Events 4353 and 4356 appearing once daily in logs on DC

For the past 2 weeks I have been getting Events 4353 and 4356 appearing once
daily in logs on a domain controller. The 4353 error says
"ChangedSubscription event but received a bad return code. HRESULT was
80040201." The 4356 error says "...The COM+ Event System failed to create an
instance of the subscriber {...GIUD removed for security...}.
StandardCreateInstance returned HRESULT 80070422. Can anyone tell me what is
caising this and how to fix it?

Thanks

....

 

In

Hello Brad,

What specific error code (example: "Error code: 80070057") does EventID 4356
show? Are you also getting EventID 1000 errors?

EventID 4353 indicates an issue accessing the gpt.ini file in Sysvol. By
chance are any services disabled, such as the NetBIOS Helper Service and/or
the DHCP Client Service on the DC?

Just to make sure, I am assuming your DC is only using itself for DNS, and
there are no ISP's DNS servers listed in the DNS settings in IP Properties.
If incorrect, please elaborate and post an unedited ipconfig /all.

More info on the events can be found in the following links.
http://eventid.net/display.asp?eventid=4353&eventno=2027&source=EventSystem&phase=1
http://eventid.net/display.asp?eventid=4356&eventno=1035&source=EventSystem&phase=1


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
Microsoft Certified Trainer


For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

 

Hi Brad,

Thank you posting here.

From your description, I understand that:

Events 4353 and 4356 appear once daily in longs on a Domain Controller.

If I have misunderstood the problem, please don't hesitate to let me know.

As Ace suggested, please check Sysvol folder permission and NetBIOS Helper
Service.

If the issue persists, let’s try the steps below to clean up a damaged COM+
catalog, follow these steps:

1. Rename the %WinDir%\System32\Clbcatq.dll file
to%WinDir%\System32\~Clbcatq.dll. Make sure that you include the tilde (~)
at the start of the file name.
2. Restart the computer.
3. Start Registry Editor (Regedt32.exe).
4. Locate and delete the following key in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3

5. At a command prompt, type cd %windir%, and then press ENTER.
6. At a command prompt, type rmdir /s Registration, and then press ENTER.
This is the location folder of the registration database.

7. Click the Start button, point to Settings, and then click Control Panel.
8. Double-click Add/Remove Programs, and then click Add/Remove Windows
Components.
9. Click Next to go through the reinstallation process, to reinstall COM+.
10. If IIS is installed on the computer, IIS creates several COM+
applications. These applications will now be missing. To re-create these
applications, run the following command at a command prompt:

rundll32 %windir%\system32\inetsrv\wamreg.dll, CreateIISPackage

If Windows File Protection blocks the renaming and deletion, restart the
computer in Safe mode, and follow these steps again.

Is there any progress? If not, please help to collect the following
information for research.

The MPS Reporting Tool is utilized to gather detailed information regarding
a systems current configuration. The data collected will assist you with
fault isolation.

A . Please download MPS Reporting Tool (MPSRPT_PFE.EXE) from the following
link:
(http://www.microsoft.com/downloads/details.aspx?FamilyID=00ad0eac-720f-4441
-9ef6-ea9f657b5c2f&DisplayLang=en)

Please note: The link may be truncated when you read the E-mail. Be sure to
include all text between '(' and ')' when navigating to the download
location.

B . Right click MPSRPT_PFE.EXE and select Run as Administrator to run this
tool, and you will see a Command Window start up.

C . Please type Y with the message of <Include the MSINFO32 report?
(defaults to Y in 15 seconds)[Y,N]?

D . When the tool is done you will see an Explorer Window opening up the
%systemroot%\MPSReports\Setup\Reports\cab folder and containing a
<Computername>MPSReports.cab file. After collecting, please use Windows
Live SkyDrive (http://www.skydrive.live.com/) to upload the file and then
give me the download address.

Sincerely,
Mervyn Zhang
Microsoft Online Community Support

==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

Ace and Mervyn,

I checked everything Ace suggested and found nothing that needed to be
changed but the events have not appeared for 48 hours , no sure why they
stopped. I will wait a few days, if the events return, I will proceed with
Mervyn's suggestions.

Thanks to both of you.

--
bb

 

Hi Brad,

Glad to hear the issue doesn't appear now.

You're welcomed to post any update on this issue. If there is anything else
I can do for you, please us know.

Sincerely,
Mervyn Zhang
Microsoft Online Community Support

==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

In

You are welcome. Just as Mervyn, I am also happy to hear the problem has not
reoccured. Please do keep us posted for any reoccurance.

Ace

 

Mervyn,

The errors reappeared so I proceeded with the instruction that you provided
(renaming the dll, removing the COM3 key, etc. Now new errors are appearing:

Directory Services log: Event ID 1126, 2087, 1168, 1913 appear, some of them
repeated times and then events 1238 and 1168; then settles into a repeating
pattern of events 1655 and 1126.

Application log has event 1053 repeatedly.

This domain controller seems to be developing serious issues. Would the
safest course of action be to promote a new domain controller and then remove
this one from the domain? Or would you suggest another approach?
--
bb

 

Mervyn,

The errors started apperaing in the logs again so I followed hte procedure
that you recommended (rename the .dll. delete the COM3 registry key, etc).
Now we are getting new erros on the logs, as follows:

Directory Services log: Event ID 1126, 2087, 1168, 1913 appear, some of them
repeated times and then events 1238 and 1168; then settles into a repeating
pattern of events 1655 and 1126

Aplication log has event 1053 repeatedly.

This domain controller seems to be developing serious issues. Would the
safest course of action be to promote a new domain controller and then remove
this one from the domain?
--
bb

 

Mervyn,

The errors came back so I wen through the steps you recommended (rename the
..dll, delete the registry key, etc). Now we are getting new errors:

Directory Services log: Event ID 1126, 2087, 1168, 1913 appear, some of them
repeated times and then events 1238 and 1168; then settles into a repeating
pattern of events 1655 and 1126

Aplication log has event 1053 repeatedly.

This domain controller seems to be developing serious issues and I don't
want them to lead to corruption of Active Directory. Would the safest course
of action be to promote a new domain controller on different hardware and
then remove this one from the domain?
--
bb

 

I apologize for the multiple postings. I was getting errors saying the
posting did not succeed so I tried again a couple of times.

This issue is now resolved by going through the COM+ installation again and
removing patch KB951748. Case closed, no need for response. Thanks to all for
your input.
--
bb

 

In

Good to hear you got it fixed. I was going to suggest to possibly just
demote the machine and promote a new one. Sometimes in such cases if you
can't get to the bottom of it, and there are other DCs, it is easier and
less time consuming to go this route, unless of course Exchange is on it,
which complicates the procedure.

Ace