Event Error 2424 and Warning 2436 Every 5 minutes (posted fixes don't apply)

Discussion in 'Windows Small Business Server' started by WebColin70, Sep 28, 2009.

  1. WebColin70

    WebColin70 Guest

    I have what appears (from an Internet search) to be a somewhat-common
    error - Event ID error 2424 and warning 2436 every 5 minutes. The proposed
    fix appears to be to create a BackConnectionHostNames in
    HKLM/System/CurrentControlSet/Control/Lsa/MSV1_0 and set it to the exterior
    facing FQDN domain name (e.g., remote.mydomain.com). However, on my system,
    this was already set properly in my registry, so that is not the solution in
    my case.

    Is there another possibility?

    I am running SBS 2008. It is mostly running the basic configuration out of
    the the box. I have not really used SharePoint or the web site yet, other
    than for OWA. I believe all current patches are installed.

    In my case, this appears to have started approximately when I changed the IP
    address and subnet range of the server from to (note
    the third octet change from .1.x to .2.x, both subnet). The
    router also changed from to I had needed to change
    this because I needed to put the server on a second router, behind the
    original router, reached from the outside by setting the new router as the
    DMZ server on the first (requested by my ISP to diagnose occasional
    intermittent Internet access loss, which I have blamed on their router).

    I did use the SBS Wizard "Connect to the Internet" in the SBS Console to
    change the IP address, router, etc. I figured this would help ensure
    everything that needed to change would be changed properly. After running
    the wizard, which simply created a new default DHCP scope, I also needed to
    re-create the DHCP exclusions and a few specific reservations (printers).

    I also restarted the server after these changes, which I suppose could
    itself have caused other changes of which I am not aware.

    I'm not certain that any of this is the cause, as mail and remote web
    access, and client computers' domain and shared folder access all appear to
    work properly since the changes, but the timing seems to be very closely
    related. I especially don't think the DMZ router or the DHCP changes are
    relevant (I just don't think the SharePoint search crawler would be affected
    by those), but I am a little suspicious of the server and router IP#
    changes. Perhaps it thinks it's a different system now, so security settings
    that worked previously are now failing? In any case, these were all of the
    changes that seem to coincide with the timing of the errors appearing, so
    maybe they are diagnostically relevant.

    Any suggestions?

    Thanks for any help or leads,
    WebColin70, Sep 28, 2009
    1. Advertisements

  2. Les Connor [SBS MVP], Sep 28, 2009
    1. Advertisements

  3. WebColin70

    WebColin70 Guest

    Everything checked out fine. I guess the Best Practice Analyzer doesn't
    actually check anything to do with Sharepoint, as the errors still appear
    every 5 minutes like clockwork.

    Any other suggestions?


    WebColin70, Sep 28, 2009
  4. I'll guess at the source of the event ID 2424, but in future you should
    copy/paste the event.

    Have a look here: (hint: the official sbs blog is always a good choice for
    first search)


    and/or here.


    Les Connor [SBS MVP]

    Les Connor [SBS MVP], Sep 28, 2009
  5. fix my network wizard didn't *fix it* either?

    Les Connor [SBS MVP]

    Les Connor [SBS MVP], Sep 28, 2009
  6. WebColin70

    WebColin70 Guest

    I don't see anything relevant in the SBS Analyzer, but there are some
    issues. I'll look into those.

    I had tried the blog and that entry. While the error is the same, the
    proposed fix was not relevant. In fact, I referenced that fix in my original
    post and said that my registry was already configured in the recommended

    I had also tried changing the Service Account, something several other posts
    recommend, but that also had no effect anyway. I should note that none of
    the posts recommending that fix, nor the MS Technet entries actually explain
    this or provide detailed steps to carry it out. It is entirely possible that
    I did not try this in the way the experts had intended, as the fix
    suggestions are always vague: "Be sure the Service Account is not one of the
    builtin accounts." Some said be sure it's an admin account, others said it
    should not be an admin account.

    However, I may have stumbled on the problem and solution. It appears that
    the "Connect to the Internet," the "Fix My Network," and the "SharePoint
    Products and Technologies Configuration Wizard" all missed updating one of
    my DNS records. This would appear to be a bug in the wizards, as they left
    the old, obsolete, and obviously wrong IP# in my Forward Lookup Zone -
    remote.mydomain.com. It was still set to the old address and had
    not been properly updated to the new address. When I changed
    that manually, the 2424 errors appear to have stopped.

    To be fair, it's only been half an hour, but they were every 5 minutes on
    the nose until now. I'll wait and see if this is a permanent fix, or just a

    WebColin70, Sep 28, 2009
  7. WebColin70

    Leythos Guest

    A call to MS support may fix it, the last time I talked with someone
    that dealt with it and it took MS several days to fix it.

    It starts after you fully patch a SBS 2008 system.
    Leythos, Sep 28, 2009
  8. Good stuff, Colin :).

    I can't say for sure if the fact the BPA didn't pick this up has been
    identified, or not. I do know we're waiting for an update to the rule set
    BPA uses.

    But in any case, it's a good practice to address all BPA issues identified

    Les Connor [SBS MVP]

    Les Connor [SBS MVP], Sep 28, 2009
  9. It doesn't affect all SBS08 installs, though. That makes it a bit tougher to
    Les Connor [SBS MVP], Sep 28, 2009
  10. WebColin70

    Leythos Guest

    I did 4 installs from the action pack subscription, the latest release,
    it wasn't present before the updates, it was after.

    I did 2 installs from OEM media, not there before the updates, there
    after them.

    I've done countless other 08 installs where I just have not looked any
    Leythos, Sep 28, 2009
  11. Ahh, yes, the errors are common - what's not consistent is that the
    published fix doesn't seem to work in all cases.
    Les Connor [SBS MVP], Sep 28, 2009
  12. WebColin70

    Leythos Guest

    That's been my experience, and the fix, if you do all that MS Support
    asks, provides an email way to break things.
    Leythos, Sep 29, 2009
  13. WebColin70

    WebColin70 Guest

    I haven't yet gone through the BPA results, and there may be other issues
    still in need of fixing, but the 2424 errors have not recurred since I fixed
    that DNS entry. In fact, I have not had a single error or warning in the
    Administrative Events Custom View log since I corrected that.

    So at least one lesson here is clear: having an incorrect forward lookup for
    the external-facing FQDN (remote.domainname.com) will cause the 2424 error
    and 2436 warning every 5 minutes. From reports on the Internet, other issues
    will also cause the same symptoms (5 minutes is simply the default re-index
    time in SharePoint, set at: Start | Administrative Tools | SharePoint 3.0
    Central Administration | Operations | Services on server | Windows
    SharePoint Services Search | Indexing Scheduling).

    Thanks for pointing me to the BPA. I had never used that before and it
    certainly seems like a great tool.


    WebColin70, Sep 29, 2009
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.