Event ID 1000
Eric Wojo
log every hour and 40 minutes:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 7/29/2002
Time: 6:23:44 AM
User: NT AUTHORITY\SYSTEM
Computer: TERMINAL
Description:
Windows cannot determine the user or computer name. Return
value (1326).
This is a WIN2K Terminal Server with SP2.
Anyone know what this is? All help is most appreciated.
Eric
Scott
I got the following from a news post.
Hope it helps.
Scott Scotland.
Event ID: 1000
Source Application Error
Type Error
Description Faulting application <application name>, version
<version number>, faulting module <module name>, version <version number>,
fault address <hex address>.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Comments Robert: In my case the error was generated by
mmc.exe,version,5.1.2600.0. It turns out I was missing the mscat32.dll and
minnls.dll files from the system32 folder. I replaced them from a backup.
Adrian Grigorof: If the application is iexplore.exe and you
cannot do "New window" without crushing the browser, then see Q272322 and
Q316593.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Links Q272322 , Q316593
Contributors Robert , Hman4 , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Application Error" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source CLTMGR
Type Error
Description The server was not able to initialize the Client
Management virtual driver (Error 13)
Comments Adrian Grigorof: From a newsgroup post this error:
"Citrix tends to start dying around a 700 ms latency (RDP is around 600ms),
even at this latency, it starts to become unusable. Although it is not
ideal, measure the latency using ping from his client machine to the Citrix
server. If the latency is around 1000 ms, then almost certianly the session
will die if data is streaming to the client at the time (high latency is OK,
just so long as no data is being send to and from the server at the time of
the hight latency).
Future release 1 for MF 1.8 has a "high latency" workaround
which is essentially a local echo on the client of mouse and keystrokes -
which makes most applications usable even at 700 ms latency - but it does
not prevent the session from dying completely when the latency is 1000 ms or
more. You will find that cable users will generally have 1/2 to 2/3 the
latency compared to an equivalent DSL user. Note that to make the session
stable, you only need to get the latency below 650 ms, rather than reduce it
to a really low value.
Generally, there is not much you can do to lower the latency for
the user - in these instances you need to look at the viability of shifting
them to another medium such as cable, ISDN or even modems (we have had an
office of 3 users running Citrix sessions concurrently very successfully on
a 33.6k connection in the past - yes, we were suprised it worked at all)."
Another newsgroup post: "Solution: If the group Everyone is
given Read access to the Mfc42u.dll file, the errors no longer appear during
logon."
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Contributors Adrian Grigorof , Stanko Popovic , Richard Suarez
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 CLTMGR" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Frontpage 2000
Type Warning
Description Error #e0024 Message: gettting SID's account name
failed.
Comments Adrian Grigorof: From a newsgroups post: "This is about
listing the security permissions. Remember to put the global account in the
local group and assign the rights to the local group. In other words make a
local group account on the web server and pull from the domain the global
account with users in that group, put that group in the local group you made
and give the rights to the local group then make sure in FrontPage under
groups the local group account is in there with admin author or browse.
Check also Q260159."
Another post suggests: "I found the error was being created by a
Frontpage Administrator trying to change permissions using Frontpage from a
different domain."
Jeff Alderman: Use the FPSRVADM command line to create a web and
check for a more informative error message. (than the one from the event
log).
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Links Q260159
Contributors Adrian Grigorof , Jeff Alderman
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Frontpage 2000" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source FrontPage 4.0
Type Warning
Description Microsoft FrontPage Server Extensions: <error>
Message: <error message>
Comments Adrian Grigorof: Check your meta refresh tag and make
sure the quotation marks are balanced. This problem usually occurs when a
mark is missing. It could also be a corrupted file so try to recreate it.
Adrian Grigorof: From a newsgroup post: Check that the NTFS
permissions on the inetpub\wwwroot are set correctly. FP needs certain
minimum permissions in order to work properly. A list of all the permissions
is at:
http://www.microsoft.com/technet/prodtechnol/sharepnt/proddocs/admindoc/owsk
01.asp?frame=true. Without the correct permissions FP can misbehave like
this also because it can't do what it needs to.
Adrian Grigorof: This is a VERY generic message from FrontPage.
It can occur on many conditions and the error message vary. A few of them
seem to be a consequence of lack of rights to the web folders. Few examples:
- "unexpected C++ exception: [INDEXERR] Illegal Index (675) for
collection with 1 elements" - no info
- "(OS Error #-1073741819 Message: exception occurred at
0x17ff8439)" - See Q259534
- "(OS Error #5 Message: Access is denied.)" - See Q259534
- "(OS Error #13 Message: Permission denied)" - See Q259534
- "OS Error #123 Message: The filename, directory name, or
volume label syntax is incorrect.)" - no info
- "Error reading IIS default Vroot info" - no info
- "Bad response from SMTP host'exchangeserver': 550 Relaying is
prohibited." - See Q251283
- "http://<url> - Error #20005 Message: Cannot create file
"<file name>". - no info
- "http://<url> - Error #80002 Message: System exception: access
violation." - See Q259534
- "http://<url> - VrwObj::beginWriteLock() could not get
DataBSem " - no info
- "http://<url> - Error #2000c Message: Write error on file
"<file name>". - no info
- "Received empty response from Microsoft FrontPage Server
Extensions" - See Q259534
- "http://<url> - Error #20001 Message: Cannot open file
"c:\inetpub\wwwroot\subweb1\_vti_pvt\access.cnf" for reading." - See Q259534
- "http://<url>- Error #e0024 Message: Getting SID's account
name failed."
