Events 4353 and 4356 appearing once daily in logs on DC

Discussion in 'Active Directory' started by brad, Feb 3, 2009.

  1. brad

    brad Guest

    For the past 2 weeks I have been getting Events 4353 and 4356 appearing once
    daily in logs on a domain controller. The 4353 error says
    "ChangedSubscription event but received a bad return code. HRESULT was
    80040201." The 4356 error says "...The COM+ Event System failed to create an
    instance of the subscriber {...GIUD removed for security...}.
    StandardCreateInstance returned HRESULT 80070422. Can anyone tell me what is
    caising this and how to fix it?

    Thanks

    ....
     
    brad, Feb 3, 2009
    #1
    1. Advertisements

  2. In
    Hello Brad,

    What specific error code (example: "Error code: 80070057") does EventID 4356
    show? Are you also getting EventID 1000 errors?

    EventID 4353 indicates an issue accessing the gpt.ini file in Sysvol. By
    chance are any services disabled, such as the NetBIOS Helper Service and/or
    the DHCP Client Service on the DC?

    Just to make sure, I am assuming your DC is only using itself for DNS, and
    there are no ISP's DNS servers listed in the DNS settings in IP Properties.
    If incorrect, please elaborate and post an unedited ipconfig /all.

    More info on the events can be found in the following links.
    http://eventid.net/display.asp?eventid=4353&eventno=2027&source=EventSystem&phase=1
    http://eventid.net/display.asp?eventid=4356&eventno=1035&source=EventSystem&phase=1


    --
    Ace

    This posting is provided "AS-IS" with no warranties or guarantees and
    confers no rights.

    Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCT
    Microsoft Certified Trainer


    For urgent issues, you may want to contact Microsoft PSS directly. Please
    check http://support.microsoft.com for regional support phone numbers.
     
    Ace Fekay [Microsoft Certified Trainer], Feb 3, 2009
    #2
    1. Advertisements

  3. Hi Brad,

    Thank you posting here.

    From your description, I understand that:

    Events 4353 and 4356 appear once daily in longs on a Domain Controller.

    If I have misunderstood the problem, please don't hesitate to let me know.

    As Ace suggested, please check Sysvol folder permission and NetBIOS Helper
    Service.

    If the issue persists, let’s try the steps below to clean up a damaged COM+
    catalog, follow these steps:

    1. Rename the %WinDir%\System32\Clbcatq.dll file
    to%WinDir%\System32\~Clbcatq.dll. Make sure that you include the tilde (~)
    at the start of the file name.
    2. Restart the computer.
    3. Start Registry Editor (Regedt32.exe).
    4. Locate and delete the following key in the registry:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3

    5. At a command prompt, type cd %windir%, and then press ENTER.
    6. At a command prompt, type rmdir /s Registration, and then press ENTER.
    This is the location folder of the registration database.

    7. Click the Start button, point to Settings, and then click Control Panel.
    8. Double-click Add/Remove Programs, and then click Add/Remove Windows
    Components.
    9. Click Next to go through the reinstallation process, to reinstall COM+.
    10. If IIS is installed on the computer, IIS creates several COM+
    applications. These applications will now be missing. To re-create these
    applications, run the following command at a command prompt:

    rundll32 %windir%\system32\inetsrv\wamreg.dll, CreateIISPackage

    If Windows File Protection blocks the renaming and deletion, restart the
    computer in Safe mode, and follow these steps again.

    Is there any progress? If not, please help to collect the following
    information for research.

    The MPS Reporting Tool is utilized to gather detailed information regarding
    a systems current configuration. The data collected will assist you with
    fault isolation.

    A . Please download MPS Reporting Tool (MPSRPT_PFE.EXE) from the following
    link:
    (http://www.microsoft.com/downloads/details.aspx?FamilyID=00ad0eac-720f-4441
    -9ef6-ea9f657b5c2f&DisplayLang=en)

    Please note: The link may be truncated when you read the E-mail. Be sure to
    include all text between '(' and ')' when navigating to the download
    location.

    B . Right click MPSRPT_PFE.EXE and select Run as Administrator to run this
    tool, and you will see a Command Window start up.

    C . Please type Y with the message of <Include the MSINFO32 report?
    (defaults to Y in 15 seconds)[Y,N]?

