EventId: 40961 LSASrv

Discussion in 'Windows Small Business Server' started by Nick, Mar 21, 2008.

  1. Nick

    Nick Guest

    I am seeing the above error on one particular user account; another user
    account on the same workstation is fine but the faulty user account also
    causes the same error on a different workstation. Any ideas?
     
    Nick, Mar 21, 2008
    #1
    1. Advertisements

  2. Larry Struckmeyer, Mar 21, 2008
    #2
    1. Advertisements

  3. Hello Nick,

    Thank you for posting here. Let's also thank Larry for the input.

    According to your description, I understand that you get event warning
    40961 about LSASrv on workstations when you logon one domain user account.
    If I have misunderstood the problem, please don't hesitate to let me know.

    Based on my research, I suggest we try the following steps to see if we can
    resolve this issue:

    1. If you log on to a Microsoft Windows XP Service Pack 2 (SP2)-based
    computer before a domain controller on your network is available, you will
    get this warning. I suggest you install the following hotfix on your XP
    workstation:

    You cannot access network resources after you try to log on to a Windows XP
    Service Pack 2-based computer
    http://support.microsoft.com/?id=885887

    2. As I know the corrupted user profile on workstation may cause this
    warning. I suggest you logon the domain user account on a new workstation
    which it never logon before. The new profile will be created. Then test
    this issue.

    3.Remove bad stored credentials for the Credential Manager and prevent them
    from re-writing. To do this:
    1) Run Regedit.exe
    2) Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
    Value Name: disabledomaincreds
    Value Type: REG_DWORD
    3) Set the disabledomaincreds value to "1" to stop store domain
    credentials

    4.Set Kerberos to use TCP. To do this:
    1) Start Registry Editor.
    2) Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\
    Kerberos\Parameters
    Note: If the Parameters key does not exist, create it now.

    3) On the Edit menu, point to New, and then click DWORD Value.
    4) Type MaxPacketSize , and then press ENTER.
    5) Double-click MaxPacketSize, type 1 in the Value data box, click to
    select the Decimal option, and then click OK.
    6) Quit Registry Editor.
    7) Restart your computer.

    If we cannot resolve the issue after we perform the above steps, please
    help me collect some information for further investigation:

    1. Do you enable roaming profile for this user account?

    2. Try to create a new user account on SBS and logon it on workstation.
    Does the issue happen again?

    3. What's OS of your workstation?

    4. Gather MPS network report on SBS:

    a. Download MPSrepot_network from
    http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
    15706/MPSRPT_NETWORK.EXE

    b. Run MPSRPT_NETWORK.exe.

    c. The tool will automatically collect the information. This procedure will
    take 10~15 minutes.

    d. Open Windows Explorer, navigate to the folder:
    %SystemRoot%\MPSReports\Network\Reports\Cab\

    e. Send the .cab file directly to me at

    I hope these steps will give you some help.

    Thanks and have a nice day!

    Best regards,

    Terence Liu(MSFT)

    Microsoft CSS Online Newsgroup Support

    Get Secure! - www.microsoft.com/security

    =====================================================
    This newsgroup only focuses on SBS technical issues. If you have issues
    regarding other Microsoft products, you'd better post in the corresponding
    newsgroups so that they can be resolved in an efficient and timely manner.
    You can locate the newsgroup here:
    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

    When opening a new thread via the web interface, we recommend you check the
    "Notify me of replies" box to receive e-mail notifications when there are
    any updates in your thread. When responding to posts via your newsreader,
    please "Reply to Group" so that others may learn and benefit from your
    issue.

    Microsoft engineers can only focus on one issue per thread. Although we
    provide other information for your reference, we recommend you post
    different incidents in different threads to keep the thread clean. In doing
    so, it will ensure your issues are resolved in a timely manner.

    For urgent issues, you may want to contact Microsoft CSS directly. Please
    check http://support.microsoft.com for regional support phone numbers.

    Any input or comments in this thread are highly appreciated.
    =====================================================

    This posting is provided "AS IS" with no warranties, and confers no rights.