- "http://<url> - Error #90017 Message: Source Control System
failure:
Unable to open user login file <file name>."
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Links Q264775 , Q251283 , Q259534 , Files and Permissions on
Internet Information Service
Contributors Adrian Grigorof , Jason Wells
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 FrontPage 4.0" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source FrontPage 5.0
Type Warning
Description Microsoft FrontPage Server Extensions: - Error
<error code> Message: <error message>
Comments Jason Wells:
Error: 2001d Message: Theme path doesn't exist "global" not
found. - no info
Error: 3005f Message: Unable to read configuration for
Microsoft Internet Information Server. - no info
Brian Meehan: Error: "#a0007" - Message: Error from search:
can''t open the word hash file
c:\inetpub\wwwroot\elearning\_vti_txt\default.wti\All.dct unable to open the
database"
Frontpage-generated search engines use the Index service to
perform searches. There must be a catalog in the Index Service that contains
the web content.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Contributors Jason Wells , Brian Meehan
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 FrontPage 5.0" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source FTPCtrs
Type Error
Description Unable to collect the FTP performance statistics.
The error code returned by the service is data DWORD 0. For additional
information specific to this message please visit the Microsoft Online
Support site located at: http://www.microsoft.com/contentredirect.asp.
Comments Adrian Grigorof: This event is sometimes generated when
the FTP service is stopped while using the Performance Monitor. You may
also try reinstalling the performance counters as specified in Q226512 (no
longer available at Microsoft):
How to Reinstall IIS 4.0 Performance Monitor Counters
This article provides detailed instructions for reinstalling or
removing and reinstalling the Windows NT Option Pack (NTOP) Performance
Monitor Counters.
Three files are required to install Performance Monitor Counters
for NTOP services. One file is a .ini file that contains the installation
instructions for the counters, another is a .h file that contains the
symbolic and offset information for the counters, and the third file is the
.dll file that maintains the counters statistics. These three files must
reside in the %windir%\system32 directory before they can be installed for
use with Performance Monitor.
If the main Performance Monitor data files (Perfc009.dat and
Perfh009.dat) have become corrupted, you can use Q127207.
The following list provides a list of all NTOP Performance
Monitor Objects, their corresponding .ini, .h, and .dll files, their
registry key name, and the .cab file on the NTOP compact disc where the
files are located:
Format: (Object name,.ini file name,.h file name,.dll file
name,Services registry key name,.cab file name)
Radius
Server,Authperf.ini,Authperf.h,Authperf.dll,AuthSrv,Rasics.cab
PBServer
Monitor,Regsym.ini,Regsym.h,Pbsmon.dll,PBServerMonitor,Rasics.cab
MSMQ Exchange
Connector,Counters.ini,Counters.h,Gwperf.dll,MSEXGW,Msmqocm.cab
MSMQ Service,Mqperf.ini,Perfsym.h,Mqperf.dll,MSMQ,Msmqocm.cab
Content
Index,Perfci.ini,Ciperfm.h,Qperf.dll,ContentIndex,Is20.cab
Content Index
Filter,Perffilt.ini,Filtperf.h,Qperf.dll,ContentFilter,Is20.cab
HTTP Content
Index,Perfwci.ini,Perfwci.h,Qperf.dll,ISAPISearch,Is20.cab
NNTP Server,Nntpctrs.ini,Nntpctrs.h,Nntpctrs.dll,NNTPSVC,Ins.cab
SMTP Server,Smtpctrs.ini,Smtpctrs.h,Smtpctrs.dll,SMTPSVC,Ims.cab
Active Server
Pages,Axperf.ini,Axctrnm.h,Aspperf.dll,ASP,Iis4_03.cab
FTP
Service,Ftpctrs.ini,Ftpctrs.h,Ftpctrs2.dll,MSFTPSVC,Iis4_03.cab
Internet Information Services
Global,Infoctrs.ini,Infoctrs.h,Infoctrs.dll,Inetinfo,Iis4_01.cab
Web Service,W3ctrs.ini,W3ctrs.h,W3ctrs.dll,W3SVC,Iis4_01.cab
Use the following instructions to install or reinstall
Performance Monitor Counters for the NTOP services:
To install an object's counters, the object's .ini, .h, and .dll
files must reside in the %windir%\system32 directory. Using the above table
determine which .ini, .h, and .dll files you need for the object you want to
install. Determine if the .ini, .h, and .dll files are in the
%windir%\system32 directory. If they are not, you can use the latest version
of WinZip to extract the files to the %windir%\system32 directory from the
appropriate .cab file on the NTOP compact disc.
Open a Command Prompt and change directory to %windir%\system32.
Type the following:
lodctr <.ini file name for object to install>
If you receive the following message:
Counters for <object name> are already installed Unable to
update the system registry
type the following:
unlodctr <services registry key name> and re-type:
lodctr <.ini file name for object to install>
Repeat Steps 1 through 3 for each object that you want to
install Performance Monitor Counters for.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Links Q201638 , Q127207
Contributors Adrian Grigorof , Anonymous
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 FTPCtrs" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source LoadPerf
Type Information
Description Performance counters for the <service name> service
were loaded successfully. The Record Data contains the new index values
assigned to this service.
