[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

8.8

Advice on best order to troubleshoot the following event log errors on 2 servers

Asked by fixnix in Windows 2000 Operating System

Tags: event, information, rasctrs

I've got a client w/ an AD network that seems to have been set up by a "less than professional" admin.  I've sorted out many problems so far, but still have many Event log errors.  I'm not looking for advice on how to resolve them at this time since I can likely google up any answers I need.  I would, however, like to draw on the more experienced doze admins in the EE community for opinions on the most efficient ORDER in which to tackle these errors (I'm not sure which would be related, and it makes no sense to spend 4 hours troubleshooting <error x, y, and z> if fixing <error z> would have made the others go away anyway).

Environment:

Win2k server (sp4, current on hotfixes) as a PDC.

Win2k Advanced Server (sp4 + hotfixes, current) running WSUS and *not* configured as a backup DC nor handling any AD services except WSUS (and it also runs symantec corp av 7.x which seems to not use any AD-specific features).  It was apparently just set up as any other workstation that joined the domain.

About a dozen workstations, all members of the domain, a few network printers that are published in the directory.

The even log errors on the PDS consist of:

   Event 13,  E1000
   Intel gigabit problem (although the nic appears to be operating correctly)

   Event 107  WUSyncServices
   SUS failed to load some config info
   (the old SUS server/service is still installed...I intend to uninstall it once WSUS on the other server is operating correctly)

   Event 7023  Service Control Manager
   Auto Update Service Termination
   (Likely again from SUS...not too concerned about this one either since SUS will be scrapped)

   Event 11 w32time
   NTP server didn't respond
   (trivial to fix...just listing it since for completeness's sake)

   Event 7022 Service Control Manager
   COM+ Event System Service hung on starting

   Event 7001 Service Control Manager
   System Event Notification depends on COM+ which failed because: "After ctarting, the service hung in a start-pending state"  (obiously related to the 7022 event above)

  That's all for the system log, now for the Aplication log errors:

   Event 1000 Userenv
   "Windows cannot unload your registry file.  If you have a roaming profile, your settings are not replicated"
    DETAIL - Access Denied

   Event 4097 Event System
   "The COM+ Event System detected a bad return code during it's internal processing.  HRESULT was 80004015 from line 137 of .\service.cpp"

   Event 4097 Event System
   Same as above except HRESULT was 800700005 from line  42 of .\eventsystemobj.cpp

   Event 2001 rasctrs
   "The description for EventID (2001) in Source ( rasctrs ) cannot be found.  The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer.  The following information is part of the event:  The event lig file is corrupt."

   Event 1202 SceCli
   Repeated every 5 mins, "Security policies are propogated w/ warning 0x5: Access Denied"

That's all for the PDC, now for the System event logs on the WSUS server:

   Event 1058 Userenv
   "Windows cannot access the file gpi.ini for GPO CN={B28E....}, CN=Policies, CN=System, DC=(domain), DC=com.  The file must be present at location <\\domain.com\sysvol.......>. (The network path was not found)
  This error also happens on workstations, see http://Q_21530267.html for more detail on that issue.

   Event 1030 Eserenv
   Cannot query for list of Group Policy objects.....
   (related to the previous event.  Both the above events are repeated twice for each user:  SYSTEM, and the username of whomever is logging in to check the event logs)

That's all, experts.  What order do you suggest I tackle them?  Again....I'm not looking for specific advice on how to resolve any of the events.  I just was a "processing order" since yesterday I spent a lot of time tackling events that were only by-products of others that were the "real" problem....I don't want to waste any more time than I already have.

Thanks!
[+][-]08/17/05 10:21 AM, ID: 14693627Accepted Solution

Your question has an Asker Certified™ answer! fixnix verified that this solution worked for them--which means it will likely work for you, too. Click to view the solution free for 30-days now.

About this solution

Zone: Windows 2000 Operating System
Tags: event, information, rasctrs
Sign Up Now!
Solution Provided By: robrandon
Participating Experts: 1
Solution Grade: A
 
[+][-]08/17/05 11:14 AM, ID: 14694230Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20100204-EE-VQP-115