    --------------------
    | From: "Nick" <>
    | Subject: EventId: 40961 LSASrv
    | Date: Fri, 21 Mar 2008 20:16:05 -0000
    | Lines: 5
    | X-Priority: 3
    | X-MSMail-Priority: Normal
    | X-Newsreader: Microsoft Outlook Express 6.00.3790.2929
    | X-RFC2646: Format=Flowed; Original
    | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
    | Message-ID: <>
    | Newsgroups: microsoft.public.windows.server.sbs
    | NNTP-Posting-Host: host86-150-149-249.range86-150.btcentralplus.com
    86.150.149.249
    | Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
    | Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:99420
    | X-Tomcat-NG: microsoft.public.windows.server.sbs
    |
    | I am seeing the above error on one particular user account; another user
    | account on the same workstation is fine but the faulty user account also
    | causes the same error on a different workstation. Any ideas?
    |
    |
    |
     
    Terence Liu [MSFT], Mar 25, 2008
    #3
  4. Nick

    Nick Guest

    Thanks Larry and Terrence for your suggestions.

    I have now been able to temorarily fix this on a workstation by setting
    DisableDomainCreds=1. Obviously this is only a temporary fix because that
    user still has a faulty roaming user profile and the same error occurs if
    they logon to a different workstation. However there are no passwords
    cached.

    Next question is wether this is likely to be something screwed in that user
    profile, in which case I can simply restore a previous one from before the
    problem started, or is it an Active Directory problem with this user
    account? Any suggestions what to try next?

    Cheers,
    Nick
     
    Nick, Mar 27, 2008
    #4
  5. Hello Nick,

    Thank you for your update.

    I'm glad we find the resolution of this issue.

    Since this issue only happen on one user, and the user be enabled roaming
    profile. I think this issue is caused by the corrupted user profile. I
    suggest you recreate the roaming profile for this user account.

    1. On the SBS server, backup the roaming profile of this user, and then
    empty the folder. You can open the user's properties in Server Management
    console -> Users node, select Profile tab, the roaming profile path is the
    value Profile path box.

    2. Delete the roaming profile for this user account on all client
    computers.

    a. Logon the client computer with local administrator.
    b. Right-click My Computer , and then click Properties .
    c. On the Advanced tab, click Settings under User Profiles pane, click the
    problematic profile,
    d. Then, click Delete button to delete the profile.

    3. Then, logon the user account to the client computer to test.

    I hope these steps will give you some help.

    Thanks and have a nice day!

    Best regards,

    Terence Liu(MSFT)

    Microsoft CSS Online Newsgroup Support

    Get Secure! - www.microsoft.com/security

    =====================================================
    This newsgroup only focuses on SBS technical issues. If you have issues
    regarding other Microsoft products, you'd better post in the corresponding
    newsgroups so that they can be resolved in an efficient and timely manner.
    You can locate the newsgroup here:
    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

    When opening a new thread via the web interface, we recommend you check the
    "Notify me of replies" box to receive e-mail notifications when there are
    any updates in your thread. When responding to posts via your newsreader,
    please "Reply to Group" so that others may learn and benefit from your
    issue.

    Microsoft engineers can only focus on one issue per thread. Although we
    provide other information for your reference, we recommend you post
    different incidents in different threads to keep the thread clean. In doing
    so, it will ensure your issues are resolved in a timely manner.

    For urgent issues, you may want to contact Microsoft CSS directly. Please
    check http://support.microsoft.com for regional support phone numbers.

    Any input or comments in this thread are highly appreciated.
    =====================================================

    This posting is provided "AS IS" with no warranties, and confers no rights.