Comments Adrian Grigorof: Self-explanatory.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Contributors Tyler , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 LoadPerf" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Microsoft Internet Explorer
Type Error
Description The description for Event ID ( 1000 ) in Source (
Microsoft Internet Explorer ) could not be found. It contains the following
insertion string(s): iexplore.exe,6.0.2600.0,wininet.dll,6.0.2600.0,00015105
Comments James T. Thomas: This seems to coincide with an
explorer.exe generated errors message which forces windows explorer to
close. It also seems to be associated with the application of sp2 to
Internet Explorer 5.5 or the installation of Internet Explorer 6.
R. Spike: This event varies in the reporting text - it does not
always reflect the exact same error message. There are several variations to
the Event 1000, Internet Explorer Error Messages. I began getting these
errors not long after I downloaded Zone Alarm. I am running Win2k Pro. (no
service packs installed on this machine, but I had the same problem with
Win2K SP1 on another machine.
When I get these error messages, they usually follow a Dr.
Watson notification and that also only happened after I began getting True
Vector Engine (EVENT 1) Error Messages. There is a known issue with Zone
Alarm and Win 2K SP1, and the fix for that is to adjust the Internet
Security Settings to "Medium" vs. "High". I applied the "fix" and have
stopped receiving the True Vector Engine Error Messages, so I guess I will
have to wait and see what happens with Internet Explorer, although I haven't
received any event id 1000 error messages since then. I hope this helps.
Dave: I find that this error constantly appears when I attempt
to use Outlook Web Access to reach my exchange server. The Outlook Web
access page begins to load, seems to be ready to display my mailbox, and
then blows up. I have had this error occur many times on many different
machiens running I.E. 6.0 with various levels of patches ranging from none
to the most current. I have also seen this with I.E. 5.5 SP2. My exchange
server otherwise behaves flawlessly. By the way, if I use OWA to hit other
exchange servers than mine I have also gotten this error which leads me to
believe I have an I.E. problem, not and exchange problem.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Contributors Dwright , James T. Thomas , R. Spike , Dave
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Microsoft Internet Explorer"
at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Microsoft Office 10
Type Error
Description Faulting application outlook.exe, version
10.0.2627.1, faulting module msmapi32.dll, version 10.0.2625.0, fault
address 0x0001e85d.
Comments Adrian Grigorof: From a Usenet post: "Run the update
from the Microsoft Office XP site
(http://office.microsoft.com/Downloads/default.aspx). I had frequent crashes
in Outlook 2002, went to the update site and found crucial updates posted
there for Outlook and for Word. Since I downloaded those updates I haven't
had a crash in those programs."
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Contributors Robert McKee , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Microsoft Office 10" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source MSExchangeSA
Type Information
Description Microsoft Exchange System Attendant is starting.
Microsoft Exchange Server System Attendant, service startup complete,
version 6.0 (build 4417.0). For more information, click
http://www.microsoft.com/contentredirect.asp.
Comments Adrian Grigorof: Self-explanatory, service startup.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Contributors Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 MSExchangeSA" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source MsiInstaller
Type Error
Description Product: Microsoft Office 2000 Premium -- Error
<error code> < error description>
Comments Jeremy Ano: Error code 1706 = "No valid source could be
found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue." - This error usually happens after switching profiles on a
2000 pro machine. To fix the problem download and install Mdac.
Adrian: Error code 1321 = The Installer has insufficient
privileges to modify this file: - Permissions to the C:\Winnt\Installer
folder are insufficient for MSI to create\modify files. See Q217714.
Rummie Herssein: Error code 1706 = "No valid source could be
found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue." - This occurs when windows attempts to locate a file (such
as the first time you start up office after installation, or if you
accidentally click "Reconfigure mail support" in MS outlook, tools,
options....) to complete configuration of an application. Windows attempts
to find the file that it needs in the exactly location that the application
was installed from. therefore this file IN that location must be available.
If you installed from a CD, insert the disk, and point the MSI installer
there. if you installed over a network, you will have to reconnect to that
network share.
Aram Iskenderian: Error: 1931 - See Q279177.
Links Q217714 , Q279177
Contributors Adrian Grigorof , Adrian , Jeremy Ano , Rummie
Herssein , Aram Iskenderian
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 MsiInstaller" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source MsiInstaller
Type Error
Description Failed to connect to server. Error: <error code>
Comments Adrian Grigorof:
Error code 0x80070003 = "The system cannot find the path
specified."
Error code 0x80004001 = "The method is not implemented. This
value might be returned if a driver does not support a feature necessary for
the operation."
Error code 0x80070005 = "General access denied error."
Contributors Anonymous , Tony Russo
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 MsiInstaller" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source MsiInstaller
Type Information
Description Product: WebFldrs -- Installation operation
completed successfully.
Comments Adrian Grigorof: Indicates a successful installation of
a software using the Microsoft Installer.
Contributors Martin Holmes
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 MsiInstaller" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source NTDS General
Type Information
Description Microsoft Directory startup complete, Version
5.00.2195.3719
Comments Joseph 'Radar' Mann: This is a normal event as a Domain
Controller starts up should also see message 1394.
Contributors Joseph 'Radar' Mann
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 NTDS General" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source PerfDisk
Type Error
Description Unable to open the Disk performance object. Status
code returned is data DWORD 0.
Comments Chris Park: This usually means that performance
counters have been enabled, but not configured. If you don't plan to use
performance counters, don't run the service "Performance Counters and
Alerts".
