DCDIAG error AD 2012 - Starting test: SystemLog warning event occurred. EventID: 0x00001795

I am getting when I run DCDIAG /e on my AD 2012 DC the following :-

Starting test: SystemLog
  warning event occurred.  EventID: 0x00001795
Event String:

            The program svchost.exe, with the assigned process ID 952, could not authenticate locally by using the target name HOST/.. The target name used is not valid. A target name should refer to one of the local computer names, for example, the DNS host name.
 ......................... AMI01-DC-01 passed test SystemLog

I have searched for a fix finding (see below), to which I have applied but still am getting the message when I run DCDIAG/e . Any ideas on how to remove, after I have created the DWORD in the registry and re-booted the DC ? Or is it not an issue to worry about ?

Event 6037, lsasrv
https://social.technet.microsoft.com/forums/systemcenter/en-US/05cedf19-cd02-4c26-9651-4b5d5f46d58b/event-6037-lsasrv

This settings should fix it:

HKLM\system\CurrentControlSet\Services\Lanmanserver\parameters

DisableStrictNameChecking:DWORD=1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

DisableLoopbackCheck:DWORD=1
ccfcfcAsked:
Who is Participating?
 
Andy MInternal Systems ManagerCommented:
Historical events won't auto remove and DCDIAG can still pick up on these. AS you've noted the events are still occurring it would suggest that the issue has not being resolved. Looking into the error itself this can be caused by a number of different things so the fix you found may not be relevant to your system.

I would start by having a look to find out what process ID number 952 relates to - this may help narrow down where the issue lies and allow further investigation.
0
 
Andy MInternal Systems ManagerCommented:
If you've fixed the issue then it's likely dcdiag is still seeing the historic warning in the event logs and bringing it up because of that. If you look in the event log for the corresponding error check when the most recent occurrence is - if it was before you applied the fix then this is fine, if it's after then the problem has not being resolved.

If I come across these issues where the issue is resolved (and no further events have been logged) I backup the event logs and clear them, then dcdiag should be fine.
0
 
ccfcfcAuthor Commented:
I still am getting the entries in event log and when I run DCDIAG /e it reports that even though I ran the registry change as per link  below.... as this was the common view on the fix for the entry. SO I was expecting the messages to be removed but they are still there. Link and changed made :-
https://social.technet.microsoft.com/forums/systemcenter/en-US/05cedf19-cd02-4c26-9651-4b5d5f46d58b/event-6037-lsasrv

Resulting registry change ....
HKLM\system\CurrentControlSet\Services\Lanmanserver\parameters

DisableStrictNameChecking:DWORD=1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

DisableLoopbackCheck:DWORD=1
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.