    --------------------
    | From: "Nick" <>
    | References: <>
    <>
    | Subject: Re: EventId: 40961 LSASrv
    | Date: Thu, 27 Mar 2008 11:30:55 -0000
    | Lines: 167
    | X-Priority: 3
    | X-MSMail-Priority: Normal
    | X-Newsreader: Microsoft Outlook Express 6.00.3790.2929
    | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
    | X-RFC2646: Format=Flowed; Original
    | Message-ID: <uiatI4$>
    | Newsgroups: microsoft.public.windows.server.sbs
    | NNTP-Posting-Host: host86-157-219-146.range86-157.btcentralplus.com
    86.157.219.146
    | Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
    | Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:100130
    | X-Tomcat-NG: microsoft.public.windows.server.sbs
    |
    | Thanks Larry and Terrence for your suggestions.
    |
    | I have now been able to temorarily fix this on a workstation by setting
    | DisableDomainCreds=1. Obviously this is only a temporary fix because
    that
    | user still has a faulty roaming user profile and the same error occurs if
    | they logon to a different workstation. However there are no passwords
    | cached.
    |
    | Next question is wether this is likely to be something screwed in that
    user
    | profile, in which case I can simply restore a previous one from before
    the
    | problem started, or is it an Active Directory problem with this user
    | account? Any suggestions what to try next?
    |
    | Cheers,
    | Nick
    |
    |
    |
    | | > Hello Nick,
    | >
    | > Thank you for posting here. Let's also thank Larry for the input.
    | >
    | > According to your description, I understand that you get event warning
    | > 40961 about LSASrv on workstations when you logon one domain user
    account.
    | > If I have misunderstood the problem, please don't hesitate to let me
    know.
    | >
    | > Based on my research, I suggest we try the following steps to see if we
    | > can
    | > resolve this issue:
    | >
    | > 1. If you log on to a Microsoft Windows XP Service Pack 2 (SP2)-based
    | > computer before a domain controller on your network is available, you
    will
    | > get this warning. I suggest you install the following hotfix on your XP
    | > workstation:
    | >
    | > You cannot access network resources after you try to log on to a
    Windows
    | > XP
    | > Service Pack 2-based computer
    | > http://support.microsoft.com/?id=885887
    | >
    | > 2. As I know the corrupted user profile on workstation may cause this
    | > warning. I suggest you logon the domain user account on a new
    workstation
    | > which it never logon before. The new profile will be created. Then test
    | > this issue.
    | >
    | > 3.Remove bad stored credentials for the Credential Manager and prevent
    | > them
    | > from re-writing. To do this:
    | > 1) Run Regedit.exe
    | > 2) Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
    | > Value Name: disabledomaincreds
    | > Value Type: REG_DWORD
    | > 3) Set the disabledomaincreds value to "1" to stop store domain
    | > credentials
    | >
    | > 4.Set Kerberos to use TCP. To do this:
    | > 1) Start Registry Editor.
    | > 2) Locate and then click the following registry subkey:
    | >
    | > HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\
    | > Kerberos\Parameters
    | > Note: If the Parameters key does not exist, create it now.
    | >
    | > 3) On the Edit menu, point to New, and then click DWORD Value.
    | > 4) Type MaxPacketSize , and then press ENTER.
    | > 5) Double-click MaxPacketSize, type 1 in the Value data box, click to
    | > select the Decimal option, and then click OK.
    | > 6) Quit Registry Editor.
    | > 7) Restart your computer.
    | >
    | > If we cannot resolve the issue after we perform the above steps, please
    | > help me collect some information for further investigation:
    | >
    | > 1. Do you enable roaming profile for this user account?
    | >
    | > 2. Try to create a new user account on SBS and logon it on workstation.
    | > Does the issue happen again?
    | >
    | > 3. What's OS of your workstation?
    | >
    | > 4. Gather MPS network report on SBS:
    | >
    | > a. Download MPSrepot_network from
    | >
    http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
    | > 15706/MPSRPT_NETWORK.EXE
    | >
    | > b. Run MPSRPT_NETWORK.exe.
    | >
    | > c. The tool will automatically collect the information. This procedure
    | > will
    | > take 10~15 minutes.
    | >
    | > d. Open Windows Explorer, navigate to the folder:
    | > %SystemRoot%\MPSReports\Network\Reports\Cab\
    | >
    | > e. Send the .cab file directly to me at
    | >
    | > I hope these steps will give you some help.
    | >
    | > Thanks and have a nice day!
    | >
    | > Best regards,
    | >
    | > Terence Liu(MSFT)
    | >
    | > Microsoft CSS Online Newsgroup Support
    | >
    | > Get Secure! - www.microsoft.com/security
    | >
    | > =====================================================
    | > This newsgroup only focuses on SBS technical issues. If you have issues
    | > regarding other Microsoft products, you'd better post in the
    corresponding
    | > newsgroups so that they can be resolved in an efficient and timely
    manner.
    | > You can locate the newsgroup here:
    | > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
    | >
    | > When opening a new thread via the web interface, we recommend you check
    | > the
    | > "Notify me of replies" box to receive e-mail notifications when there
    are
    | > any updates in your thread. When responding to posts via your
    newsreader,
    | > please "Reply to Group" so that others may learn and benefit from your
    | > issue.
    | >
    | > Microsoft engineers can only focus on one issue per thread. Although we
    | > provide other information for your reference, we recommend you post
    | > different incidents in different threads to keep the thread clean. In
    | > doing
    | > so, it will ensure your issues are resolved in a timely manner.
    | >
    | > For urgent issues, you may want to contact Microsoft CSS directly.
    Please
    | > check http://support.microsoft.com for regional support phone numbers.
    | >
    | > Any input or comments in this thread are highly appreciated.
    | > =====================================================
    | >
    | > This posting is provided "AS IS" with no warranties, and confers no
    | > rights.
    | >
    | > --------------------
    | > | From: "Nick" <>
    | > | Subject: EventId: 40961 LSASrv
    | > | Date: Fri, 21 Mar 2008 20:16:05 -0000
    | > | Lines: 5
    | > | X-Priority: 3
    | > | X-MSMail-Priority: Normal
    | > | X-Newsreader: Microsoft Outlook Express 6.00.3790.2929
    | > | X-RFC2646: Format=Flowed; Original
    | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
    | > | Message-ID: <>
    | > | Newsgroups: microsoft.public.windows.server.sbs
    | > | NNTP-Posting-Host: host86-150-149-249.range86-150.btcentralplus.com
    | > 86.150.149.249
    | > | Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
    | > | Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:99420
    | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
    | > |
    | > | I am seeing the above error on one particular user account; another
    user
    | > | account on the same workstation is fine but the faulty user account
    also
    | > | causes the same error on a different workstation. Any ideas?
    | > |
    | > |
    | > |
    | >
    |
    |
    |
     