Contributors Rrzwirner , Chris Park
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 PerfDisk" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Save Dump
Type Error
Description The computer has rebooted from a bugcheck. The
bugcheck was: <bugcheck code> (0x0000005c, 0x00000002, 0x00000000,
0xef9997ce). Microsoft Windows NT [v15.1381]. A full dump was not saved.
See explanations for various bugchecks codes below:
Comments Adrian Grigorof: 0x0000000a = IRQL NOT LESS OR EQUAL -
This Stop message, also known as Stop 0xA, indicates that a kernel-mode
process attempted to access a portion of memory at an Interrupt Request
Level (IRQL) that was too high. A kernel-mode process can only access other
processes that have an IRQL lesser than or equal to its own. See the link
below for more details.
0x0000001e = KMODE_EXCEPTION_NOT_HANDLED - This Stop message,
also known as Stop 0x1E, indicates that a kernel-mode process tried to
execute an illegal or unknown processor instruction. This error handler is a
default error handler that catches errors not associated with other specific
error handlers. See the link below for more details.
0x00000022 = FILE_SYSTEM - Explanation: This is a Windows 2000
Executive character-mode STOP message. This indicates a generic file system
problem. User Action: If this is the first time you have booted after
installing new hardware, remove the hardware and boot again. Check the
Microsoft Hardware Compatibility List to verify that the hardware and its
drivers are compatible with Windows 2000. For information about the
hardware, contact the supplier. If you are installing Windows 2000 for the
first time, check the Windows 2000 system requirements, including the amount
of RAM and disk space required to load the operating system. Also, check the
Hardware Compatibility List to verify that the system can run Windows 2000.
If Windows 2000 is loaded and no new hardware has been installed, reboot
with recovery options set to create a dump file. If the message continues to
appear, select the Last Known Good option when you reboot. If there is no
Last Known Good configuration, try using the Emergency Repair Disk. If you
do not have an Emergency Repair Disk, contact your technical support group.
0x00000024 = NTFS_FILE_SYSTEM - This Stop message, also known as
Stop 0x24, indicates that a problem occurred within Ntfs.sys (the driver
file that allows the system to read and write to NTFS drives).
0x00000044 = MULTIPLE_IRP_COMPLETE_REQUESTS - This is a Windows
2000 Executive character-mode STOP message. It indicates an attempt was made
to complete an IRP (I/O request packet) more than once, possibly by more
than one driver. If this is the first time you have booted after installing
new hardware, remove the hardware and boot again. Check the Microsoft
Hardware Compatibility List to verify that the hardware and its drivers are
compatible with Windows 2000. For information about the hardware, contact
the supplier. If you are installing Windows 2000 for the first time, check
the Windows 2000 system requirements, including the amount of RAM and disk
space required to load the operating system. Also, check the Hardware
Compatibility List to verify that the system can run Windows 2000. If
Windows 2000 is loaded and no new hardware has been installed, reboot with
recovery options set to create a dump file. If the message continues to
appear, select the Last Known Good option when you reboot. If there is no
Last Known Good configuration, try using the Emergency Repair Disk. If you
do not have an Emergency Repair Disk, contact your technical support group.
See also Q186345,Q296734,Q294876,Q187518,Q196022,Q258813,Q260830
0x0000004D = NO_PAGES_AVAILABLE - Indicates there are no
physical pages available. Restart and set the Recovery options in the System
Control Panel or the /CRASHDEBUG system start option.
0x00000050 = PAGE_FAULT_IN_NONPAGED_AREA - Occurs on many
circumstances and it usually indicates a fault drivers. There are quite a
few number of Q articles on Microsoft's site. Do a search on "0x00000050".
0x000000de = POOL_CORRUPTION_IN_FILE_AREA - This signifies that
a driver corrupted pool memory used for holding pages destined for disk.
When the Memory Manager dereferenced the file, it discovered the corruption
in pool memory.
0x0000007b = INACCESSIBLE_BOOT_DEVICE - Indicates a problem with
the boot disk.
0x0000007f = UNEXPECTED_KERNEL_MODE - Appears when a driver
tries to execute an illegal processor instruction.
0xc0000005 = STATUS_ACCESS_VIOLATION - A memory access violation
occurred. (Parameter 4 of the bug check is the address, which the driver
attempted to access.) Typically generated by faulty drivers.
0xc000021a = STATUS_SYSTEM_PROCESS_TERMINATED - This error
occurs when a user-mode subsystem, such as WinLogon or the Client Server
Runtime Subsystem (CSRSS), has been fatally compromised and security can no
longer be guaranteed. In response, the operating system switches to kernel
mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore,
this is one of the few cases where the failure of a user-mode service can
shut down the system. Mismatched system files can also cause this error.
This can occur if you have restored your hard disk from a backup. Some
backup programs might skip restoring system files that they determine are in
use. Search Microsoft's site for 0xc000021a as there are a large number of Q
article related to this stop code.
0xdeaddead = When there is not enough free disk space to write a
dump file, Savedump.exe does not write the following entry to the event log.
See Q235999 for more details. Fixed with SP6.
For a complete list of exception codes, see the ntstatus.h file
located in the inc directory of the Windows DDK.
Links Q235999 , Q192463 , Q314084 , Inside the Blue Screen,
Crash Dump Analysis, Stop 0x0000000A or IRQL_NOT_LESS_OR_EQUAL, Stop
0x0000001E or KMODE_EXCEPTION_NOT_HANDLED, Stop 0x00000024 or
NTFS_FILE_SYSTEM, Q186345 , Q296734 , Q294876 , Q187518 , Q196022 , Q258813
, Q260830 , Bug Check 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
Contributors Adrian Grigorof , Loan Vo , Anonymous , Rick Phil
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Save Dump" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Information
Description Windows could not save the registry settings in your
user profile on its first try because another program or service was editing
them. Windows tried again and saved them after 3 attempts.
