Event id 2042 /2041 (Directory service) + 12292/11 (VSS)

Tech-Archive recommends: Speed Up your PC by fixing your registry

Hi,

I am getting lots of event logs in all 3 domain controllers recently.

First of all in Directory service, I am getting these event id 2042 & 2041
as below:

{ Event Type: Error
Event Source: NTDS Replication
Event Category: Replication
Event ID: 2042
Date: 10/15/2008
Time: 10:18:30 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: DELLSERVER
Description:
It has been too long since this machine last replicated with the named
source machine. The time between replications with this source has exceeded
the tombstone lifetime. Replication has been stopped with this source.
The reason that replication is not allowed to continue is that the two
machine's views of deleted objects may now be different. The source machine
may still have copies of objects that have been deleted (and garbage
collected) on this machine. If they were allowed to replicate, the source
machine might return objects which have already been deleted.
Time of last successful replication:
2008-06-25 01:26:15
Invocation ID of source:
07b0f6c8-f6b8-07b0-0100-000000000000
Name of source:
382cdb4e-7b9c-4a33-a252-4c11bf6117e5._msdcs.kbgca.local
Tombstone lifetime (days):
60

The replication operation has failed.

User Action:

Determine which of the two machines was disconnected from the forest and is
now out of date. You have three options:

1. Demote or reinstall the machine(s) that were disconnected.
2. Use the "repadmin /removelingeringobjects" tool to remove inconsistent
deleted objects and then resume replication.
3. Resume replication. Inconsistent deleted objects may be introduced. You
can continue replication by using the following registry key. Once the
systems replicate once, it is recommended that you remove the key to
reinstate the protection.
Registry Key:
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication
With Divergent and Corrupt Partner


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.}


{Event Type: Information
Event Source: NTDS General
Event Category: Internal Processing
Event ID: 2041
Date: 10/15/2008
Time: 10:18:30 AM
User: N/A
Computer: DELLSERVER
Description:
Duplicate event log entries were suppressed.

See the previous event log entry for details. An entry is considered a
duplicate if the event code and all of its insertion parameters are
identical. The time period for this run of duplicates is from the time of the
previous event to the time of this event.

Event Code:
c00007fa
Number of duplicate entries:
3

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.}

Secondly I am unable to use Backup utility in all 3 domain contrlloers. Also
I can't take system state backup even with backup utility. I am getting the
same error message on all 3 domain controllers when I try to use backup
utility to backup anything:

{Backup Status
Operation: Backup
Active backup destination: File
Media name: "Volume 2 Backup.bkf created 10/15/2008 at 2:54 PM"

Volume shadow copy creation: Attempt 1.

Error returned while creating the volume shadow copy:0x8004230f.

Error returned while creating the volume shadow copy:8004230f
Aborting Backup.

----------------------

The operation did not successfully complete.}

Last, I am also getting these volume shadow copy event id : 12292, 11 on
all 3 domain controllers as below:

{Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 12292
Date: 10/15/2008
Time: 7:00:13 AM
User: N/A
Computer: DELLSERVER
Description:
Volume Shadow Copy Service error: Error creating the Shadow Copy Provider
COM class with CLSID {363948d2-035d-4d1d-9bfc-473fece07dab} [0x8007042d].

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2d 20 43 6f 64 65 3a 20 - Code:
0008: 43 4f 52 48 57 50 57 43 CORHWPWC
0010: 30 30 30 30 30 33 30 36 00000306
0018: 2d 20 43 61 6c 6c 3a 20 - Call:
0020: 43 4f 52 48 57 50 57 43 CORHWPWC
0028: 30 30 30 30 30 32 34 32 00000242
0030: 2d 20 50 49 44 3a 20 20 - PID:
0038: 30 30 30 30 34 34 38 30 00004480
0040: 2d 20 54 49 44 3a 20 20 - TID:
0048: 30 30 30 30 30 37 30 30 00000700
0050: 2d 20 43 4d 44 3a 20 20 - CMD:
0058: 43 3a 5c 57 49 4e 44 4f C:\WINDO
0060: 57 53 5c 53 79 73 74 65 WS\Syste
0068: 6d 33 32 5c 76 73 73 76 m32\vssv
0070: 63 2e 65 78 65 20 20 20 c.exe
0078: 2d 20 55 73 65 72 3a 20 - User:
0080: 4e 54 20 41 55 54 48 4f NT AUTHO
0088: 52 49 54 59 5c 53 59 53 RITY\SYS
0090: 54 45 4d 20 20 20 20 20 TEM
0098: 2d 20 53 69 64 3a 20 20 - Sid:
00a0: 53 2d 31 2d 35 2d 31 38 S-1-5-18}

{Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 11
Date: 10/15/2008
Time: 7:00:13 AM
User: N/A
Computer: DELLSERVER
Description:
Volume Shadow Copy Service information: The COM Server with CLSID
{363948d2-035d-4d1d-9bfc-473fece07dab} and name HWPRV cannot be started.
[0x8007042d]

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2d 20 43 6f 64 65 3a 20 - Code:
0008: 43 4f 52 48 57 50 57 43 CORHWPWC
0010: 30 30 30 30 30 32 39 38 00000298
0018: 2d 20 43 61 6c 6c 3a 20 - Call:
0020: 43 4f 52 48 57 50 57 43 CORHWPWC
0028: 30 30 30 30 30 32 34 32 00000242
0030: 2d 20 50 49 44 3a 20 20 - PID:
0038: 30 30 30 30 34 34 38 30 00004480
0040: 2d 20 54 49 44 3a 20 20 - TID:
0048: 30 30 30 30 30 37 30 30 00000700
0050: 2d 20 43 4d 44 3a 20 20 - CMD:
0058: 43 3a 5c 57 49 4e 44 4f C:\WINDO
0060: 57 53 5c 53 79 73 74 65 WS\Syste
0068: 6d 33 32 5c 76 73 73 76 m32\vssv
0070: 63 2e 65 78 65 20 20 20 c.exe
0078: 2d 20 55 73 65 72 3a 20 - User:
0080: 4e 54 20 41 55 54 48 4f NT AUTHO
0088: 52 49 54 59 5c 53 59 53 RITY\SYS
0090: 54 45 4d 20 20 20 20 20 TEM
0098: 2d 20 53 69 64 3a 20 20 - Sid:
00a0: 53 2d 31 2d 35 2d 31 38 S-1-5-1}

Sorry for the long post as I wanted to give every information so that
someone can help me.

I really appreciate any reply. Thanks in advance.

With best regards,
Hemal
.

Relevant Pages

  • Re: Event id 2042 /2041 (Directory service) + 12292/11 (VSS)
    ... I would start with the dc with the FSMO role holder of the PDCe ... created by loss of replication. ... Secondly I am unable to use Backup utility in all 3 domain ... Error returned while creating the volume shadow copy:0x8004230f. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Event id 2042 /2041 (Directory service) + 12292/11 (VSS)
    ... on all DC's except FSMO role holder and then promote one DC. ... take system state backup or even any file backup using it. ... Error returned while creating the volume shadow copy:0x8004230f. ... created by loss of replication. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Event id 2042 /2041 (Directory service) + 12292/11 (VSS)
    ... I am getting lots of event logs in all 3 domain controllers recently. ... Event Source: NTDS Replication ... Secondly I am unable to use Backup utility in all 3 domain contrlloers. ... Error returned while creating the volume shadow copy:0x8004230f. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Event id 2042 /2041 (Directory service) + 12292/11 (VSS)
    ... Replication has been stopped with this source. ... machine's views of deleted objects may now be different. ... Secondly I am unable to use Backup utility in all 3 domain ... Error returned while creating the volume shadow copy:0x8004230f. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Event id 2042 /2041 (Directory service) + 12292/11 (VSS)
    ... Replication has been stopped with this source. ... machine's views of deleted objects may now be different. ... Secondly I am unable to use Backup utility in all 3 domain ... Error returned while creating the volume shadow copy:0x8004230f. ...
    (microsoft.public.windows.server.active_directory)