and running since.
Click if the comment is good! x 10

Anonymous
This is a common event when you have multiple computers in a local workgroup and no domain.
Click if the comment is good! x 9

Anonymous
Windows XP Pro clients with the inbuilt firewall enabled on the LAN interface cause this event to appear in the server logs. Disabling this sorted the problem.
Click if the comment is good! x 9

Dave Murphy
Some considerations and ways to keep this from happening. As one other post mentioned, stopping the browser service on the workstation can clear this out. Other options to look into also consist of editing the "IsDomainMaster" key, under HKLM\System\CCS\Service\Browser\Parameters, on the domain controllers and changing the key to TRUE. This gives an extra boost the election process to help ensure the domain controllers retain the master browser status. Also on the domain controllers, change the "MaintainServerList" key to "Yes" instead of Auto, and on the workstation, change the entry to "No" instead of Auto. This should resolve a number of browsing issues.

There is also a tool, called the NetBIOS Browsing Console to help with browsing issues. The software and instructions can be found via M818092 article.
Click if the comment is good! x 5

Anonymous
Setting MaintainServerList to False will cause 2550 errors from the Browser service on restarts. The Browser service consequently fails every time. The solution to this can be to remove the Browser service with "instsrv browser REMOVE" at the command prompt.
Click if the comment is good! x 2

Anonymous
In my case I had an open pair in my cat5 cabling. Repaired the cable and the error message stopped.
Click if the comment is good! x 3

Why bother deciphering Event logs when GFI EventsManager can do everything for you? Free trial here!

Dan Israel
Client desktop or workstations using Win XP Pro can cause this issue if the built in Internet Connection Firewall is active.  Because this feature interferes with the network browsing, the client will attempt to become the Master Browser. Disabling the setting under browser/parameter will block the attempt to become master, but the client will still have difficult seeing and being seen in the workgroup/domain.
Click if the comment is good! x 2

Woodrow Wayne Collins
See also Microsoft W2K Resource Kit link.
Click if the comment is good! x 4

Michael Hopkinson
The actual commands to be applied to the Cisco router are:
"no ip forward-protocol udp NetBIOS-ns"
and
"no ip forward-protocol udp netbios-dgm"
This will prevent each VLAN or segment from seeing the others when sending out NetBIOS broadcasts.  You should end up with a valid master browser in each segment and no longer have these Events on your DC.
Click if the comment is good! x 2

Damien Murphy
Related to Cisco routers that have IP helper statements that point back to the DHCP server: This also occurs with "ip-helpering" if the DHCP server is a Windows 2000 Domain Controller holding the PDC Emulator Role (as it is the Domain Master Browser).
Click if the comment is good! x 2

EventID.Net
In order to stop this error from occuring, use Regedit and set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList from Auto or YES to FALSE

This will prevent the computer from attempting to become a Domain Master Browser and compete with Domain Controllers. If the server is a domain controller it is advisable to leave it with the default settings.
Click if the comment is good! x 3

Kevin Biddick
Look for NT 4.0 Domain controller that is hosting DHCP and Cisco routers that have IP helper statements that point back to the DHCP server. The default IP helper setings cause master browser elections. 

Monday, February 25, 2013

event ID 8003 -master browser error

The master browser has received a server announcement from the computer  {...} that believes that it is the master browser for the domain on transport NetBT_Tcpip_{80178446-3157-4DA9-8. The master browser is stopping or an election is being forced.

Common Questions About Browsing with Windows
8003 browsing errors with UDP forwarding
--------------------------
event ID 8003 windows server 2003
try resolutions mentioned in these Microsoft articles and check again: 
http://support.microsoft.com/kb/135464
http://support.microsoft.com/kb/143153
======================
Hundreds of Event 8003 errors on layer 3 network
There will be no consistency about which machine reports that it thinks it is the master browser. This is a symptom, not a cause. When a machine cannot obtain a browse list (because it cannot find a master browser), it assumes that browsing has failed. It then declares itself the master browser to force an election. That is how the system works. The machine which actually triggers the election is not the problem.
  Browsing is an NT legacy app, so it really has nothing to do with AD or DNS. Basically it relies on Netbios names and LAN broadcasts, and originally only worked in a single segment. To enable it to work across routers you need to have WINS and Netbios over TCP/IP, and you need all machines to register with WINS. WINS allows the master browsers to communicate directly (rather than through broadcasts) by converting names to IP addresses.
 First up, make sure that all of your servers have Netbios over TCP/IP enabled. If any of them are multihomed, make sure that only one interface has NBT enabled. Apart from that, debugging browser problems is still the same as it was in NT. The standard tool is browstat. The standard decription of browing is KB188001 and the standard troubleshooter is KB188305.
--------------------

event ID 8007 -Service status bit

The browser was unable to update the service status bits.  The data is the error.
http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/0cac064b-75a1-4f6e-a87b-70f0aac9b038/
Are you running any 3rd party firewalls on the machine? These can cause that error. If so can you disable as a test?
--------------------
You should check in event viewer for more details:
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows+Operating+System&ProdVer=5.0&EvtID=8007&EvtSrc=Browser&LCID=1033
-----------------