Comments Adrian Grigorof: From a newsgroup post: "I just found
this at Norton's website:
Description: Windows could not save the registry settings in
your user profile on its first try because another program or service was
editing them. Windows tried again and saved them after 9 attempts. NOTE: The
number of attempts may vary.
This issue is being investigated. Please check back with us
periodically for an update.
Workaround: Keeping the server console logged-in or locked at
all times prevents this error from happening. NOTE: This issue does not
occur if an account is logged into the server console."
Links , User Profile Does Not Roam
Contributors Dgmuonio , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot obtain the domain controller name for
your computer network. Return value (<error code>).
Comments Adrian Grigorof:
- 59 = "An unexpected network error occurred." - This may
indicate a problem with the physical network (cables, fault NICs or hubs.
- 2146 = "The specified component could not be found in the
configuration information."
From a newsgroup post: "Do the following to ensure that the SRV
records for the AD servers are in DNS properly (from the DOS prompt):
nslookup
set type=srv
_ldap._tcp.dc._msdcs.YOURDOMAIN.COM
You should see something like this:
_ldap._tcp.dc._msdcs.YOURDOMAIN.COM SRV service location:
priority = 0
weight = 100
port = 389
svr hostname = server1.YOURDOMAIN.COM
_ldap._tcp.dc._msdcs.YOURDOMAIN.COM SRV service location:
priority = 0
weight = 100
port = 389
svr hostname = server2.YOURDOMAIN.COM
server1.YOURDOMAIN.COM internet address = 1.1.1.2
server2.YOURDOMAIN.COM nternet address = 1.1.1.1
If you don''t then you definately have a DNS problem. I would
also recommend running the dcdiag and netdiag utilities on your domain
controllers. If you find that the servers aren''t in DNS, then make sure
dynamic updates are enabled on your DNS server and restart the netlogon
server on each of your DCs.
Contributors Jo-Ann Bookalam , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot log you on because the profile cannot
be loaded. Contact your network administrator. DETAIL - Access is denied.
Comments Michael Glaubig: Symptoms: The user can successfully
log on to a Windows 2000 Server, domain controller or member server, but
cannot load profile information unless the user is of the administrators
group on that machine. This was accompanied by an error (1F) given when
logging on via a Citrix ICA connection, again only if the user was not an
administrator.Windows 2000 Workstations were uneffected by this.
A timed message box would appear when logging on the console of
a Windows 2000 Server with the same error message as in the event log.
Clicking "OK" would return the user to the Ctrl-Alt-Del screen.
Problem: This was an error with the Group Policy Objects being
applied through Active Directory in that Default Group Policy was somehow
linked to two different Group Policies. The fix Microsoft gave me:
"Unlinking, NOT DELETING, the Default Group Policy (see the link below),
refreshing policy information and logging all users off and then back on
fixed the problem. This did not effect any newly created policies, just the
Default Group Policy made when installing Active Directory."
Gennady Nesanelis: Cause: Permissions for EVERYONE on the share
on PDC, that points to the location of roaming profiles, have been removed.
More Info: Error 1000 and User Profiles (Q185198).
Links Q185198 , Unlinking a Group Policy
Contributors Michael Glaubig , Gennady Nesanelis , Gennady
Nesanelis
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot update your roaming profile. Contact
your network administrator. DETAIL - Access is denied
Comments Anonymous: This event can occur in various
circumstances. See the links below for more information.
Juuso Haapala: You get ''access denied'' everytime a file with
read-only attribute is trying to be copied to
\\%server%\profiles\%profilename%. Q273473 states this only can take place
if the roaming profiles are stored in a netware server. However, this also
can take place in Windows 2000 server if userenv.dll is outdated. Solution:
check userenv.dll file:
Date Time Size File name
---------------------------------------
10/10/2000 13:57 366,352 Userenv.dll
... and reapply service pack 2.
Adrian Grigorof: See the "User profile does not roam" link for
troubleshooting this issue.
Links Q257838 , Q257848 , Q273473 , User Profile Does Not Roam
Contributors Anonymous , Juuso Haapala , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot copy your profile because it contains
encrypted files or directories. The keys to decrypt the files or directories
are also stored in the profile and are not available now. Please decrypt the
files and try again.
Comments No info available. If you have additional information
about this event please submit it to us!
Contributors Anonymous
Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot load extension <file name> with
(error number).
Comments No info available. If you have additional information
about this event please submit it to us!
Contributors Stanko Popovic
Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot load the user's profile but has
logged you on with the default profile for the system.
DETAIL - <error description>
Comments Adrian Grigorof: Error: "Not enough storage is
available to process this command." - From a newsgroup post: "It seems like
you have a roaming profile that resides on a server. It cannot be copied to
your machine for some reason. Permissions? Disk full? Have you exceeded your
space quota? All of these would generate your error message.". Please note
that "storage" does not necessarely mean hard disk space. It could mean
registry size limitations and other software-based settings."
Error: "The system has attempted to load or restore a file into
the registry but the specified file is not in a registry file format." - no
info
Links , User Profile Does Not Roam
Contributors Clifford Levitan , Adrian Grigorof , Anonymous
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot access the registry information at
\\mydomain.com\sysvol\mydomain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\Machine\registry.pol with (<error code>).