    D . When the tool is done you will see an Explorer Window opening up the
    %systemroot%\MPSReports\Setup\Reports\cab folder and containing a
    <Computername>MPSReports.cab file. After collecting, please use Windows
    Live SkyDrive (http://www.skydrive.live.com/) to upload the file and then
    give me the download address.

    Sincerely,
    Mervyn Zhang
    Microsoft Online Community Support

    ==================================================
    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Mervyn Zhang [MSFT], Feb 3, 2009
    #3
  4. brad

    brad Guest

    Ace and Mervyn,

    I checked everything Ace suggested and found nothing that needed to be
    changed but the events have not appeared for 48 hours , no sure why they
    stopped. I will wait a few days, if the events return, I will proceed with
    Mervyn's suggestions.

    Thanks to both of you.

    --
    bb


     
    brad, Feb 4, 2009
    #4
  5. Hi Brad,

    Glad to hear the issue doesn't appear now.

    You're welcomed to post any update on this issue. If there is anything else
    I can do for you, please us know.

    Sincerely,
    Mervyn Zhang
    Microsoft Online Community Support

    ==================================================
    This posting is provided "AS IS" with no warranties, and confers no rights.
     
    Mervyn Zhang [MSFT], Feb 6, 2009
    #5
  6. In
    You are welcome. Just as Mervyn, I am also happy to hear the problem has not
    reoccured. Please do keep us posted for any reoccurance.

    Ace
     
    Ace Fekay [Microsoft Certified Trainer], Feb 7, 2009
    #6
  7. brad

    brad Guest

    Mervyn,

    The errors reappeared so I proceeded with the instruction that you provided
    (renaming the dll, removing the COM3 key, etc. Now new errors are appearing:

    Directory Services log: Event ID 1126, 2087, 1168, 1913 appear, some of them
    repeated times and then events 1238 and 1168; then settles into a repeating
    pattern of events 1655 and 1126.

    Application log has event 1053 repeatedly.

    This domain controller seems to be developing serious issues. Would the
    safest course of action be to promote a new domain controller and then remove
    this one from the domain? Or would you suggest another approach?
    --
    bb


     
    brad, Feb 10, 2009
    #7
  8. brad

    brad Guest

    Mervyn,

    The errors started apperaing in the logs again so I followed hte procedure
    that you recommended (rename the .dll. delete the COM3 registry key, etc).
    Now we are getting new erros on the logs, as follows:

    Directory Services log: Event ID 1126, 2087, 1168, 1913 appear, some of them
    repeated times and then events 1238 and 1168; then settles into a repeating
    pattern of events 1655 and 1126

    Aplication log has event 1053 repeatedly.

    This domain controller seems to be developing serious issues. Would the
    safest course of action be to promote a new domain controller and then remove
    this one from the domain?
    --
    bb


     
    brad, Feb 10, 2009
    #8
  9. brad

    brad Guest

    Mervyn,

    The errors came back so I wen through the steps you recommended (rename the
    ..dll, delete the registry key, etc). Now we are getting new errors:

    Directory Services log: Event ID 1126, 2087, 1168, 1913 appear, some of them
    repeated times and then events 1238 and 1168; then settles into a repeating
    pattern of events 1655 and 1126

    Aplication log has event 1053 repeatedly.

    This domain controller seems to be developing serious issues and I don't
    want them to lead to corruption of Active Directory. Would the safest course
    of action be to promote a new domain controller on different hardware and
    then remove this one from the domain?
    --
    bb


     
    brad, Feb 10, 2009
    #9
  10. brad

    brad Guest

    I apologize for the multiple postings. I was getting errors saying the
    posting did not succeed so I tried again a couple of times.

    This issue is now resolved by going through the COM+ installation again and
    removing patch KB951748. Case closed, no need for response. Thanks to all for
    your input.
    --
    bb


     
    brad, Feb 11, 2009
    #10
  11. In
    Good to hear you got it fixed. I was going to suggest to possibly just
    demote the machine and promote a new one. Sometimes in such cases if you
    can't get to the bottom of it, and there are other DCs, it is easier and
    less time consuming to go this route, unless of course Exchange is on it,
    which complicates the procedure.

    Ace
     
    Ace Fekay [Microsoft Certified Trainer], Feb 12, 2009
    #11
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.