Event ID 105: source W3SVC, SMTPSVC, LDAPSVCX, MSFTPSVC

[Wally Sanford]

An MVP on the microsoft.public.win2000.dns newsgroup sent me here, because
this appears to be IIS related.

I'm getting Event ID 105 from four sources. The sources are W3SVC, SMTPSVC,
LDAPSVCX, and MSFTPSVC. The text from event viewer says:

"The server was unable to register the administration tool discovery
information. The administration tool may not be able to see this server. The
data is the error code. "

I am running Windows 2000 Advanced Server with all patches, running IIS 5
behind a router with ports 80 and 53 forwarded. NetBIOS over TCP is enabled.

I do not have a NIC with no cable as per
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q254/5/25.ASP&NoWebContent=1.

http://www.eventid.net/display.asp?eventid=105&source=w3svc echoes the
above.

I do not have the key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsmon described at
http://www.iisfaq.com/?View=A335&P=154 .

http://www.eventid.net/display.asp?eventid=105&source= is not helpful
because I have need of SMB, which is precluded by disabling "Client for
Microsoft Networks".

The error does not reoccur after boot. I wonder if it happens because the
network on this (not very fast) computer is not started, or at least cable
modem access is not available, when W3SVC, SMTPSVC, LDAPSVCX, and MSFTPSVC
are trying to load, initialize, or whatever they do at boot. Everything
seems to be working, but the message annoys me.

Any ideas about what this is or how to stop it?

Thanks in advance.

--
Wally Sanford
Web: www.wallysanford.com
Email: PleaseSubstitut...@wallysanford.com

[Wally Sanford]

An MVP at microsoft.public.windows.server.general sent me here, because
this seems to be IIS related.

[Paul Lynch]

Wally,

Try this KB article :

Event Log Error: Event ID 105 from Service W3SVC or FTPSVC
http://support.microsoft.com/?id=240779

Regards,

Paul Lynch
MCSE

[Wally Sanford]

Thanks for replying, Paul, but I believe that refers to NT4, and this
computer runs Windows 2000.

--
Wally Sanford
Web: www.wallysanford.com
Email: PleaseSubstitut...@wallysanford.com

"Paul Lynch" <paul....@nospam.com> wrote in message
news:eq0nlvo7jf7p2bqsd...@4ax.com...

[Jonathan Maltz [MS-MVP]]

Still worth a try, no? (Yes, I do these groups as well)

--
--Jonathan Maltz [Microsoft MVP - Windows Server]
http://www.imbored.biz - A Windows Server 2003 visual, step-by-step
tutorial site :-)
Only reply by newsgroup. If I see an email I didn't ask for, it will be
deleted without reading.

"Wally Sanford" <PleaseSubstituteMyActualFirstName&LastNa...@hotmail.com>
wrote in message
news:1FL6b.8256$_26....@newsread2.news.atl.earthlink.net...

[Bernard]

Do you have any special software in the box ?
say firewall, kazaa and etc ?

what's the data in error code ?

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...

"Wally Sanford" <PleaseSubstituteMyActualFirstName&LastNa...@hotmail.com>
wrote in message
news:1FL6b.8256$_26....@newsread2.news.atl.earthlink.net...

[Wally Sanford]

Jonathan,

I was keying off the fact that there is no "Network" icon in Windows
2000 Control Panel, and no way to remove NetBIOS that was readily
apparent to me. Do you mean just removing NetBEUI from the TCP/IP
configuration, or performing "net stop something", or something else?
I guess I am not seeing how to remove NetBIOS...

Do the sort of issues described at
http://archives.neohapsis.com/archives/ntbugtraq/2000-q2/0071.html
seem problematic to you?

"Jonathan Maltz [MS-MVP]" <jma...@mvps.org> wrote in message news:<#ev7pPad...@TK2MSFTNGP11.phx.gbl>...

[Wally Sanford]

Paul and Jonathan: In the server's NIC properties I uninstalled "File and
Print Sharing" and "NetBEUI", and TCP/IP Properties>Advanced>WINS disabled
"NetBIOS over TCP/IP"; rebooted, got the subject errors plus one for RIS,
which I repaired using risetup.

I assume that uninstalling "File and Print Sharing", it being a service,
rather than NetBEUI, it being a protocol, is how you "Remove, and then
reinstall the NetBIOS Interface network service" in Windows 2000 but my
Googling is unclear on that. I did both and disabled "NetBIOS over TCP/IP"
just to be somewhat sure.

