Windows Server 2016 – Memory Leak Event ID 11 Error

August 28, 2018

Encountering Event ID 11 Memory Leak in MMC ?

image

This can be safely ignore according to Microsoft

See here for more details

image

Enjoy!

Advertisements

Windows Server 2016 – VSSAdmin Event ID 7001 Error

August 27, 2018

Event ID 7001 relating to VSSAdmin unable to create Shadow Copy

image

Solution :

Go to task manager and check the job configurations GUID.

If you find the similar compared to the Event Viewer details. You can delete them.

Reason :

This might happen after convert a Physical machine to a VM.

Success !


Windows Server 2016 – Sync Host OneSyncSvc Service PARAMETER is incorrect

August 10, 2018

Let’s say you want to disable the Sync Host Service on our server…

You will get this Error :The Parameter is Incorrect

And it will not let you disable it Sad smile

image

SOLUTION :

First open servives.msc and look for 1 or more Sync Host_xxxx Services in the list. And stop all the services.

image

Next open Regedit  and go to :

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\OneSyncSvc

There might be multiple in the list…

image

Change the Start value from 2 to 4 (Disabled)

Open the services again an refresh F5.

image

The status has changed to Disabled Smile

image

Enjoy !


Windows Server 2016 – LSA (LsaSrv) Event ID 6038

August 10, 2018

What does this Warning event ID 6038 mean when you see this on a Doman Controller ?

image

image

It means as it says you have clients connecting using the WEAKER NTLM authentication method…

By default, Windows server does not report where NTLM requests are coming from, so auditing needs to be enabled.

If you want the address this issue read this guys post on how to …

https://nathanlevandowski.wordpress.com/2017/05/28/event-id-6038-auditing-ntlm-usage/


Windows Server 2016 – CertificateServicesClient-AutoEnrollment Event ID 64

August 9, 2018

I got some warnings regarding Event ID 64 CertificateServicesClient-AutoEnrollment

image

image

SOLUTION :

Open PowerShell and use command

cd CERT:\\ 

ls

Get-ChildItem -Path "xxxxxxxxx" -Recurse

image

If PowerShell can’t find it use the GUI

Open mmc and add the Certificates snap-in.

And search for the HASH Key in all stores.

image

Certificate seems to be expired.

image

image

Since this certificate relates to Azure AD Connect, which was uninstalled on this server, I can delete it…

Enjoy !


Windows Server 2016 – "Disk # has been surprise removed", Event ID 157 / 12289 / 5014

August 9, 2018

Been getting Event ID 157 Disk # has been surprise removed on a brand new Windows 2016 AD DC …

This server runs as a VM, so how can it give disk issues ?

image

I also saw this Event ID 12289 VSS appearing …

image

When I looked a little closer I notice both had the same time more or less…

Then I remembered that this was the time a VM Ware Snapshot was taken…

So these events make sense, and can be disregarded.

Same for the Event ID 5014 DFSR

image

Detail message says, Pauzed for Backup or Restore

clip_image001

Indeed that is the time a Backup is taken…

All false alarm…

Smile


Windows Server 2016 – Performance data for this service will not be available Event ID 1008

July 10, 2018

How to solve the Event ID 1008.

image

SOLUTION :

Run these commands using Admin Privileges :

image

C:\Windows\system32\lodctr.exe /R

C:\Windows\SysWOW64\lodctr.exe /R

C:\Windows\System32\wbem\winmgmt.exe /RESYNCPERF

C:\Windows\SysWOW64\wbem\winmgmt.exe /RESYNCPERF

After running these commands you might get the Event ID 2003

image

To solve this run this command using Admin Privileges :

lodctr /T:TermService

See here for more options :

https://partnersupport.microsoft.com/en-us/par_servplat/forum/par_winserv/top-issue-error-1008-from-perflib-open-procedure/2104e9f9-62c3-40e1-9bfe-a04027149f04

https://www.admin-enclave.com/en/articles/windows/306-resolved-the-open-procedure-for-service-bits-in-dll-c-windows-system32-bitsperf-dll-failed-performance-data-for-this-service-will-not-be-available-the-first-four-bytes-dword-of-the-data-section-contains-the-error-code.html

Enjoy !