OK, THIS IS FROM TEH APPLOG: Starting with Shutdown.
Event Type: Information
lsass (604) The database engine stopped.
Event Type: Information
lsass (604) The database engine 5.02.3790.0000 started.
Event Type: Information
Event Source: MSDTC
Event Category: TM
Event ID: 4097
Date: 12/20/2004
Time: 8:49:00 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
MS DTC started with the following settings:
Security Configuration (OFF = 0 and ON = 1):
Network Administration of Transactions = 0,
Network Clients = 0,
Distributed Transactions using Native MSDTC Protocol = 0,
Transaction Internet Protocol (TIP) = 0,
XA Transactions = 0
Event Type: Information
Event Source: ESENT
Event Category: General
Event ID: 100
Date: 12/20/2004
Time: 8:49:01 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
ntfrs (1916) The database engine 5.02.3790.0000 started.
Event Type: Information
Event Source: McLogEvent
Event Category: None
Event ID: 5000
Date: 12/20/2004
Time: 8:49:02 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
VirusScan Enterprise McShield service started - scanning for 110544 viruses.
Engine version : 4.3.20
.DAT version : 4415
EXTRA.DAT name : None
Number of virus signatures in EXTRA.DAT : None
Names of viruses that EXTRA.DAT can detect : None
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1097
Date: 12/20/2004
Time: 8:49:05 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
Windows cannot find the machine account, The Local Security Authority cannot
be contacted .
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 12/20/2004
Time: 8:49:05 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
Windows cannot query for the list of Group Policy objects. Check the event
log for possible messages previously logged by the policy engine that
describes the reason for this.
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 12/20/2004
Time: 8:58:59 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
Windows saved user TTS-I\Administrator registry while an application or
service was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it is
no longer in use.
This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.
THE NEXT IS FROM dIRECTORY SERVICE:
Event Type: Information
Event Source: NTDS ISAM
Event Category: General
Event ID: 103
Date: 12/20/2004
Time: 8:46:45 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
NTDS (604) NTDSA: The database engine stopped the instance (0).
Event Type: Information
Event Source: NTDS ISAM
Event Category: General
Event ID: 102
Date: 12/20/2004
Time: 8:48:49 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
NTDS (604) NTDSA: The database engine started a new instance (0).
Event Type: Information
Event Source: NTDS General
Event Category: Service Control
Event ID: 1000
Date: 12/20/2004
Time: 8:49:00 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: TRINIUM-SERVER
Description:
Microsoft Active Directory startup complete, version 5.2.3790.0
Event Type: Information
Event Source: NTDS General
Event Category: Service Control
Event ID: 1394
Date: 12/20/2004
Time: 8:49:34 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: TRINIUM-SERVER
Description:
Attempts to update the Active Directory database are succeeding. The Net
Logon service has restarted.
Event Type: Information
Event Source: NTDS ISAM
Event Category: Online Defragmentation
Event ID: 700
Date: 12/20/2004
Time: 9:04:05 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
NTDS (604) NTDSA: Online defragmentation is beginning a full pass on
database 'C:\WINDOWS\NTDS\ntds.dit'.
Event Type: Information
Event Source: NTDS ISAM
Event Category: Online Defragmentation
Event ID: 701
Date: 12/20/2004
Time: 9:04:08 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
NTDS (604) NTDSA: Online defragmentation has completed a full pass on
database 'C:\WINDOWS\NTDS\ntds.dit'.
FROM FILE REPLICATION:
Event Type: Information
Event Source: NtFrs
Event Category: None
Event ID: 13501
Date: 12/20/2004
Time: 8:49:01 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The File Replication Service is starting.
Event Type: Information
Event Source: NtFrs
Event Category: None
Event ID: 13516
Date: 12/20/2004
Time: 8:49:02 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The File Replication Service is no longer preventing the computer
TRINIUM-SERVER from becoming a domain controller. The system volume has been
successfully initialized and the Netlogon service has been notified that the
system volume is now ready to be shared as SYSVOL.
Type "net share" to check for the SYSVOL share.
Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 12/20/2004
Time: 8:50:46 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The File Replication Service is having trouble enabling replication from
MAILSVR to TRINIUM-SERVER for c:\windows\sysvol\domain using the DNS name
mailsvr.TTS-I.local. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name mailsvr.TTS-I.local from
this computer.
[2] FRS is not running on mailsvr.TTS-I.local.
[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers.
This event log message will appear once per connection, After the problem
is fixed you will see another event log message indicating that the
connection has been established.
Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13509
Date: 12/20/2004
Time: 8:52:36 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The File Replication Service has enabled replication from MAILSVR to
TRINIUM-SERVER for c:\windows\sysvol\domain after repeated retries.
AND NOW FOR THE SYSTEM LOG:
Event Type: Information
Event Source: USER32
Event Category: None
Event ID: 1074
Date: 12/20/2004
Time: 8:46:38 AM
User: TTS-I\johnl
Computer: TRINIUM-SERVER
Description:
The process winlogon.exe has initiated the restart of computer
TRINIUM-SERVER on behalf of user TTS-I\johnl for the following reason: No
title for this reason could be found
Reason Code: 0x80070015
Shutdown Type: restart
Comment:
Data:
0000: 15 00 07 80 ...€
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 8:46:39 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The Network Associates McShield service entered the stopped state.
Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6006
Date: 12/20/2004
Time: 8:46:59 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The Event log service was stopped.
Data:
0000: 31 00 2e 00 31 00 00 00 1...1...
0008: 30 00 00 00 4d 00 69 00 0...M.i.
0010: 63 00 72 00 6f 00 73 00 c.r.o.s.
0018: 6f 00 66 00 74 00 20 00 o.f.t. .
0020: 57 00 69 00 6e 00 64 00 W.i.n.d.
0028: 6f 00 77 00 73 00 20 00 o.w.s. .
0030: 53 00 65 00 72 00 76 00 S.e.r.v.
0038: 65 00 72 00 20 00 32 00 e.r. .2.
0040: 30 00 30 00 33 00 00 00 0.0.3...
0048: 35 00 2e 00 32 00 2e 00 5...2...
0050: 33 00 37 00 39 00 30 00 3.7.9.0.
0058: 20 00 42 00 75 00 69 00 .B.u.i.
0060: 6c 00 64 00 20 00 33 00 l.d. .3.
0068: 37 00 39 00 30 00 20 00 7.9.0. .
0070: 20 00 00 00 4d 00 75 00 ...M.u.
0078: 6c 00 74 00 69 00 70 00 l.t.i.p.
0080: 72 00 6f 00 63 00 65 00 r.o.c.e.
0088: 73 00 73 00 6f 00 72 00 s.s.o.r.
0090: 20 00 46 00 72 00 65 00 .F.r.e.
0098: 65 00 00 00 33 00 37 00 e...3.7.
00a0: 39 00 30 00 2e 00 73 00 9.0...s.
00a8: 72 00 76 00 30 00 33 00 r.v.0.3.
00b0: 5f 00 67 00 64 00 72 00 _.g.d.r.
00b8: 2e 00 30 00 34 00 30 00 ..0.4.0.
00c0: 34 00 31 00 30 00 2d 00 4.1.0.-.
00c8: 31 00 32 00 33 00 34 00 1.2.3.4.
00d0: 00 00 34 00 31 00 39 00 ..4.1.9.
00d8: 66 00 33 00 64 00 65 00 f.3.d.e.
00e0: 63 00 00 00 44 00 65 00 c...D.e.
00e8: 6c 00 6c 00 20 00 43 00 l.l. .C.
00f0: 6f 00 6d 00 70 00 75 00 o.m.p.u.
00f8: 74 00 65 00 72 00 20 00 t.e.r. .
0100: 43 00 6f 00 72 00 70 00 C.o.r.p.
0108: 6f 00 72 00 61 00 74 00 o.r.a.t.
0110: 69 00 6f 00 6e 00 00 00 i.o.n...
0118: 50 00 6f 00 77 00 65 00 P.o.w.e.
0120: 72 00 45 00 64 00 67 00 r.E.d.g.
0128: 65 00 20 00 32 00 36 00 e. .2.6.
0130: 30 00 30 00 20 00 20 00 0.0. . .
0138: 20 00 20 00 20 00 20 00 . . . .
0140: 20 00 20 00 20 00 20 00 . . . .
0148: 20 00 20 00 20 00 00 00 . . ...
0150: 30 00 00 00 34 00 00 00 0...4...
0158: 31 00 30 00 32 00 34 00 1.0.2.4.
0160: 00 00 34 00 30 00 39 00 ..4.0.9.
0168: 00 00 74 00 72 00 69 00 ..t.r.i.
0170: 6e 00 69 00 75 00 6d 00 n.i.u.m.
0178: 2d 00 73 00 65 00 72 00 -.s.e.r.