Reinstalled "File and Print Sharing" and "NetBEUI", and re-enabled NetBIOS
over TCP/IP. Rebooted, and got only the original subject events 105 in

W3SVC, SMTPSVC, LDAPSCVX, and MSFTPSVC. In each event the Description says:

"The server was unable to register the administration tool discovery
information. The administration tool may not be able to see this server. The

data is the error code. For additional information specific to this message
please visit the Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp. "

Bernard: there is nothing special like firewall, Kaaza, and so forth
installed on the box (mostly just Office 2000, DreamWeaver MX,
Acrobat/RealPlayer/QuickTime, and such typical suspects, but also McAfee
Netshield 4.5, patched and updated, which has been implicated with some
anomalies). My Linksys BEFW11S4 v2 four-port wireless router acts a
firewall of sorts. It also is acting as a DHCP server.I have TCP and UDP
traffic on ports 80 and 53 forwarded to the server IP. I had UDP on ports 67
and 68 forwarded, but they are not now. The Linksys is in "gateway" working
mode rather than "router", with dynamic routing disabled for RX and TX (I
sure hope I'm not disclosing too much on a public forum...).

Thanks for your input.

--
Wally Sanford
Web: http://www.wallysanford.com
Email: PleaseSubstitut...@wallysanford.com

"Jonathan Maltz [MS-MVP]" <jma...@mvps.org> wrote in message

news:%23ev7pPa...@TK2MSFTNGP11.phx.gbl...

[Jonathan Maltz [MS-MVP]]

Try unchecking everything in the NIC's properties (except TCP IP)...

Can you access any IIS resources?

--
--Jonathan Maltz [Microsoft MVP - Windows Server]
http://www.imbored.biz - A Windows Server 2003 visual, step-by-step
tutorial site :-)
Only reply by newsgroup. If I see an email I didn't ask for, it will be
deleted without reading.

"Wally Sanford" <PleaseSubstituteMyActualFirstName&LastNa...@hotmail.com>
wrote in message

news:Gi77b.10309$_26....@newsread2.news.atl.earthlink.net...

[Wally Sanford]

>> Replies inline.

"Bernard" <qber...@hotmail.com> wrote in message news:<O1#DWeedD...@TK2MSFTNGP09.phx.gbl>...

> Do you have any special software in the box ?
> say firewall, kazaa and etc ?

No, but see earlier message about router.

> what's the data in error code ?

>> c6 04 00 00 Æ...

[Bernard]

c6 04 00 00 - translate to 1222
and using 'net helpmsg 1222' you get
'the network is not present or not started'

so this is definitely something to do with services
IP and port binding. in the pass, I'd see firewall,
and kazaa are some posible reason why you get
this error beside general network card, network cable
and etc. issue.

Now is IIS running fine ? only sometime you get this
105 errors ? is your network cable always connected ?
what other software you have in the box, you might want to disable
one by one to see if solve this.

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...

"Wally Sanford" <wa...@wallysanford.com> wrote in message
news:9415ae90.03090...@posting.google.com...

[Wally Sanford]

I unchecked everything in the NIC properties except TCP/IP, and can access
the web pages from the server or another computer in the network, and by
Citrixing to a computer in another domain.

--
Wally Sanford
Web: www.wallysanford.com
Email: PleaseSubstitut...@wallysanford.com

"Jonathan Maltz [MS-MVP]" <jma...@mvps.org> wrote in message
news:%23eb3Mzl...@TK2MSFTNGP10.phx.gbl...

[Wally Sanford]

>> Replies inline

 

"Bernard" <qber...@hotmail.com> wrote in message news:e52SCiod...@TK2MSFTNGP10.phx.gbl...

> c6 04 00 00 - translate to 1222
> and using 'net helpmsg 1222' you get
> 'the network is not present or not started'

 

>>  I see. That seems more ominous that the original event. Yet I can browse other computers in the workgroup (I have joined no ther computers to the domain yet), can access external web sites, so the network would "seem" to this newbie to be started...

 

> so this is definitely something to do with services
> IP and port binding. in the pass, I'd see firewall,
> and kazaa are some posible reason why you get
> this error beside general network card, network cable
> and etc. issue.
>
> Now is IIS running fine ? only sometime you get this
> 105 errors ? is your network cable always connected ?
> what other software you have in the box, you might want to disable
> one by one to see if solve this.

 

>> I disabled NetShield and realschd.exe. The only other programs or services that do not seem to be from MS are Easy CD Creator, which apparently cannot be disabled safely, and the DDNS client. Reboot, same errors. I am wondering if this error, which occurs only at boot, is a result of dependencies, and whether the error results from various services/programs/whatever attempting to start before some aspect of the network is up. That would explain why the network actually seems to be started, and there seem to be no other anomalies or events, other than a few broken counters, which I'll fix with unlodctr/lodctr shortly, and a warning event 257 "Alert Manager Event Log Alert: Alert Manager Service: Active Dir Republish Not Successful ", which occurs eary in the boot process, and I think may be related to the somewhat slow speed of this computer. It may be that my Quest To Have No Errors At All may be unrealistic.

