Just a quick question.

My DHCP server is working fine, however, I receive these Information events
in Event Viewer:

The description for Event ID (1039) in Source (DHCPServer) cannot be found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. The following
information is part of the event: 0,0.

I did a google search but couldnt come up with anything. Also, I checked
the remote PC's event logs and nothing out of the ordinary showed up there.

Just kinda curious what these events are indicating.

Any help would be appreciated.

Thanks..

Hi Chris,

Thanks for your posting here.

As I know, these events occur when the DHCP server cleans up the address
lease database. It will try to free up addresses that are beyond the lease
expiration time (e.g. 48 hours) and return them to a state where they can
be used by other computers on the network, or the same computer should it
try to login and the address hasn't been taken. The Event Viewer will then
log the 2 messages 1037 and 1038.

As for event 1039, this is the result from DHCP database cleanup. This
particular instance indicates that the database was clean, so no changes
were made.

These event should be information, not error. You can just ignore them if
the DHCP server works properly.

Have a nice day!

Regards,
Bob Qin
Product Support Services
Microsoft Corporation

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Thanks, you were right. I reference another DHCP server and found the same
events but there actually displaying: Do you know why?

The DHCP service has cleaned up the database for multicast IP addresses -- 0
leases have expired (been marked for deletion) and 0 records have been
removed from the database.






"Bob Qin [MSFT]" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hi Chris,
>
> Thanks for your posting here.
>
> As I know, these events occur when the DHCP server cleans up the address
> lease database. It will try to free up addresses that are beyond the lease
> expiration time (e.g. 48 hours) and return them to a state where they can
> be used by other computers on the network, or the same computer should it
> try to login and the address hasn't been taken. The Event Viewer will then
> log the 2 messages 1037 and 1038.
>
> As for event 1039, this is the result from DHCP database cleanup. This
> particular instance indicates that the database was clean, so no changes
> were made.
>
> These event should be information, not error. You can just ignore them if
> the DHCP server works properly.
>
> Have a nice day!
>
> Regards,
> Bob Qin
> Product Support Services
> Microsoft Corporation
>
> Get Secure! - www.microsoft.com/security
>
> ====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ====================================================
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>

Hi Chris,

Thanks for your posting here.

Do you check the event logs from remote computer or local computer? The
problem often occur when you view the event log remotely or copy and view
on another computer.

Please refer to the following document for more information.

294893 Viewing Saved FRS, DNS and Directory Service Event Logs and Events on
http://support.microsoft.com/?id=294893

Have a nice day!

Regards,
Bob Qin
Product Support Services
Microsoft Corporation

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

I am logging into the server via terminal services client and viewing the
events locally. I am not viewing them remotely.

"Bob Qin [MSFT]" <(E-Mail Removed)> wrote in message
news:M4op%(E-Mail Removed)...
> Hi Chris,
>
> Thanks for your posting here.
>
> Do you check the event logs from remote computer or local computer? The
> problem often occur when you view the event log remotely or copy and view
> on another computer.
>
> Please refer to the following document for more information.
>
> 294893 Viewing Saved FRS, DNS and Directory Service Event Logs and Events
on
> http://support.microsoft.com/?id=294893
>
> Have a nice day!
>
> Regards,
> Bob Qin
> Product Support Services
> Microsoft Corporation
>
> Get Secure! - www.microsoft.com/security
>
> ====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ====================================================
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>

Hi Chris,

Please copy the dhcpssvc.dll file from other Windows 2000 to this one and
replace it in the "%systemroot%\system32 directory.

In addition, please make sure that the registry settings are same as below.

"HkeyLocalMachine\currentcontrolset\services\eventlog\system\DHCPServer"

Value "EventMesageFile"
"Reg_Expand_Sz"
string "%systemroot%\system32\dhcpssvc.dll"

Value "ParameterMessageFile"
"Reg_Expand_Sz"
string "%systemroot%\system32\kernel32.dll"

Value "TypesSupported"
"Reg_Dword"
Hex Value = 7

Wish it helps.

Regards,
Bob Qin
Product Support Services
Microsoft Corporation

Get Secure! - www.microsoft.com/security

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[BertIt64]

See also this on Microsoft over the causes, and official repair help:
http://support.microsoft.com/kb/555593/en-us

Note also that the above registry path is bad, as it must be:
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\DHCPServer"