Comments Adrian Grigorof: As first step, use NET HELPMSG <error
code> for a first clue as what it wrong.
Adrian Grigorof: Error code 5 - "Access denied" - See Q290647.
Also, from a newsgroup post: "I have been plagued by the same message on my
system for months. Most of the postings I saw claimed that this was due to
my system being multi-homed and the order of the priority of the NICs being
incorrect. In my case, the suggested remedies did not work. Today I checked
and found out the the node "C:\WINNT\sysvol\sysvol" was not shared. After I
shared that node to system and Administrator, the error messages stopped."
Adrian Grigorof: 51 - "The remote computer is not available." -
"The \\Active Directory Domain Name\Sysvol share is a special share that
requires the distributed file system (Dfs) client to make a connection. If
the Dfs client is disabled, the error messages are generated. ". See the
link to Q259398
Adrian Grigorof: 53 - "The network path was not found." - Caused
by File and Printer Sharing service not being enabled on the Domain
Controller interface(s). See the link to Q279742.
Jürgen Reithmayr: Error: 1351 - "Configuration information could
not be read from the domain controller, either because the machine is
unavailable, or access has been denied."
Links Q279742 , Q259398 , Q290647 , Q285923
Contributors Adrian Grigorof , Jürgen Reithmayr
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Warning
Description Windows cannot copy file <path to source file> to
location <path to destination file>. Contact your network administrator.
DETAIL - <detail description>
Comments Adrian Grigorof: Detail: "The process cannot access the
file because it is being used by another process.": From a newsgroup
posting: "In order to get rid of these messages I had to stop the Norton
AntiVirus Services.".
Juuso Haapala: Detail: "Access is Denied" - You get "access
denied" everytime a file with read-only attribute is trying to be copied to
\\%server%\profiles\%profilename%.
Links Q273473 , User Profile Does Not Roam
Contributors Anonymous , Adrian Grigorof , Juuso Haapala
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot query for the list of Group Policy
objects. A message that describes the reason for this was previously logged
by this policy engine.
Comments Adrian Grigorof: "As the message says, this event
should be preceeded by another one that usually provides more info on why
the Group Policy objects could not be queried. A typical example of such
event is: Userenv Event:1000 Windows cannot establish a connection to with
(1787) Error code 1787 means: "The security database on the server does not
have a computer account for this workstation trust relationship."
Michael Glaubig: "This error was caused by group policy not
being appropriately applied. I received this error on workstations in
conjunction with not being able to logon locally to Win2k Server for use
with Citrix (Terminal Services). After a lengthly phone call to Microsoft,
it was determined that this was because the Default Group Policy was somehow
linked to two separate policies on disk. Unlinking, NOT DELETING, the
Default Group Policy and refreshing all policy information should fix the
problem. From that point, new polices should have no trouble being created
or applied."
Links How to unlink a Windows 2000 Group Policy
Contributors Dean Michael Dorman , Adrian Grigorof , Michael
Glaubig
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot establish a connection to <domain
name> with (<error code>).
Comments Adrian Grigorof: Error code: 0 = "The operation
completed successfully." - no additional info
Error code: 1787 (decimal) = The security database on the server
does not have a computer account for this workstation trust relationship.
Error code: 10053 = "An established connection was aborted by
the software in your host machine." - no additional info
Error code: 0x2747 (10055 decimal) = An operation on a socket
could not be performed because the system lacked sufficient buffer space or
because a queue was full. See Q196271 for details.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Links Q196271 , Active Directory Diagnostics, Troubleshooting,
and Recovery
Contributors Adrian Grigorof , Camelia Dogaru , Dean Michael
Dorman
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Your profile was not successfully loaded, but you
have been logged on with the default system profile. Please correct the
problem and log off. (5)
Comments Anonymous: There are several conditions when this event
can occur. See the links below for information about event 1000 and user
profiles.
Links Q185198 , Q289158 , User Profile Does Not Roam
Contributors Anonymous , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows can not create profile directory \\<path to
profile> You will be logged on with a local profile only. Changes to this
profile will not be propagated to the server. Contact your network
administrator. Detail: The system can not find the file specified.
Comments Adrian Grigorof: See the link to Q174520 for various
scenarios when this event can occur.
Links Q174520 , User Profile Does Not Roam
Contributors Adrian Grigorof , Stanko Popovic
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot find the local profile and is logging
you on with a temporary profile. Changes you make to this profile will be
lost when you log off.
Comments Stanko Popovic: This message can occur on various
situations. See the link below.
Links Q289158 , Q248368 , User Profile Does Not Roam
Contributors Stanko Popovic , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot determine the user or computer name.
Return value (<return error code>).
Comments Adrian Grigorof: This event occurs in various
conditions, the return code providing more details about the problem. Use
NET HELPMSG to obtain a description of the code.
Adrian Grigorof: Value 59 - "An unexpected network error
occurred." - Typically, connectivity problems (cable, hub, switch, etc..
layer 2 level)
Adrian Grigorof: Value 1317 - "The specified user does not
exist." - no additional info
Abel: Value: 59 - "An unexpected network error occurred." - This
may happen if you have a firewall between your domain controller (or
installed on the DC itself) and a workstation that is trying to connect to
it. I noticed this while using Norton Internet Security 2002 on a domain
controller and after that the network became very slow and the eventviewer
filled with these events.
