Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


Event ID: 4029 Source: TlntSvr

Posted on 2011-10-29
Medium Priority
Last Modified: 2012-05-12
Any ideas on how to solve this? I am getting this every few hours. I also tried disabling the Telnet service.

This is on a new Windows 2008 R2 Terminal Server.

Service Details:
Event Log Module Status: 0
The Last Record Number of the eventlog type that current event entry belongs to: 0
# of duplicate events: 1
Source: TlntSvr
Category: (0)
Event ID: 4029
User (If Applicable): N/A
Computer: server.domain.com
Event Description: The description for Event ID '-1073737795' in Source 'TlntSvr' cannot be found.  The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them.  The following information is part of the event:'The parameter is incorrect.
Question by:SpiderPig
  • 4
  • 3
LVL 15

Accepted Solution

jrhelgeson earned 2000 total points
ID: 37051445
I would download ProcMon (Process Monitor) from the Sysinternals tool kit.

Run that, and you will be able to capture the exact activity that is triggering that error. You will identify the process that calls it, and what the exact error message is.

I use that tool *all* the time to troubleshoot error messages.


Author Comment

ID: 37070951
Disabling the service took care of it, but then I noticed the service auto start even though I changed it to disable. Running ProcMon again...
LVL 15

Expert Comment

ID: 37073738
What service was it that you disabled?
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 37084535
The Telnet Service.
LVL 15

Expert Comment

ID: 37084704
Yes, but what program is causing the telnet service to be launched?
Using Process explorer (ProcExp.exe) you can view the command line that is being used to launch a process.  You can also do the same thing using ProcMon.

Author Comment

ID: 37085118
I used ProcMon but it keeps crashing and closes itself. I did not use ProcExp.exe. What a night mare this thing is. Everything seems to be working, I am thinking of just ignoring this stupid error
LVL 15

Expert Comment

ID: 37086177
Well, it is these types of errors that lead you to discover that you've been hacked, or something.  It is time well spent, IMHO.

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question