[Jonathan Maltz [MS-MVP]]

So it's not like IIS doesn't work...Hm...

--
--Jonathan Maltz [Microsoft MVP - Windows Server]
http://www.imbored.biz - A Windows Server 2003 visual, step-by-step
tutorial site :-)
Only reply by newsgroup. If I see an email I didn't ask for, it will be
deleted without reading.

"Wally Sanford" <Wa...@wallysanford.com> wrote in message
news:iQg7b.164$TC1...@newsread2.news.atl.earthlink.net...

[Bernard]

Mm.. if do a 'net stop iisadmin /y'
and then 'iisreset /start' does it trigger the evt id 105 again ?
or it only logged at boot time ?

some other crazy things you might try is reload entire IIS
or NIC driver and etc.

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...

"Wally Sanford" <Wa...@wallysanford.com> wrote in message

news:vGj7b.1143$c35...@newsread1.news.atl.earthlink.net...

[Tim Coffey]

If you don't have a NIC, you need to install the MS Loopback adapter from the add/remove hardware wizard, and ensure tcp/ip and the
ms client for microsoft networks are all installed. However, if you are behind a router, with no NIC, how are you connected to your
router?

Thank you. I hope this information is helpful.

Tim Coffey [MSFT]

This posting is provided “AS IS” with no warranties, and confers no rights. You assume all risk for your use. © 2001 Microsoft
Corporation. All rights reserved.
--------------------
| Reply-To: "Wally Sanford" <PleaseSubstituteMyActualFirstName&LastNa...@hotmail.com>
| From: "Wally Sanford" <PleaseSubstituteMyActualFirstName&LastNa...@hotmail.com>
| Newsgroups: microsoft.public.inetserver.iis
| Subject: Event ID 105: source W3SVC, SMTPSVC, LDAPSVCX, MSFTPSVC
| Lines: 44
| Organization: Sanford Consulting (http://www.wallysanford.com)
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
| Message-ID: <67L6b.8234$_26....@newsread2.news.atl.earthlink.net>
| Date: Sun, 07 Sep 2003 18:51:46 GMT
| NNTP-Posting-Host: 24.136.141.61
| X-Complaints-To: ab...@earthlink.net
| X-Trace: newsread2.news.atl.earthlink.net 1062960706 24.136.141.61 (Sun, 07 Sep 2003 14:51:46 EDT)
| NNTP-Posting-Date: Sun, 07 Sep 2003 14:51:46 EDT
| Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!news-out.cwix.com!newsfeed.cwix.com!newsfeed.icl.net!newsfeed.fjserv.net!
newsfeed.news2me.com!elnk-nf2-pas!newsfeed.earthlink.net!stamper.news.pas.earthlink.net!stamper.news.atl.earthlink.net!
newsread2.news.atl.earthlink.net.POSTED!not-for-mail
| Xref: cpmsftngxa06.phx.gbl microsoft.public.inetserver.iis:274331
| X-Tomcat-NG: microsoft.public.inetserver.iis

[Wally Sanford]

The restart triggered three events: W3SVC, LDAPSVCX, and SMTPSVC.

Your mention of reloading IIS and the NIC reminded me: the NIC that was in
this server when installed (a Linksys something or other) blew out the other
night, and I replaced it with a Compaq Nettelligent 10/100T (TLan chip)
which I had on hand. Is there anything special you have to do after
installing a new NIC with IIS?

I'm going to hold off just a little longer on the IIS reinstall: I'll hose
something else that will require a full reinstall before this over...

"Bernard" <qber...@hotmail.com> wrote in message

news:eME4m70d...@TK2MSFTNGP09.phx.gbl...

[Wally Sanford]

I removed and reinstalled IIS, and rebuilt some counters (which got rid of a few warnings), but I still get the same errors, plus one, I believe:

 

1) EventID 105 Source W3SVC "The server was unable to register the administration tool discovery information. The administration tool may not be able to see this server. The data is the error code. ", data= 0000: c6 04 00 00

 

2) EventID 105 Source SMTPSVC "The server was unable to register the administration tool discovery information. The administration tool may not be able to see this server. The data is the error code. ", data=0000: c6 04 00 00

 

3) EventID 105 Source NNTPSVC "The server was unable to register the administration tool discovery information. The administration tool may not be able to see this server. The data is the error code. ", data=0000: c6 04 00 00

 

4) EventID 105 Source LDAPSVCX "The server was unable to register the administration tool discovery information. The administration tool may not be able to see this server. The data is the error code. ", data=0000: c6 04 00 00

 

5) EventID 105 Source MSFTPSVC "The server was unable to register the administration tool discovery information. The administration tool may not be able to see this server. The data is the error code. ", data=0000: c6 04 00 00

 

 

 

"Bernard" <qber...@hotmail.com> wrote in message news:eME4m70d...@TK2MSFTNGP09.phx.gbl...

