LAN Overview
 
Cabling
Domain
    Architecture
        History
    Server Hardware
    Server Roles
        Applications
        DC
        DFS
        DHCP
        DNS
        Issues
Power
Virtualisation
VOIP
Windows Event IDs
 
 

 

 

Windows Server Domain

Miscellaneous Server Event IDs

I have experienced various Windows Event Log entries that have sometimes taken a bit of effort to understand and resolve. Most of the time, a quick "Google" will point to a relevant Microsoft Knowledgebase article, at other times, there may be a number of solutions proposed. I have documented a number of Event IDs here and the fix that worked for me - your issue and resolution may be different, but hopefully, this page can provide a useful starting point.

 

Errors Warnings    
Event ID OS Version Description / Resolution Microsoft KB Ref. etc.
       
       
       
       
       
       
       
       
       
     

 

 
 
       
       
13

Windows Server

2012

Volume Shadow Copy Service information: The COM Server with CLSID {463948d2-035d-4d1d-9bfc-473fece07dab} and name HWPRV cannot be started. [0x80070005, Access is denied.

iSCSI Target Storage (VDS/VSS) Provider

12292 Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID {463948d2-035d-4d1d-9bfc-473fece07dab} [0x80070005, Access is denied
Resolution New features introduced in Windows Server 2012 related to iSCSI: iSCSI Target Server and Storage Provider. "Out of the box", the credentials for these processes are not set correctly and this pair of errors will be recorded in the Event log every 15 minutes.

The storage providers require credential configuration after being enabled. This may be achieved in a number of ways as described in the Microsoft Storage Team blog. As described in the blog, I used DCOM Config to set the credentials to local administrator.

516

Windows Server

2012

DFSN service has started performing complete refresh of metadata for namespace <namespace name>. This task can take time if the namespace has large number of folders and may delay namespace administration operations.

TechNet Thread

DFSN-Server ID 516 Flooding Event Log

Resolution This message means that namespace data is being refreshed, it is expected behavior and flagging it up as a warning is a BUG. The message should be informational only.

The message can't be individually disabled, but a custom event view can be created that suppresses this one event can be created as described in the TechNet thread

2213

Windows Server

2012

 

 

Windows Server 2008R2

The DFS Replication service stopped replication on volume D:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.
Additional Information:
Volume: D: GUID: 292776E7-516D-11E3-941F-B0C7459F06E0

Recovery Steps
1. Back up the files in all replicated folders on the volume. Failure to do so may result in data loss due to unexpected conflict resolution during the recovery of the replicated folders.
2. To resume the replication for this volume, use the WMI method ResumeReplication of the DfsrVolumeConfig class. For example, from an elevated command prompt, type the following command:

wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig where volume Guid="292776E7-516D-11E3-941F-B0C7459F06E0" call ResumeReplication
26633685
Resolution This message is caused by a "dirty" DFSR database, it happened to me when I had a UPS fault and the power to one of the DFS nodes dropped out unexpectedly. The Event Log tells you how to fix the error.
(The Guid is unique to the replication node affected.)
It is possible to enable Auto Recovery, but that runs the risk of data loss if the Conflict Resolution algorithm can't identify the most current file(s).
 
2212

Windows Server

2012

 

 

Windows Server 2008R2

After you run the ResumeReplication command, you should see :

"The DFS Replication service has detected an unexpected shutdown on volume D:. This can occur if the service terminated abnormally (due to a power loss, for example) or an error occurred on the volume. The service has automatically initiated a recovery process. The service will rebuild the database if it determines it cannot reliably recover. No user action is required.
Additional Information:
Volume: D: GUID: 292776E7-516D-11E3-941F-B0C7459F06E0"
 
2214

Windows Server

2012

 

 

Windows Server 2008R2

Depending on the size of the DFS, this can take many hours to compete! Once replications resumes, you should see :

"The DFS Replication service successfully recovered from an unexpected shutdown on volume C:.This can occur if the service terminated abnormally (due to a power loss, for example) or an error occurred on the volume. No user action is required. "
 
       
       
       
       
       
       
       
       
       
       
       
       
       

 

 

 

 

 

mailto: Webmaster

 Terms & Conditions