    Terence Liu [MSFT], Mar 28, 2008
    #5
  6. Nick

    Nick Guest

    Terrence, thanks for your suggestions.

    Problem believed to now be fixed, so some further info for the archive.

    DisableDomainCreds=1 did indeed temporarily fix the problem but was not a
    permanent fix as same issue occured when that user logged onto a different
    workststion (roaming profiles). Problem was any other profile which logged
    onto this workstation while DisableDomainCreds=1 also got corrupted, that
    also included the local Administrator account.

    Solution appears to be reset DisableDomainCreds=0, restore all roaming user
    profiles from a previous backup and delete the local Administrator profile.

    Nick
     
    Nick, Apr 3, 2008
    #6
  7. Hello Nick,

    Thank you very much for sharing your resolution. I appreciate your time on
    this issue.

    I'm glad to hear that things are working correctly for you now. Please do
    not hesitate to post in SBS newsgroup if you need any assistance in the
    future. I look forward to working with you again.

    Thank you and have a nice day,

    Best regards,

    Terence Liu(MSFT)

    Microsoft CSS Online Newsgroup Support

    Get Secure! - www.microsoft.com/security

    =====================================================
    This newsgroup only focuses on SBS technical issues. If you have issues
    regarding other Microsoft products, you'd better post in the corresponding
    newsgroups so that they can be resolved in an efficient and timely manner.
    You can locate the newsgroup here:
    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

    When opening a new thread via the web interface, we recommend you check the
    "Notify me of replies" box to receive e-mail notifications when there are
    any updates in your thread. When responding to posts via your newsreader,
    please "Reply to Group" so that others may learn and benefit from your
    issue.

    Microsoft engineers can only focus on one issue per thread. Although we
    provide other information for your reference, we recommend you post
    different incidents in different threads to keep the thread clean. In doing
    so, it will ensure your issues are resolved in a timely manner.

    For urgent issues, you may want to contact Microsoft CSS directly. Please
    check http://support.microsoft.com for regional support phone numbers.