Event ID 8007 – Browser
===================
Check firewalls and AV software on the machines (from a google search).
also:
Event Message:
The browser was unable to update the service status bits. The data is the error.
Source Event Log Event ID Event Type
Browser System 8007 Error
Explanation:
An error occurred in the Server service.
User Action:
Check the event log with Event Viewer for more details about the error.
http://msdn.microsoft.com/en-us/library/ms841535.aspx
=============== 
http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/d609e51f-edd1-4224-89cf-f4587789a902/
You need to have the understanding of the microsoft browsing technology ( intermediate level ) to understand and troubleshoot the event id's related to computer browser service.
Computer browser service helps you to view your entire network in one single win32 UI or in shell , which means you would double click my network places -- entire network you would see the domain name and the related clients added to the domains.
How does these clients are being added ? , this is done with the help of computer browser service running on the clients.
The process of computer browser service is complex , It does browser elections and nominates the master browser , this master browser listens for all hosts announcements and caches them . So it depends how your network design is
Always a PDC is nominated as master browser , and if there is no PDC available , computer browser service would perform election and nominate additional DC's as one of the master browser.
So your network should comprise of WINS from which the PDC / Master browser would obtain the list of hosts using 1b record. So this PDC would contact all the master browsers across the network and merge the lists.

So for any network there will be
a) domain master browser
b) master browser
c) open appropriate UDP ports because they work on datagrams
===========================================
You need to be careful in designing your browser service , you need to enable computer browser service on DC's which you intend to make them as master browser server. and always PDC will be the domain master browser.
By saying this you need to now check if the list is getting populated , if not you need to troubleshoot further and one of the best utility to troubleshoot is browstat
http://technet.microsoft.com/en-us/library/cc739367(WS.10).aspx
 
===============
Cause:An error occurred in the server service.
Following information from a newsgroup post may help:
"Check following things.
1. Check for any virus infection to your system.
2. Check the permission for the folder "C:\WINNT" (system root)
3. Install updated driver for Ethernet card.
4. Try by reinstallation of the Service Packs installed."
----------------------------
"I removed and reinstalled "Browser" and "Workstation" services and reapplied the service packs and the problem has solved."
----------------------------
"We have faced the same problem. The problem was due to a memory error. We have used an Utility from MajorGeeks for memory test."
**Link given below. 
http://kb.prismmicrosys.com/evtpass/evtpages/EventId_8007_Browser_44470.asp
===============
http://www.computing.net/answers/windows-2003/the-browser-was-unable-to-update-the-service/10630.html
What Anti-Virus are you running?
What version of I.E. are you running?  
Maybe is a TCP/IP stack problem, as you told me, but I'm not quite sure if we will be able to do that in this production server. Do you know how to do it or when I can find some info about that?
----------
 Yes, if you only have one NIC you would have to do it after hours.
Here is where I got the info on the TCP/IP stack causing the problem...
http://www.techsupportforum.com/for...

afd.sys indicates a problem with tcp/ip stack.
reset tcp/ip stack
Use a manual method to reset TCP/IP for Windows XPNote This section is intended for advanced computer users.
The reset command is available in the IP context of the NetShell utility. Follow these steps to use the reset command to reset TCP/IP manually:
  1. To open a command prompt, click Start and then click Run. Copy and paste (or type) the following command in the Open box and then press ENTER:
    cmd
  2. At the command prompt, copy and paste (or type) the following command and then press ENTER:
    netsh int ip reset c:\resetlog.txt
    Note If you do not want to specify a directory path for the log file, use the following command:
    netsh int ip reset resetlog.txt
  3. Reboot the computer.
Use a manual method to reset TCP/IP for Windows Vista and Windows 7 
Note This section is intended for advanced computer users.
The reset command is available in the IP context of the NetShell utility. Follow these steps to use the reset command to reset TCP/IP manually:


  1. To open a command prompt, click Start and then type CMD in the Search programs and files.
  2. Right-click CMD.exe icon in Programs and choose Run as administrator.
  3. When the User Account Control box pop up, click Yes.
  4. At the command prompt, copy and paste (or type) the following command and then press ENTER:
    netsh int ip reset c:\resetlog.txt
    Note If you do not want to specify a directory path for the log file, use the following command:
    netsh int ip reset resetlog.txt
  5. Reboot the computer.
When you run the reset command, it rewrites two registry keys that are used by TCP/IP. This has the same result as removing and reinstalling the protocol. The reset command rewrites the following two registry keys:
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ 
SYSTEM\CurrentControlSet\Services\DHCP\Parameters\ 
To run the manual command successfully, you must specify a file name for the log, in which the actions that netsh takes will be recorded. When you run the manual command, TCP/IP is reset and the actions that were taken are recorded in the log file, known as resetlog.txt in this article.
The first example, c:\resetlog.txt, creates a path where the log will reside. The second example, resetlog.txt, creates the log file in the current directory. In either case, if the specified log file already exists, the new log will be appended to the end of the existing file.
===========================
The story continues I'm afraid. Since resetting the tcp/ip stack I've not had a stop error while browsing, however, I just tried to put my system on standby and a different stop error screen appeared, counted to 100 then restarted the pc. The stop error read:
IRQL not less or equal
STOP: 0x0000000A (0x00000016, 0x00000002, 0x00000000, 0x080500390)
------------
Im the event viewer, under Application:
There are repeated Application errors and Application hangs to Spybot's TeaTimer, event ID 1000. They are followed by Application errors described as 'Fault bucket 199747174.
I disabled Teatimer but got the stop error screen when attempting system standby.
Under Security:
There are a handful of 'Failure Audits', event ID 615, category 'Policy change', described as IPSec Services failed to get the complete list of network interfaces on the machine. Please run IPSec monitor snap-in to further diagnose the problem.
Under System:
It seems that the most recent error was to do with the browser, event ID 8007. 'The browser was unable to update the service status bits. The data is the error'.
However there are multiple entries for 3 sources:
System error, category 102, event ID 1003, which is described as the parameters quoted in my previous post.
The other two are multiple and always occur at the same time (according to the event viewer).
Source:W32Time
Event ID: 17
Description: Time provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
Source: W32Time
Event ID: 29
Description: The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. NtpClient has no source of accurate time.
I hope this sheds some light on things for you because I'm totally in the dark!
-----------------------
just had another afd.sys stop error:
STOP 0x000000D1 (0x00000000, 0x00000002, 0x00000000, 0xEE85E7FC)
Afd.sys -
I guess this means that the resetting of tcp/ip stack didn't work :(
-------------
The event viewer errors wouldn't cause a crash
http://support.microsoft.com/kb/830092/ check to see if your file dates are the same as in this kb to see if you need the hotfix
Do a memory test
============================
http://www.petri.co.il/forums/showthread.php?t=50805
I'm using Windows server 2003 Standard Edition R2, and i get my windows server freezed every morning. I still can move my mouse, but the Start menu and taskbar don't work, and Ctrl + Alt+ Del doesn't do anything.
Then, i checked the event viewer, and i got this error:

Quote:
EventID: 8007
The browser was unable to update the service status bits. The data is the error.
The browser error message occurs with 2 hours interval. Every time i hard restart the server, it's normal again, but it will get freeze again in the next morning.
I've been using Process Explorer software to find any process related to that error. And i found process svchost.exe which the service computer browser is in, contained 0x77e617ec process which keep occurring and i have no idea when it'll finish. I think my windows get freeze because that never ending process and eating my memory process.
I couldn't print-screen when i'm getting the 0x77e617ec, because i couldn't open any software. And i couldn't post image either here. May i'll add some pictures later.
When my windows server get freeze, 0x77e617ec process keep occurring under Start Address in the Process Explorer all the time.
-----------------------------------
Read this, http://www.bleepingcomputer.com/tuto...torial129.html and determine what process 0x77e617 is then we can debug from there.