[Wally Sanford]

I just found something interesting: In Control Panel>System>Hardware>Device
Manager>Network Adapters there is an entry for the original NIC, an AMD
PCNET Home Based Adapter, which was removed last week and is disabled. I try
to remove it, and it won't remove (!). I wonder:

1) Why is this entry here?,
2) Is it the phantom card "without a cable", and
3) How do I get rid of it?

I imagine it's in the registry, I'm going to look while I await comments.

[Wally Sanford]

To remove the several phantom devices, I had to run this batch file"

set devmgr_show_nonpresent_devices=1
cd\ %SystemRoot%\System32
start devmgmt.msc

Then open Device Manager and "show hidden devices". Removed them (had
several old cards in there), rebooted, same error messages.

This is getting weird.

--
Wally Sanford
web: http://wallysanford.com
email: PleaseSubstitut...@wallysanford.com

[Bernard]

Mm.. probably why you getting the 105 error.
If you don't mind. remove all and install the correct
NIC driver. then reload IIS again :(

Now one other thing which looks weird is teh LDAPSVCX.
iisadmin don't really related to this in plain fresh installed box.
I'm not sure why you get this. is this box a DC ? or any ldap installed ?

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...

"Wally Sanford" <PleaseSubstituteMy...@wallysanford.com>
wrote in message news:6cQ7b.71$%G3...@newsread2.news.atl.earthlink.net...

[Wally Sanford]

Bernard,

It is a Domain Controller. Is that significant?

Will be tomorrow before I can reload IIS, etc.

Thanks.

"Bernard" <qber...@hotmail.com> wrote in message

news:eDjsMsCe...@tk2msftngp13.phx.gbl...

[Bernard]

Err. nope. just that normally we don't
mix DC and IIS together.

Good luck.. if same result, I'm afraid you need
to ring up PSS already :(

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...

"Wally Sanford" <PleaseSubstituteMy...@wallysanford.com>
wrote in message news:SK58b.149$u07...@newsread1.news.atl.earthlink.net...

[Jonathan Maltz [MS-MVP]]

Shouldn't be

I'm on a DC with IIS right now

--
--Jonathan Maltz [Microsoft MVP - Windows Server]
http://www.imbored.biz - A Windows Server 2003 visual, step-by-step
tutorial site :-)
Only reply by newsgroup. If I see an email I didn't ask for, it will be
deleted without reading.

"Wally Sanford" <PleaseSubstituteMy...@wallysanford.com>
wrote in message news:SK58b.149$u07...@newsread1.news.atl.earthlink.net...

[Wally Sanford]

I know I've got too much going on with this machine (DC, WINS, DNS, IIS: at
least I moved DHCP to the Linksys <g>), but it's a lab setup with only two
clients, and it's serving about two pages, which the masses are not
stampeding to see... But yes, I need more and newer computers, as I always
do. I'll probably set up another server in the guest bedroom to take some
load off.

*However*, ladies and gentlemen, I am pleased to announce that removing all
NICs, removing IIS, and reinstalling in that order eliminated the pesky
error messages. A clean Event Viewer is a thing of beauty. I believe the
Lessons Learned are:

1) Believe Mark Minasi when he says (p. 416 Windows 2000 Server 3rd Edition)
that "Multihomed PC's shouldn't be PDC's" (at least during installation).
2) Look for phantom devices if you have physically removed anything after
IIS installation.
3) This is an extraordinarily helpful group.

Many thanks.

--
Wally Sanford
web: http://wallysanford.com (at least it was working a minute ago)
email: PleaseSubstitut...@wallysanford.com

"Bernard" <qber...@hotmail.com> wrote in message

news:eFxwvwNe...@TK2MSFTNGP10.phx.gbl...

[Bernard]

Ding !!! glad to know that it solved your problems.
I would say it is those 'unknown' interfaces that causing the errors.

Got you mail as well :) I'm not from MS, they don't want me :(
get a girl friend ? already got a wife :) but I don't mind have that.

Cheers!

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...

"Wally Sanford" <PleaseSubstituteMy...@wallysanford.com>
wrote in message news:Gfc8b.758$u07...@newsread1.news.atl.earthlink.net...