Adrian Grigorof: Value 1722 - "The RPC Server is unavailable" -
Usually occurs when DNS servers are not configured properly. There is
connectivity but not at the service level. See the Q260371 link below for
troubleshooting such issues. One note here, usually it may appear that DNS
is set properly but one has to double-check all the aspects of DNS
registration/resolution as the problem may not be that obvious.
Adrian Grigorof: Value 1908 - "Could not find the domain
controller for this domain. No additional info."
David T. Perry: See Q221833 on how to Enable User Environment
Debug Logging in Retail Builds of Windows.
Ed Nitch: In my case - Windows 2000 Pro Workstation - the user
complained that all Internet access and Internet email through MS Exchange
was lost and IE 5.5 reported a DNS Error. The workstation's TCP/IP settings
were correctly obtained via DHCP. Release/renew and manually setting DNS did
not help. I removed the TCP/IP stack, reboot, login locally, reinstall
TCP/IP stack, reboot, login to the network - problem gone.
Anonymous: Value 1326 - "Logon failure: unknown user name or bad
password." - I had this error filling up my event viewers on two servers for
days. I had scheduled backups under my user name and password. After I
changed my password I started getting the errors. I fixed it by rescheduling
the jobs under my user name and new password; problem resolved.
Adrian Grigorof: Value 1753 - "There are no more endpoints
available from the endpoint mapper." - no additional info.
Johnnie Letarte: Value 1747 - "The authentication service is
unknown." - Occurs when the server is set up as a domain controller but not
synchronizing with the Main DC
Adrian Grigorof: Value 14 - "Not enough storage is available to
complete this operation." - As per Microsoft: "Do one of the following, then
retry the operation:
(1) reduce the number of running programs;
(2) remove unwanted files from the disk the paging file is on
and restart the system;
(3) check the paging file disk for an I/O error;
(4) install additional memory in your system."
Links Q261007 , Q260371 , Q221833
Contributors Adrian Grigorof , Anonymous , Bettina Frauzem , Ed
Nitch , Ronen.S , Brian Koch , Alex Nunez , David T. Perry , Abel , Johnnie
Letarte
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description Windows cannot unload your registry file. If you
have a roaming profile, your settings are not replicated. Contact your
administrator. DETAIL - Access is denied. , Build number ((2195)).
Comments Adrian Grigorof: As per Microsoft: "This problem can
occur if a handle to a registry key is not closed correctly." Several users
have reported this problem as occuring after the installation of various
software packages.
Kevin Galea: Change the start type of the service Windows
Management Instrumentation to manual and then stop the service, in this way
the file winmgmt.exe is not used by the system anymore, unless you manually
start it. After that, delete any extra profiles that the computer had
created and also make a few changes to "My Desktop" to test wheather these
changes would be uploaded. Log off and then on again. The error message in
the event viewer should disapear.
Anonymous: "I, and others, are working with MS on this one [..]
Have you disabled/stopped any default services? Is your "Documents and
Settings" folder in the canonical place. I can reproduce the problem right
after a restart by simply starting/stopping the NetMeeting client (CONF.EXE,
no connection necessary) and then logging off. I have read about others
reproducing it by using Netscape, Office2000, etc... The problem is with two
registry files, UsrClass.dat and UsrClass.dat.log (buried in one's profile
dir) ... which the system process always has open and which (here at least)
never contain any data. They can't be "unloaded" at logoff, and remain open
even after another user logs on (hence the two "leaked" handles reported in
%SystemRoot%\Debug\UserMode\userenv.log (there you see that the minute delay
at logoff is caused by the system trying once per second for a minute to
unload those files)."
JPElectron: I have tracked this down to after I installed Norton
Anti-Virus 7.5 Corp. Ed. and noticed the yellow on-demand scan monitor
shield thing has a yellow exclamation mark over it when logged onto a server
via terminal services. I belive the duplicate instance of on-demand scan
monitor in the terminal service session is the application causing the
registry hive not to unload correctly.
Kevin Chapman: When logging off server using Terminal Services
with NAV CE enabled, system would wait 60 secondds to unload user profile
and then create a Event ID 1000 in the application log. According to MS,
this is caused by a registry leak. Symantec has released a fix, v7.6.934.
Anonymous: This event may also occur in the application log if
you are running terminal services on Windows 2000 Server/Advanced Server. A
fix for this is availible thru microsoft support and shall only be applied
to systems experiencing this particular problem, see Q289564. The next
service pack (SP3) will solve this problem for this specific case.
Matt Decker: There are 3 options:
1. There is a hotfix available from MS that will be publicly
available in SP3.
2. The "Documents and Settings" DACL gets hosed. You can try
this pre or post hotfix, but you have to set the Everyone group to Full
Controll over Documents and Settings. Log out, then log back in. Then you
can set it back to the default permissions (everyone = r&a, R, l,
system=full, powerusers, r&a, r, l, local users, r&a, r, l, etc). Also, if
you cannot change permissions on Documents and Settings, turn off
inheritance.
3.The most effective variable - disable and stop your virus
protection. Works like a charm. I'm about to find out if reinstalling it and
starting it back up still works.
Derek: There is a fix available from Microsoft. Please see
Q285192 for more information.
