[Webinar] Streamline your web hosting managementRegister Today

x
?
Solved

event id 2019

Posted on 2010-04-09
8
Medium Priority
?
615 Views
Last Modified: 2012-05-09
Im gettin this event id 2019 every 5seconds from time to time on my PDC. And havin event id 1083 and 1955 on directory service.

Reading another posts here I downloaded the err.exe and got this:
===========================================================
C:\Documents and Settings\sysadm\My Documents\Err>err c0002a5
# as an HRESULT: Severity: SUCCESS (0), Facility: 0xc00, Code 0x2a5
# for hex 0x2a5 / decimal 677 :
  SE_AUDITID_TGS_TICKET_FAILURE                                 msaudite.h
# Service Ticket Request Failed:%n
# %tUser Name:%t%1%n
# %tUser Domain:%t%2%n
# %tService Name:%t%3%n
# %tTicket Options:%t%4%n
# %tFailure Code:%t%5%n
# %tClient Address:%t%6%n
  ERROR_VOICE_ANSWER                                            raserror.h
# 2 matches found for "c0002a5"
===========================================================

Anyone know how to solve this?
0
Comment
Question by:cce-puc-rio
8 Comments
 
LVL 11

Expert Comment

by:Venugopal N
ID: 30228221
0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 30228336
You are going to have to try and track down what is eating up that non paged pool memory.  It could be something in windows, a driver, an application.  This first blog entry by the debug team goes into great detail and I can't add much to what they have written.

http://blogs.msdn.com/ntdebugging/archive/2006/12/18/Understanding-Pool-Consumption-and-Event-ID_3A00_--2020-or-2019.aspx



http://support.microsoft.com/kb/177415

Thanks

Mike
0
 

Author Comment

by:cce-puc-rio
ID: 30229891
Sorry, Im analyzin the event viewer on PDC these days and wrote the wrong event ID on the topic.

The event id that´s happening every 5seconds sometimes is 12294(SAM).

In last few weeks I got the the 2019 (SRV) error too, but it has happened a few days only, the 12294 happens everyday. Are those related?


0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
LVL 57

Expert Comment

by:Mike Kline
ID: 30231253
They could be related looks like that 12294 is also caused by a resource error

http://support.microsoft.com/kb/887433

There they are advising for checking for malware, so do that; but maybe that 2019 is what is causing the resources to be drained.

Thanks
Mike
0
 
LVL 4

Expert Comment

by:evilsi
ID: 30414063
Hi,
Do you have any symantec products installed on this server? Both Backup exec and symantec antivirus can cuase this if they havent been updated yet the Microsoft updates have been applied.
If so, check the minidump (if blue screens have been occouring) and you may find its the storeport.sys driver that causes it. to fix, manually update all symantec products.
0
 

Author Comment

by:cce-puc-rio
ID: 30508352
Nope, I just have Veritas Backup Exec but its on a different server.

This is the 12294 message:
"The SAM database was unable to lockout the account of sysadm due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above."

It gives this error like 4 times on a second from time to time. On sunday theres no one working here and the error still happens. I think its some service tryin to use the domain admin account. The password has been changed 3 months ago.

Is there a way to monitor the event to know wich service is trying to use the account?
0
 

Author Comment

by:cce-puc-rio
ID: 30508480
mkline71:
After using "dfsutil /PurgeMupCache" the event id 2019 didnt happen(so far). I guess the SAM error is not related... ?
0
 

Accepted Solution

by:
cce-puc-rio earned 0 total points
ID: 32780594
Moderator please close the topic. We had an issue where the ORF antispam was tryin to use the domain admin account with old credentials. Took a while to figure it out(why windows cannot recognize the service is tryin to use the account? *sigh*)
0

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

640 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question