DCDIAG error AD 2012 - Starting test: SystemLog warning event occurred. EventID: 0x00001795

I am getting when I run DCDIAG /e on my AD 2012 DC the following :-

Starting test: SystemLog
  warning event occurred.  EventID: 0x00001795
Event String:

            The program svchost.exe, with the assigned process ID 952, could not authenticate locally by using the target name HOST/.. The target name used is not valid. A target name should refer to one of the local computer names, for example, the DNS host name.
 ......................... AMI01-DC-01 passed test SystemLog

I have searched for a fix finding (see below), to which I have applied but still am getting the message when I run DCDIAG/e . Any ideas on how to remove, after I have created the DWORD in the registry and re-booted the DC ? Or is it not an issue to worry about ?

Event 6037, lsasrv
https://social.technet.microsoft.com/forums/systemcenter/en-US/05cedf19-cd02-4c26-9651-4b5d5f46d58b/event-6037-lsasrv

This settings should fix it:

HKLM\system\CurrentControlSet\Services\Lanmanserver\parameters

DisableStrictNameChecking:DWORD=1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

DisableLoopbackCheck:DWORD=1
ccfcfcAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andy MIT Systems ManagerCommented:
If you've fixed the issue then it's likely dcdiag is still seeing the historic warning in the event logs and bringing it up because of that. If you look in the event log for the corresponding error check when the most recent occurrence is - if it was before you applied the fix then this is fine, if it's after then the problem has not being resolved.

If I come across these issues where the issue is resolved (and no further events have been logged) I backup the event logs and clear them, then dcdiag should be fine.
0
ccfcfcAuthor Commented:
I still am getting the entries in event log and when I run DCDIAG /e it reports that even though I ran the registry change as per link  below.... as this was the common view on the fix for the entry. SO I was expecting the messages to be removed but they are still there. Link and changed made :-
https://social.technet.microsoft.com/forums/systemcenter/en-US/05cedf19-cd02-4c26-9651-4b5d5f46d58b/event-6037-lsasrv

Resulting registry change ....
HKLM\system\CurrentControlSet\Services\Lanmanserver\parameters

DisableStrictNameChecking:DWORD=1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

DisableLoopbackCheck:DWORD=1
0
Andy MIT Systems ManagerCommented:
Historical events won't auto remove and DCDIAG can still pick up on these. AS you've noted the events are still occurring it would suggest that the issue has not being resolved. Looking into the error itself this can be caused by a number of different things so the fix you found may not be relevant to your system.

I would start by having a look to find out what process ID number 952 relates to - this may help narrow down where the issue lies and allow further investigation.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.