0180: 76 00 65 00 72 00 2e 00 v.e.r...
0188: 54 00 54 00 53 00 2d 00 T.T.S.-.
0190: 49 00 2e 00 6c 00 6f 00 I...l.o.
0198: 63 00 61 00 6c 00 00 00 c.a.l...
01a0: 00 00 ..
Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6009
Date: 12/20/2004
Time: 8:48:41 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
Microsoft (R) Windows (R) 5.02. 3790 Multiprocessor Free.
Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6005
Date: 12/20/2004
Time: 8:48:41 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The Event log service was started.
Data:
0000: 31 00 2e 00 31 00 00 00 1...1...
0008: 30 00 00 00 4d 00 69 00 0...M.i.
0010: 63 00 72 00 6f 00 73 00 c.r.o.s.
0018: 6f 00 66 00 74 00 20 00 o.f.t. .
0020: 57 00 69 00 6e 00 64 00 W.i.n.d.
0028: 6f 00 77 00 73 00 20 00 o.w.s. .
0030: 53 00 65 00 72 00 76 00 S.e.r.v.
0038: 65 00 72 00 20 00 32 00 e.r. .2.
0040: 30 00 30 00 33 00 00 00 0.0.3...
0048: 35 00 2e 00 32 00 2e 00 5...2...
0050: 33 00 37 00 39 00 30 00 3.7.9.0.
0058: 20 00 42 00 75 00 69 00 .B.u.i.
0060: 6c 00 64 00 20 00 33 00 l.d. .3.
0068: 37 00 39 00 30 00 20 00 7.9.0. .
0070: 20 00 00 00 4d 00 75 00 ...M.u.
0078: 6c 00 74 00 69 00 70 00 l.t.i.p.
0080: 72 00 6f 00 63 00 65 00 r.o.c.e.
0088: 73 00 73 00 6f 00 72 00 s.s.o.r.
0090: 20 00 46 00 72 00 65 00 .F.r.e.
0098: 65 00 00 00 33 00 37 00 e...3.7.
00a0: 39 00 30 00 2e 00 73 00 9.0...s.
00a8: 72 00 76 00 30 00 33 00 r.v.0.3.
00b0: 5f 00 67 00 64 00 72 00 _.g.d.r.
00b8: 2e 00 30 00 34 00 30 00 ..0.4.0.
00c0: 34 00 31 00 30 00 2d 00 4.1.0.-.
00c8: 31 00 32 00 33 00 34 00 1.2.3.4.
00d0: 00 00 34 00 31 00 39 00 ..4.1.9.
00d8: 66 00 33 00 64 00 65 00 f.3.d.e.
00e0: 63 00 00 00 44 00 65 00 c...D.e.
00e8: 6c 00 6c 00 20 00 43 00 l.l. .C.
00f0: 6f 00 6d 00 70 00 75 00 o.m.p.u.
00f8: 74 00 65 00 72 00 20 00 t.e.r. .
0100: 43 00 6f 00 72 00 70 00 C.o.r.p.
0108: 6f 00 72 00 61 00 74 00 o.r.a.t.
0110: 69 00 6f 00 6e 00 00 00 i.o.n...
0118: 50 00 6f 00 77 00 65 00 P.o.w.e.
0120: 72 00 45 00 64 00 67 00 r.E.d.g.
0128: 65 00 20 00 32 00 36 00 e. .2.6.
0130: 30 00 30 00 20 00 20 00 0.0. . .
0138: 20 00 20 00 20 00 20 00 . . . .
0140: 20 00 20 00 20 00 20 00 . . . .
0148: 20 00 20 00 20 00 00 00 . . ...
0150: 30 00 00 00 34 00 00 00 0...4...
0158: 31 00 30 00 32 00 34 00 1.0.2.4.
0160: 00 00 34 00 30 00 39 00 ..4.0.9.
0168: 00 00 74 00 72 00 69 00 ..t.r.i.
0170: 6e 00 69 00 75 00 6d 00 n.i.u.m.
0178: 2d 00 73 00 65 00 72 00 -.s.e.r.
0180: 76 00 65 00 72 00 2e 00 v.e.r...
0188: 54 00 54 00 53 00 2d 00 T.T.S.-.
0190: 49 00 2e 00 6c 00 6f 00 I...l.o.
0198: 63 00 61 00 6c 00 00 00 c.a.l...
01a0: 00 00 ..