Saturday, February 23, 2013

event ID 8032 -Master browser

Error: The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{295DA550-690F-4A11-A706-C247D694E155}. The backup browser is stopping.
Error: The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{909DCC46-93C2-4B24-A2AA-9BF5114EDF82}. The backup browser is stopping.
Warning: The browser was unable to retrieve a list of servers from the browser master \\D10YNN81 on the network \Device\NetBT_Tcpip_{909DCC46-93C2-4B24-A2AA-9BF5114EDF82}. The data is the error code.
---------------
You can disable the Computer Browser service in Windows services, that will stop it from trying to connect. Truthfully, if you have no other networked computers, just to go the Network properties and disable file/print sharing, that will stop several services, including the computer browser.
------------------
Did you remove file and print sharing from this computer or the master browser?
Is this computer connecting to the master browser via VPN?
Did you turn off annonymous enumeration on either this server or the master browser?
Does the master browser have multiple NIC's?
----------------
http://www.computing.net/answers/windows-2003/event-id-8032/4596.html
http://forums.techarena.in/windows-server-help/703617.htm
Just gone onto my PDC and this is the registry setting for 'Preferred Master Browser'. Should the Value be True, and on the other DC be false...Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\Browser\Parameters
Type: REG_SZ
Name: IsDomainMaster
Value: False
-----------------
You may want to use browstat to check the master browser status. Or disable the windows 2000 as master browser. these search results may help,
Event ID Troubleshooting
Event ID 2504, 2505, 8021 and 8032 - Inability to Browse ... Event id: 8032 - The browser service has failed to retrieve the backup list too many times ...
http;//www.chicagotech.net/wineventid.htm
Computer Browser
2) Event id: 8032 and Description: The browser service has failed to retrieve the backup list too many times on transport of .
------------------
I ran browstat and saw that the DC is the master browser, and then there are two other Win2K3 servers that are acting as backup browsers.
=================================
http://support.microsoft.com/kb/135404
 ===========================
http://support.microsoft.com/kb/135404
Common causes and solutions of browser Event ID 8021 and Event ID 8032 on domain master browsers
Article ID: 135404 - View products that this article applies to.
System TipThis article applies to a different version of Windows than the one you are using. Content in this article may not be relevant to you. Visit the Windows 7 Solution Center
This article was previously published under Q135404
 ===================
http://support.microsoft.com/kb/314872/en-us
Browse List Issues on Servers and Clients Include Error Messages About Event ID 8032 and Inability to Browse
Under the following conditions, you may experience one or more of the following symptoms:
  • When you double-click My Network Places in Windows Explorer, an incomplete browse list is displayed.
  • Computers that do not have file and printer sharing turned on do not appear in the browse list.
  • If a Windows-based domain controller does not have file and printer sharing turned on, Windows-based computers that try to use the browse list display the following information about Event ID 8032:
    The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{XXXXXXX-9F03-42B2-AB84-12EEEFD572E9}. The backup browser is stopping.
  • A Windows-based client user who is trying to browse My Network Places receives the following information about Event ID 8032:
    Event Type: Error
    Event Source: Browser
    Event Category: None
    Event ID: 8032
    Date: 16-Feb-2000
    Time: 10:22:31
    User: N/A
    Computer: Client
    Description: The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{XXXXXXX-9F03-42B2-AB84-12EEEFD572E9}. The backup browser is stopping.
    Data: 0000: 0000007a
  • On the Windows-based domain controller that does not have file and printer sharing turned on, the following information appears:
    Event Type: Error
    Event Source: Server
    Event Category: None
    Event ID: 2504
    Date: 16-Feb-2000
    Time: 11:59:22
    User: N/A
    Computer: DC
    Description: The server could not bind to the transport \Device\NetBT_Tcpip_{XXXXXXX-F096-4E5C-A847-F8F095C45053}.
    Data: 0000: aa 05 00 00

    Event Type: Error
    Event Source: Server
    Event Category: None
    Event ID: 2505
    Date: 16-Feb-2000
    Time: 11:59:31
    User: N/A
    Computer: DC
    Description: The server could not bind to the transport \Device\NetbiosSmb because another computer on the network has the same name. The server could not start.

CAUSE

This behavior can occur if the File and Print Service component was not selected during the initial setup of the server or if that component is no longer selected. When this occurs, the Server service does not bind to the NetBIOS interface. A Windows-based computer that becomes a backup browser but that does not have file and printer sharing turned on cannot share the browse list with clients. Any computer that is to be included in the browse list must also have file and printer sharing turned on.

RESOLUTION

To work around this behavior, install or turn on file and printer sharing on Windows-based domain controllers and on any computer that is in the browse list.

To install or turn on file and printer sharing in Windows XP, follow these steps:
  1. Click Start, click Control Panel, click Network and Internet Connections, and then click Network Connections.
  2. Right-click the network connection that you want to configure, and then click Properties.
  3. Click the General tab (for a local area connection), or click the Networking tab (for all other connections).
  4. Make sure that File and Printer Sharing for Microsoft Networks is in the list of components for the connection.

    NOTE: If File and Printer Sharing for Microsoft Networks is not in the list of components for the connection:
    1. Click Install.
    2. Select the Service check box, then click Add.
    3. In the Manufacturers box, click Microsoft.
    4. In the Network Services box, click File and printer sharing for Microsoft Networks, and then click OK.
  5. In the list of components for the connection, make sure that File and Printer Sharing for Microsoft Networks is selected, and then click Close or OK.
  6. Click Close or click OK

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

Properties

Article ID: 314872 - Last Review: December 1, 2007 - Revision: 1.6
APPLIES TO
  • Microsoft Windows XP Home Edition
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional x64 Edition