Paul: There are two Microsoft hotfixes, Q281267 and Q285192,
however they did not fix the problem in my case.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Links Q253820 , Q185198 , Q269858 , Q289564 , Q285192 , Q281267
, Q285192 , Q255113 , User Profile Does Not Roam
Contributors Adrian Grigorof , Kevin Galea , JPElectron , Kevin
Chapman , Derek , Matt Decker , Paul
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userenv
Type Error
Description The Group Policy client-side extension <extension
name> was passed flags (<number flags>) and returned a failure status code
of (<status code>).
Comments Jason Williams: Extension: Scripts, Flags: 16, Status
code 2: net helpmsg 2 = The system cannot find the file specified. Happens
every time a client refreshes policy. Caused by the scripts.ini file
missing/malfunctioning in the folder:
sysvol\domainname\policies\{policy_id}\USER\scripts. Put in a blank
scripts.ini or rebuild from backup.
Adrian Grigorof: Extension: Security, Flags 17, Status code 3:
net helpmsg 3 = The system cannot find the path specified. A program was
installed, which creates user accounts and assigns rights to those user
accounts. Later, the program was removed,the user accounts deleted, but the
rights from policy before the accounts were still there. A user account is
added and rights assigned to the account. The account is deleted, but not
from security policies. Following the suggestions in Q247482 helps. Make
sure you check the domain, domain controllers and local group policies. If
"error 1332" is found in Winlogon.log check Q285903 (link below). Use the
tools described in "Troubleshooting Group Policy in Windows 2000" article
from Technet to see what policies are applied and verify each of them. This
may also occur due to a lack of time synchronization - see also Q285923
Adrian Grigorof: Extension: Security, Flags 17, Status code: 5:
net helpmsg 5 = "Access is denied." - This issue occurs because of the
locked-down security that was originally set on the FRS through Group
Policy. When you attempt to configure the FRS through Group Policy, the
policy engine no longer has the permission to set security on the FRS and
does not attempt to take ownership of the FRS. See Q284461
Adrian Grigorof: Extension: Security, Flags 17, Status code: 13:
net helpmsg 13 = "The data is invalid." - Means that some of the references
in the Group Policies are invalid or pointing to shares that do not exist.
Potentially, there are many circumstances when the Group Poliy files may get
corrupted. See Q256000.
Adrian Grigorof: Extension: Security, Flags 17, Status code
1208:net helpmsg 1208 = "An extended error has occurred." - A conflict in
Group Policy can cause these events to occur. These error messages can occur
if the "Rename Administrator Account" security policy is enabled and then
set to an account name that is already in use. See Q260715, Q278316.
Adrian Grigorof: Extension: Folder Redirection, Flags 0, Status
code 1307:net helpmsg 1307 = "This security ID may not be assigned as the
owner of this object." - no additional information.
Adrian Grigorof: Extension: Security, Flags 17, Status code
1332:net helpmsg 1332 = "No mapping between account names and security IDs
was done." - See Q281454.
Tatiana Mosoi: Extension: Application Management, Flags 1,
Status code: 1612: net helpmsg 1612 = "The installation source for this
product is not available. Verify that the source exists and that you can
access it." - See Q278472.
Adrian Grigorof: Extension: Security, Flags 17, Status code
1788:net helpmsg 1788 = "The trust relationship between the primary domain
and the trusted domain failed." - This issue can occur if the link from the
Default Domain Controllers policy to the Domain Controllers organizational
unit has been broken. See Q279432.
Hernan924: Had this error for awhile. Finally figured out my
permissions within SYSVOL (the share)\Policies were hosed and users could
not access the policy. I reset these NTFS Security permissions so that
Everyone could at least READ, and lo and behold it worked. However, you
should not have to mess with permissions in these folders unless you are
having THIS SPECIFIC PROBLEM.
Jason Leverett: Extension: Scripts, Flags: 16, Status code 2:
"The system cannot find the file specified" Happens every time a client
refreshes policy. Caused by the scripts.ini file missing/malfunctioning in
the folder: sysvol\domainname\policies\{policy_id}\USER\scripts. Put in a
blank scripts.ini or rebuild from backup.
Our Approach This information is only available to subscribers.
An example of "approach" is available here.
Links Q247482 , Q285903 , Q271213 , Q279742 , Q256000 , Q260715
, Q278316 , Q279432 , Q281454 , Q284461 , Troubleshooting Group Policy in
Windows 2000, Q278472 , Q285923
Contributors Adrian Grigorof , Yuri Sytema , Tatiana Mosoi ,
Jason Leverett , Hernan924 , Ronen.S
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userenv" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source Userinit
Type Error
Description Windows could not execute <file name> due to the
following error: The system cannot find the file specified.
Comments Adrian Grigorof: "cannot find the file specified" could
mean:
- the file does not exist
- the share specified for the file path does not exist anymore
- the account used to access the file does not have sufficient
rights"
Contributors Adrian Grigorof , Anonymous
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 Userinit" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Source W3Ctrs
Type Error
Description Unable to open the Performance sub key of the HTTP
(W3) Service. The error code returned by the registry is data DWORD 0.
Comments Adrian Grigorof: See event ID 1000 from FTPCtrs for
some suggestions.
Links Event ID 1000 - FTPCtrs
Contributors Camelia Dogaru , Adrian Grigorof
Send comments - Help me now! - Notify me when updated!
Automatic search for "Event 1000 W3Ctrs" at:
Support @ Microsoft - Search @ Microsoft - Google
ewsgroups -
Automatic search for "Event ID 1000" through:
Support @ Microsoft - Search @ Microsoft - Google Newsgroups