    Any input or comments in this thread are highly appreciated.
    =====================================================

    This posting is provided "AS IS" with no warranties, and confers no rights.

    --------------------
    | From: "Nick" <>
    | References: <>
    <>
    <uiatI4$>
    <>
    | Subject: Re: EventId: 40961 LSASrv
    | Date: Thu, 3 Apr 2008 10:49:32 +0100
    | Lines: 306
    | X-Priority: 3
    | X-MSMail-Priority: Normal
    | X-Newsreader: Microsoft Outlook Express 6.00.3790.2929
    | X-RFC2646: Format=Flowed; Original
    | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
    | Message-ID: <>
    | Newsgroups: microsoft.public.windows.server.sbs
    | NNTP-Posting-Host: host86-157-219-146.range86-157.btcentralplus.com
    86.157.219.146
    | Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP04.phx.gbl
    | Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:101274
    | X-Tomcat-NG: microsoft.public.windows.server.sbs
    |
    | Terrence, thanks for your suggestions.
    |
    | Problem believed to now be fixed, so some further info for the archive.
    |
    | DisableDomainCreds=1 did indeed temporarily fix the problem but was not a
    | permanent fix as same issue occured when that user logged onto a
    different
    | workststion (roaming profiles). Problem was any other profile which
    logged
    | onto this workstation while DisableDomainCreds=1 also got corrupted, that
    | also included the local Administrator account.
    |
    | Solution appears to be reset DisableDomainCreds=0, restore all roaming
    user
    | profiles from a previous backup and delete the local Administrator
    profile.
    |
    | Nick
    |
    |
    |
    | | > Hello Nick,
    | >
    | > Thank you for your update.
    | >
    | > I'm glad we find the resolution of this issue.
    | >
    | > Since this issue only happen on one user, and the user be enabled
    roaming
    | > profile. I think this issue is caused by the corrupted user profile. I
    | > suggest you recreate the roaming profile for this user account.
    | >
    | > 1. On the SBS server, backup the roaming profile of this user, and then
    | > empty the folder. You can open the user's properties in Server
    Management
    | > console -> Users node, select Profile tab, the roaming profile path is
    the
    | > value Profile path box.
    | >
    | > 2. Delete the roaming profile for this user account on all client
    | > computers.
    | >
    | > a. Logon the client computer with local administrator.
    | > b. Right-click My Computer , and then click Properties .
    | > c. On the Advanced tab, click Settings under User Profiles pane, click
    | > the
    | > problematic profile,
    | > d. Then, click Delete button to delete the profile.
    | >
    | > 3. Then, logon the user account to the client computer to test.
    | >
    | > I hope these steps will give you some help.
    | >
    | > Thanks and have a nice day!
    | >
    | > Best regards,
    | >
    | > Terence Liu(MSFT)
    | >
    | > Microsoft CSS Online Newsgroup Support
    | >
    | > Get Secure! - www.microsoft.com/security
    | >
    | > =====================================================
    | > This newsgroup only focuses on SBS technical issues. If you have issues
    | > regarding other Microsoft products, you'd better post in the
    corresponding
    | > newsgroups so that they can be resolved in an efficient and timely
    manner.
    | > You can locate the newsgroup here:
    | > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
    | >
    | > When opening a new thread via the web interface, we recommend you check
    | > the
    | > "Notify me of replies" box to receive e-mail notifications when there
    are
    | > any updates in your thread. When responding to posts via your
    newsreader,
    | > please "Reply to Group" so that others may learn and benefit from your
    | > issue.
    | >
    | > Microsoft engineers can only focus on one issue per thread. Although we
    | > provide other information for your reference, we recommend you post
    | > different incidents in different threads to keep the thread clean. In
    | > doing
    | > so, it will ensure your issues are resolved in a timely manner.
    | >
    | > For urgent issues, you may want to contact Microsoft CSS directly.
    Please
    | > check http://support.microsoft.com for regional support phone numbers.
    | >
