asked on

Event ID 1054 Windows Cannot Obtain the Domain Controller - TS session goes inactive

I have an Windows 2003 X64 SP2 DC that occasioanlly throws this event. I have been chasing it for quite sometime.
I have eliminated most of the things people often associate with this error. It passes DC Diag clean. There is no problem with DNS. What I have discovered recently is that it is in fact related to a terminal services session becoming/going inactive. (Without giving too much detail I have various debugging enabled and have been running netmon captures.)

However the RDP session is encrypted to it is difficult to actually determine exactly what is causing the error.
It is harmless but annoying. Has anybody tracked 1054 down to this cause, any ideas as what might
be happening? I know this error has been linked to various network errors as well, but I am reasonably
confident that it is not these as I would see some sort of error in the network captures.

Netman66

What make/model server is this? What NIC(s) are installed?

neiljava

ASKER

I have been round the various suggestions that it is Gigabit relayed issue and have a AMD patch
for realted network issues.

Network Card(s): 1 NIC(s) Installed.
[01]: Broadcom NetXtreme 57xx Gigabit Controller
Connection Name: Local Area Connection
DHCP Enabled: No
IP address(es)
[01]: 192.168.0.8

Host Name: DRC
OS Name: Microsoft(R) Windows(R) Server 2003 Standard x64 Edition
OS Version: 5.2.3790 Service Pack 2 Build 3790
OS Manufacturer: Microsoft Corporation
OS Configuration: Primary Domain Controller
OS Build Type: Multiprocessor Free
Original Install Date: 05/09/2007, 03:15:19
System Up Time: 4 Days, 4 Hours, 7 Minutes, 57 Seconds
System Manufacturer: Dell Inc
System Model: OptiPlex 740
System Type: x64-based PC
Processor(s): 2 Processor(s) Installed.
[01]: AMD64 Family 15 Model 67 Stepping 2 AuthenticAMD ~2605 Mhz
[02]: AMD64 Family 15 Model 67 Stepping 2 AuthenticAMD ~2606 Mhz
Total Physical Memory: 8,126 MB
Available Physical Memory: 6,183 MB
Page File: Max Size: 9,744 MB
Page File: Available: 8,426 MB
Page File: In Use: 1,318 MB
Page File Location(s): C:\pagefile.sys
Domain: thetestplace.internal
Logon Server: \\DRC
Hotfix(s): 123 Hotfix(s) Installed.
[01]: File 1
[02]: File 1
[03]: File 1
[04]: File 1
[05]: File 1
[06]: File 1
[07]: File 1
[08]: File 1
[09]: File 1
[10]: File 1
[11]: File 1
[12]: File 1
[13]: File 1
[14]: File 1
[15]: File 1
[16]: File 1
[17]: File 1
[18]: File 1
[19]: File 1
[20]: File 1
[21]: File 1
[22]: File 1
[23]: File 1
[24]: File 1
[25]: File 1
[26]: File 1
[27]: File 1
[28]: File 1
[29]: File 1
[30]: File 1
[31]: File 1
[32]: File 1
[33]: File 1
[34]: File 1
[35]: File 1
[36]: File 1
[37]: File 1
[38]: File 1
[39]: File 1
[40]: File 1
[41]: File 1
[42]: File 1
[43]: File 1
[44]: File 1
[45]: File 1
[46]: File 1
[47]: File 1
[48]: File 1
[49]: File 1
[50]: File 1
[51]: File 1
[52]: File 1
[53]: File 1
[54]: File 1
[55]: File 1
[56]: File 1
[57]: File 1
[58]: File 1
[59]: Q147222
[60]: SP1 - SP
[61]: IDNMitigationAPIs - Update
[62]: NLSDownlevelMapping - Update
[63]: KB925398_WMP64
[64]: KB938127-IE7 - Update
[65]: KB942615-IE7 - Update
[66]: KB947864-IE7 - Update
[67]: KB956390-IE7 - Update
[68]: KB914961 - Service Pack
[69]: KB921503 - Update
[70]: KB924667-v2 - Update
[71]: KB925902 - Update
[72]: KB926122 - Update
[73]: KB927891 - Update
[74]: KB929123 - Update
[75]: KB930178 - Update
[76]: KB932168 - Update
[77]: KB932596 - Update
[78]: KB933360 - Update
[79]: KB933729 - Update
[80]: KB935839 - Update
[81]: KB935840 - Update
[82]: KB935966 - Update
[83]: KB936021 - Update
[84]: KB936782 - Update
[85]: KB937143 - Update
[86]: KB938127 - Update
[87]: KB938464 - Update
[88]: KB939653 - Update
[89]: KB941202 - Update
[90]: KB941568 - Update
[91]: KB941569 - Update
[92]: KB941644 - Update
[93]: KB941672 - Update
[94]: KB941693 - Update
[95]: KB942615 - Update
[96]: KB942763 - Update
[97]: KB942840 - Update
[98]: KB943055 - Update
[99]: KB943460 - Update
[100]: KB943484 - Update
[101]: KB943485 - Update
[102]: KB944653 - Update
[103]: KB945553 - Update
[104]: KB946026 - Update
[105]: KB948496 - Update
[106]: KB948590 - Update
[107]: KB948881 - Update
[108]: KB949014 - Update
[109]: KB950762 - Update
[110]: KB950974 - Update
[111]: KB951066 - Update
[112]: KB951072-v2 - Update
[113]: KB951698 - Update
[114]: KB951746 - Update
[115]: KB951748 - Update
[116]: KB952954 - Update
[117]: KB954211 - Update
[118]: KB956391 - Update
[119]: KB956803 - Update
[120]: KB956841 - Update
[121]: KB957095 - Update
[122]: KB958644 - Update
[123]: XpsEPSC

neiljava

ASKER

I should have added that now that I have figured out that it is caused by the TS session I reckon I can reasonably discount NIC issues since if there are no active TS sessions I do not get the error.

Netman66

You're running this on a workstation rather than a server, so there are other things that may come into play such as low level devices like the TPM.

Regardless, try disabling Media Sense on the NIC if it's running GB.

http://support.microsoft.com/kb/326152

http://support.microsoft.com/kb/239924

ASKER CERTIFIED SOLUTION

neiljava

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Netman66

That would do it, yes.

Was the server renamed after TS was installed?

neiljava

ASKER

No it has been the same name since the original install 05/09/2007 according to the system.
I do not know if TermServLicensing as an SPN existed prior to 2003 server but it certainly does not
exist on any of my 2003 or 2008 servers.
Damn odd and has been bugging me for months that error

neiljava

ASKER

BTW thanks for the pointers on the NIC, but I had chased that particular route previously. It was when it became clear that it was a TS issue and that I could reproduce it by leaving a TS connection to go inactive.
Prior to that, I had nothing at all that had even hinted that it was caused by a TS connection. Once I had that information Netmon 3.2 helped. When I had tried to trace this error previously the NIC did seem where everything pointed, but you would expect to see some sort of TCP checksum error of some sort in Netmon or Wireshark if the nic was to blame. The other thing was that there was basically no other connectivity problem. In the end it was just the event id error was misleading, if it had said SPN not found or some such thing it might have given some sort of lead. Of course the error was really a client TS not finding an SPN not the server which made it a kind of double whammy misleading message.

Netman66

Agreed. The error messages in 2003 are not as descriptive as they are in 2008.