Link to home
Start Free TrialLog in
Avatar of jdflory
jdflory

asked on

Repeated browser event ID 8021 and 8032 then server loses connction to domain with nelogon event 5719

I am  having a very strange problem on our network and would greatly apprecite any help.

I have numerous servers that have all simultaineouly lost there connection to the domain.  A reboot seems to fix the problem but I want to figure out what the underlying issue is.  All the servers in question have repeated browser events 8021 and 8032 which leads up to the catostrophic nelogon event 5719 after this the server can not authenticate anyone and needs to be rebooted.  See events below:

First:
Event Type:      Warning
Event Source:      BROWSER
Event Category:      None
Event ID:      8021
Date:            11/13/2007
Time:            3:46:26 PM
User:            N/A
Computer:      SFS03
Description:
The browser service was unable to retrieve a list of servers from the browser master \\SFDC02 on the network \Device\NetBT_Tcpip_{E1BF078F-7EFF-4FB7-85BB-6E8CAE8C67A2}.
 
 Browser master: \\SFDC02
 Network: \Device\NetBT_Tcpip_{E1BF078F-7EFF-4FB7-85BB-6E8CAE8C67A2}
 
 This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.

Second:
Event Type:      Error
Event Source:      BROWSER
Event Category:      None
Event ID:      8032
Date:            11/13/2007
Time:            3:16:27 PM
User:            N/A
Computer:      SFS03
Description:
The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{E1BF078F-7EFF-4FB7-85BB-6E8CAE8C67A2}. The backup browser is stopping.

Third:
Event Type:      Error
Event Source:      NETLOGON
Event Category:      None
Event ID:      5719
Date:            11/13/2007
Time:            3:11:36 PM
User:            N/A
Computer:      SFS03
Description:
This computer was not able to set up a secure session with a domain controller in domain CALSB due to the following:
Not enough storage is available to process this command.  
This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.  

ADDITIONAL INFO
If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.
 
I have run netdaig dcdiag and combed through the event logs on our DC's and came up with nothing.  I have checked DNS and found several other threads with the exact same problem but these have eirthe been unanswerred or related to something else.

Avatar of arunexp
arunexp
Flag of United States of America image

Cause could be any of this
" Your computer performs an acting role as a master browser because of a forced election.
" Your computer network cards are linked to the same subnet.
" Your computer network cards are not linked directly to the same subnet, but are linked indirectly to the same subnet through other subnets that they are connected to.
" The master browser is using an incorrect subnet mask.
" Your computer is a multihomed computer. A multihomed computer links at the same time to two or more subnets by using multiple network cards.
" Your computer is a master browser.
" Your computer is running the TCP/IP protocol
" Your client computer and the Windows 2000-based computer are on the same network segment as a Cisco Systems PIX firewall device.
" The PIX firewall device is configured with the proxy Address Resolution Protocol (ARP) feature. This feature sends requests through the internal network adaptor of the PIX firewall device.

please check this links
http://support.microsoft.com/kb/135404
http://support.microsoft.com/kb/888816
Have you seen this link on all three errors?
http://www25.brinkster.com/ChicagoTech/wineventid.htm




Avatar of jdflory
jdflory

ASKER

Thanks for everyones feedback I have two questions:

Can anybody tell me why these broswer events eventually lead to the server to stop authenticating to AD and then need to reboot.  I have seen these types of events before and have had connectivity issues before but they usually do not cause these types of issues.

arunexp,
-None of are servers are multihomed but all of them do have teamed nics.
-Checked the subnet mask of the master browser (one our DC's) andit is correct.
-This anomally is happening on several differnt subnets but all these subnets only have a single path to connect to.
-We do have an ASA and a Pix on our network and I have read the article disbaled proxy arp on the pix.  Allthough I am confused as to why this would be causing the problem because both devices are used only as exit points to our networks (internet access) so the servers and DC's do not use the these devices to communicate.  Can you help me understand what the MS artilce is talknig about in regards to this issue.

Thanks again
ASKER CERTIFIED SOLUTION
Avatar of ChiefIT
ChiefIT
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of jdflory

ASKER

This issue has not showed itself again so it must have been some type of connectivity issue.

John,
I appreciate your  very descriptive response which helped me to to distinguish between the errors.  I had thought that the 8021 and 8032 events were causing the 5719 event.  But I think you were correct and they were just both caused by the same issue.  We have checked all other possibilities that you mentioned.

Thanks