    | > Any input or comments in this thread are highly appreciated.
    | > =====================================================
    | >
    | > This posting is provided "AS IS" with no warranties, and confers no
    | > rights.
    | >
    | > --------------------
    | > | From: "Nick" <>
    | > | References: <>
    | > <>
    | > | Subject: Re: EventId: 40961 LSASrv
    | > | Date: Thu, 27 Mar 2008 11:30:55 -0000
    | > | Lines: 167
    | > | X-Priority: 3
    | > | X-MSMail-Priority: Normal
    | > | X-Newsreader: Microsoft Outlook Express 6.00.3790.2929
    | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
    | > | X-RFC2646: Format=Flowed; Original
    | > | Message-ID: <uiatI4$>
    | > | Newsgroups: microsoft.public.windows.server.sbs
    | > | NNTP-Posting-Host: host86-157-219-146.range86-157.btcentralplus.com
    | > 86.157.219.146
    | > | Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
    | > | Xref: TK2MSFTNGHUB02.phx.gbl
    microsoft.public.windows.server.sbs:100130
    | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
    | > |
    | > | Thanks Larry and Terrence for your suggestions.
    | > |
    | > | I have now been able to temorarily fix this on a workstation by
    setting
    | > | DisableDomainCreds=1. Obviously this is only a temporary fix because
    | > that
    | > | user still has a faulty roaming user profile and the same error
    occurs
    | > if
    | > | they logon to a different workstation. However there are no passwords
    | > | cached.
    | > |
    | > | Next question is wether this is likely to be something screwed in that
    | > user
    | > | profile, in which case I can simply restore a previous one from before
    | > the
    | > | problem started, or is it an Active Directory problem with this user
    | > | account? Any suggestions what to try next?
    | > |
    | > | Cheers,
    | > | Nick
    | > |
    | > |
    | > |
    | > | | > | > Hello Nick,
    | > | >
    | > | > Thank you for posting here. Let's also thank Larry for the input.
    | > | >
    | > | > According to your description, I understand that you get event
    warning
    | > | > 40961 about LSASrv on workstations when you logon one domain user
    | > account.
    | > | > If I have misunderstood the problem, please don't hesitate to let me
    | > know.
    | > | >
    | > | > Based on my research, I suggest we try the following steps to see
    if
    | > we
    | > | > can
    | > | > resolve this issue:
    | > | >
    | > | > 1. If you log on to a Microsoft Windows XP Service Pack 2
    (SP2)-based
    | > | > computer before a domain controller on your network is available,
    you
    | > will
    | > | > get this warning. I suggest you install the following hotfix on
    your
    | > XP
    | > | > workstation:
    | > | >
    | > | > You cannot access network resources after you try to log on to a
    | > Windows
    | > | > XP
    | > | > Service Pack 2-based computer
    | > | > http://support.microsoft.com/?id=885887
    | > | >
    | > | > 2. As I know the corrupted user profile on workstation may cause
    this
    | > | > warning. I suggest you logon the domain user account on a new
    | > workstation
    | > | > which it never logon before. The new profile will be created. Then
    | > test
    | > | > this issue.
    | > | >
    | > | > 3.Remove bad stored credentials for the Credential Manager and
    prevent
    | > | > them
    | > | > from re-writing. To do this:
    | > | > 1) Run Regedit.exe
    | > | > 2) Go to
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
    | > | > Value Name: disabledomaincreds
    | > | > Value Type: REG_DWORD
    | > | > 3) Set the disabledomaincreds value to "1" to stop store domain
    | > | > credentials
    | > | >
    | > | > 4.Set Kerberos to use TCP. To do this:
    | > | > 1) Start Registry Editor.
    | > | > 2) Locate and then click the following registry subkey:
    | > | >
    | > | > HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\
    | > | > Kerberos\Parameters
    | > | > Note: If the Parameters key does not exist, create it now.
    | > | >
    | > | > 3) On the Edit menu, point to New, and then click DWORD Value.
    | > | > 4) Type MaxPacketSize , and then press ENTER.
    | > | > 5) Double-click MaxPacketSize, type 1 in the Value data box,
    click
    | > to
    | > | > select the Decimal option, and then click OK.
    | > | > 6) Quit Registry Editor.
    | > | > 7) Restart your computer.
    | > | >