Event Type: Information
Event Source: BROWSER
Event Category: None
Event ID: 8015
Date: 12/20/2004
Time: 8:49:00 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The browser has forced an election on network
\Device\NetBT_Tcpip_{B15C17DF-BD20-4ECA-9B8E-8CB5B9BE942D} because a Windows
Server (or domain master) browser is started.
Event Type: Information
Event Source: DfsSvc
Event Category: None
Event ID: 14533
Date: 12/20/2004
Time: 8:49:00 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
DFS has finished building all namespaces.
Event Type: Information
Event Source: DfsSvc
Event Category: None
Event ID: 14531
Date: 12/20/2004
Time: 8:49:00 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
DFS server has finished initializing.
Event Type: Information
Event Source: W32Time
Event Category: None
Event ID: 37
Date: 12/20/2004
Time: 8:49:01 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The time provider NtpClient is currently receiving valid time data from
mailsvr.TTS-I.local (ntp.d|209.212.191.176:123->209.212.191.178:123).
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 12/20/2004
Time: 8:49:04 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
Application popup: Service Control Manager : At least one service or driver
failed during system startup. Use Event Viewer to examine the event log for
details.
Event Type: Information
Event Source: IPSec
Event Category: None
Event ID: 4295
Date: 12/20/2004
Time: 8:48:37 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The IPSec Driver is starting in Bypass mode. No IPSec security is being
applied while this computer starts up. IPSec policies, if they have been
assigned, will be applied to this computer after the IPSec services start.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 c7 10 00 40 ....Ç..@
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Information
Event Source: IPSec
Event Category: None
Event ID: 4294
Date: 12/20/2004
Time: 8:49:01 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The IPSec driver has entered Secure mode. IPSec policies, if they have been
configured, are now being applied to this computer.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 c6 10 00 40 ....Æ..@
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
Event Type: Information
Event Source: W32Time
Event Category: None
Event ID: 35
Date: 12/20/2004
Time: 8:49:17 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The time service is now synchronizing the system time with the time source
mailsvr.TTS-I.local (ntp.d|209.212.191.176:123->209.212.191.178:123).
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 8:50:30 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
The Terminal Services service was successfully sent a start control.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7000
Date: 12/20/2004
Time: 8:50:30 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The Network Load Balancing service failed to start due to the following
error:
The service cannot be started, either because it is disabled or because it
has no enabled devices associated with it.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 8:50:30 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
The Network Location Awareness (NLA) service was successfully sent a start
control.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 8:50:30 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The Network Location Awareness (NLA) service entered the running state.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 8:50:30 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
The NaiAvFilter1 service was successfully sent a start control.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 8:50:30 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
The EntDrv52 service was successfully sent a start control.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 8:50:30 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
The Network Connections service was successfully sent a start control.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 8:50:30 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The Network Connections service entered the running state.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 8:50:30 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The Telephony service entered the running state.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7035
Date: 12/20/2004
Time: 8:50:30 AM
User: NT AUTHORITY\SYSTEM
Computer: TRINIUM-SERVER
Description:
The Remote Access Connection Manager service was successfully sent a start
control.
Event Type: Information
Event Source: Service Control Manager
Event Category: None
Event ID: 7036
Date: 12/20/2004
Time: 8:50:30 AM
User: N/A
Computer: TRINIUM-SERVER
Description:
The Remote Access Connection Manager service entered the running state.
Dave Patrick said:
When you view the logged events in Event Viewer in the upper right corner,
third button down is a copy to clipboard, then you can paste in the body of
a reply message.
Please do so for each of the different System Log events since last boot so
we can see all of the event detail.
--
Regards,
Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect
:
|I have a new 2003 server that I have joined to my domain with 2 other 2003
| servers.
| For one, when I reboot the server I get these 2 error messages in teh App
| log
|
| "Windows cannot query for the list of Group Policy objects. Check the
event
| log for possible messages previously logged by the policy engine that
| describes the reason for this."
| and
| "Windows cannot find the machine account, The Local Security Authority
| cannot be contacted . "
|
| I went to the KB online and that was really unhelpfull.
|
| But anyway, the reason for this posting is becasue every once and a while
I
| go to log onto the machine, and the user name and password boxes are
| disabled.
| no way to type anything anywhere.
|
| I try to go to one of my other server, pulling it up in "computer
| managment", go to properties and try to tell it to reboot. It tells my
that
| it isn't ready. Yet when I go to my 2kpro machine, I can make the server
| reboot without a problem.
|
| My main concern is on why the name and password boxes are disabled.
|
|
|
