General discussion

Locked

Ed Bott's Microsoft Challenge--8/31/00

By ebott ·
A Windows 2000 network admin is baffled by an overload of Event Viewer errors. Can you help? The errors appear several times a day in the Application Log and always take the following format:

Source:Userenv
Event ID: 1000
User: NT AUTHORITY/SYSTEM
Description: Windows cannot determine the user or computer name. Return value (1722).

The system in question is properly joined to its domain and has no problem accessing shared network resources. He can't find any sign of this error in the Knowledge Base. I'll give special preference to anyone who can provide links to comprehensive resources that he can use to decode other Event Viewer messages.

This conversation is currently closed to new comments.

27 total posts (Page 1 of 3)   01 | 02 | 03   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by jaystar In reply to Ed Bott's Microsoft Chall ...

Dear ED,
The following article was posted on TechNet May 16th, 2000
http://support.microsoft.com/support/kb/articles/Q261/0/07.ASP

I found it by searching for the return code in the text.

From searching the TechNet site, it appears WIndows 2000 maps multiple errors to the 1000 event ID code. If this is the practice for other event codes, it maybe impracticle to try to generate a list of event codes to solutions w/o including descriptions with each event code.

My links follow:
http://www.technet.com
http://www.microsoft.com/technet

Good luck,
Jay

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by ebott In reply to Ed Bott's Microsoft Chall ...

The question was auto-closed by TechRepublic

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by ejsotillo In reply to Ed Bott's Microsoft Chall ...

I would go straight to good old Dr. Watson (drwtsn32.exe) to get a little more inside info pertaining to the problem, from there take it to technet knowledge base or online knowledge base at microsoft.

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by ebott In reply to Ed Bott's Microsoft Chall ...

The question was auto-closed by TechRepublic

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by jessed In reply to Ed Bott's Microsoft Chall ...

Hmmm, tough one. I'd venture to say that if network browsing/domain and resource access isn't a problem, then an unreachable DNS host isn't the cause (as is thought by some), but, worth checking just to be sure. Perhaps some app that creates user accounts (such as IIS) was installed and then removed; the user accounts were deleted, but for some reason, they stuck in the registry somewhere. If Win2K were trying to audit the registry with the SAM, it may be the source of the entry.

Try this, provided by JSI Inc.:
To find the problem:
1. I navigated to HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\GPExtension\{827...} and Added Value name ExtensionDebugLevel as a type REG_DWORD, setting it to 2. This turned on logging for Winlogon.

2. At a CMD prompt, I typed:

secedit /refreshpolicy machine_policy /enforce to create %SystemRoot%\Security\logs\Winlogon.log.

http://www.jsiinc.com is by far the best resource I've come across for event log type troubleshooting, actually providing answers a lot of time

-jd

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by ebott In reply to Ed Bott's Microsoft Chall ...

The question was auto-closed by TechRepublic

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by JackieB In reply to Ed Bott's Microsoft Chall ...

I did a little looking around for an answer to your question and the only thing I found quickly was this web site:
http://www.globetrotting.com/winnt/eventviewer.htm

It references using the NT resource kit to look up the error code. I loked at MS Support web site and the 1722 code listed there refers to an issue concerning server access. Perhaps another user (jessed) was on the right track when he mentioned that it could be a dns issue. Perhaps the dns is becoming unavailable at times, generating this error. This could be due to the network link to the server being too busy due to user loading resulting in an occasional inability to get a response from the dns. I know, everyone blames the network, but thats what I do for a living, andsometimes odd problems like this can be caused by network congestion, probably on the link to the server. Hope this helps. Jackie

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by ebott In reply to Ed Bott's Microsoft Chall ...

The question was auto-closed by TechRepublic

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by chris ham In reply to Ed Bott's Microsoft Chall ...

I had this error message for some of my client. When I set up first, I didn't have any problem, but after user start using it the error message start show up. One difference I have is that it also show error message of "no netlogon server available or net path can not be reached" and log on using local cache. But after that user is joined to the domain and all the shared network resources are available to the user. The cause of the problem was some incompatbility problem with windows 2000, motherboard & NIC card. After I changed the NIC to another brand, I never so the error again.

Collapse -

Ed Bott's Microsoft Challenge--8/31/00

by ebott In reply to Ed Bott's Microsoft Chall ...

The question was auto-closed by TechRepublic

Back to Windows Forum
27 total posts (Page 1 of 3)   01 | 02 | 03   Next

Operating Systems Forums