    | > | > If we cannot resolve the issue after we perform the above steps,
    | > please
    | > | > help me collect some information for further investigation:
    | > | >
    | > | > 1. Do you enable roaming profile for this user account?
    | > | >
    | > | > 2. Try to create a new user account on SBS and logon it on
    | > workstation.
    | > | > Does the issue happen again?
    | > | >
    | > | > 3. What's OS of your workstation?
    | > | >
    | > | > 4. Gather MPS network report on SBS:
    | > | >
    | > | > a. Download MPSrepot_network from
    | > | >
    | >
    http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
    | > | > 15706/MPSRPT_NETWORK.EXE
    | > | >
    | > | > b. Run MPSRPT_NETWORK.exe.
    | > | >
    | > | > c. The tool will automatically collect the information. This
    procedure
    | > | > will
    | > | > take 10~15 minutes.
    | > | >
    | > | > d. Open Windows Explorer, navigate to the folder:
    | > | > %SystemRoot%\MPSReports\Network\Reports\Cab\
    | > | >
    | > | > e. Send the .cab file directly to me at
    | > | >
    | > | > I hope these steps will give you some help.
    | > | >
    | > | > Thanks and have a nice day!
    | > | >
    | > | > Best regards,
    | > | >
    | > | > Terence Liu(MSFT)
    | > | >
    | > | > Microsoft CSS Online Newsgroup Support
    | > | >
    | > | > Get Secure! - www.microsoft.com/security
    | > | >
    | > | > =====================================================
    | > | > This newsgroup only focuses on SBS technical issues. If you have
    | > issues
    | > | > regarding other Microsoft products, you'd better post in the
    | > corresponding
    | > | > newsgroups so that they can be resolved in an efficient and timely
    | > manner.
    | > | > You can locate the newsgroup here:
    | > | > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
    | > | >
    | > | > When opening a new thread via the web interface, we recommend you
    | > check
    | > | > the
    | > | > "Notify me of replies" box to receive e-mail notifications when
    there
    | > are
    | > | > any updates in your thread. When responding to posts via your
    | > newsreader,
    | > | > please "Reply to Group" so that others may learn and benefit from
    your
    | > | > issue.
    | > | >
    | > | > Microsoft engineers can only focus on one issue per thread.
    Although
    | > we
    | > | > provide other information for your reference, we recommend you post
    | > | > different incidents in different threads to keep the thread clean.
    In
    | > | > doing
    | > | > so, it will ensure your issues are resolved in a timely manner.
    | > | >
    | > | > For urgent issues, you may want to contact Microsoft CSS directly.
    | > Please
    | > | > check http://support.microsoft.com for regional support phone
    numbers.
    | > | >
    | > | > Any input or comments in this thread are highly appreciated.
    | > | > =====================================================
    | > | >
    | > | > This posting is provided "AS IS" with no warranties, and confers no
    | > | > rights.
    | > | >
    | > | > --------------------
    | > | > | From: "Nick" <>
    | > | > | Subject: EventId: 40961 LSASrv
    | > | > | Date: Fri, 21 Mar 2008 20:16:05 -0000
    | > | > | Lines: 5
    | > | > | X-Priority: 3
    | > | > | X-MSMail-Priority: Normal
    | > | > | X-Newsreader: Microsoft Outlook Express 6.00.3790.2929
    | > | > | X-RFC2646: Format=Flowed; Original
    | > | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2992
    | > | > | Message-ID: <>
    | > | > | Newsgroups: microsoft.public.windows.server.sbs
    | > | > | NNTP-Posting-Host:
    host86-150-149-249.range86-150.btcentralplus.com
    | > | > 86.150.149.249
    | > | > | Path:
    | > TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
    | > | > | Xref: TK2MSFTNGHUB02.phx.gbl
    | > microsoft.public.windows.server.sbs:99420
    | > | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
    | > | > |
    | > | > | I am seeing the above error on one particular user account;
    another
    | > user
    | > | > | account on the same workstation is fine but the faulty user
    account
    | > also
    | > | > | causes the same error on a different workstation. Any ideas?
    | > | > |
    | > | > |
    | > | > |
    | > | >
    | > |
    | > |
    | > |
    | >
    |
    |
    |
     
    Terence Liu [MSFT], Apr 3, 2008
    #7
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.