Event ID: 4029 Source: TlntSvr

Any ideas on how to solve this? I am getting this every few hours. I also tried disabling the Telnet service.

This is on a new Windows 2008 R2 Terminal Server.

Service Details:
Event Log Module Status: 0
The Last Record Number of the eventlog type that current event entry belongs to: 0
# of duplicate events: 1
Source: TlntSvr
Category: (0)
Event ID: 4029
User (If Applicable): N/A
Computer: server.domain.com
Event Description: The description for Event ID '-1073737795' in Source 'TlntSvr' cannot be found.  The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them.  The following information is part of the event:'The parameter is incorrect.
Who is Participating?
I would download ProcMon (Process Monitor) from the Sysinternals tool kit.

Run that, and you will be able to capture the exact activity that is triggering that error. You will identify the process that calls it, and what the exact error message is.

I use that tool *all* the time to troubleshoot error messages.

SpiderPigAuthor Commented:
Disabling the service took care of it, but then I noticed the service auto start even though I changed it to disable. Running ProcMon again...
What service was it that you disabled?
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

SpiderPigAuthor Commented:
The Telnet Service.
Yes, but what program is causing the telnet service to be launched?
Using Process explorer (ProcExp.exe) you can view the command line that is being used to launch a process.  You can also do the same thing using ProcMon.
SpiderPigAuthor Commented:
I used ProcMon but it keeps crashing and closes itself. I did not use ProcExp.exe. What a night mare this thing is. Everything seems to be working, I am thinking of just ignoring this stupid error
Well, it is these types of errors that lead you to discover that you've been hacked, or something.  It is time well spent, IMHO.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.