RE: Event ID: 1104

Just plain crazy!

I used msconfig to disable everything like you suggested and the issue went
away, so I added everything back a couple at a time, knowing I'd have to
troubleshoot two items if the issue returned but it cut my time in half.

Well I got down to the last item on the list, re-enabled it and the issue
still didn't come back!?

Something must have been causing a conflict in writing a registry setting or
file somewhere and turning everything off gave it time to do what it needed
to do.

I did suspected Sonic's DLA, which was the last thing I added back, but it
didn't appear to be the calprit. Just to be safe I removed it anyways.

Thanks for the help.

Dave

"Robert Li [MSFT]" wrote:

Hello,

Thanks for posting in our newsgroup.

From your description, I know that your client gets Event ID: 1104 on his
workstation. If I am off-base, please don't hesitate to let me know.

Please take me the following steps to narrow down this problem:

Step 1: Please check if the other workstations have Event ID: 1104. If not,
this is only a client side issue.

Step 2: Please ask the problematic user logon a good workstation, will the
same issue reoccur?

Step 3: This issue may be caused by some third-party software, therefore,
please boot the system into Clean Boot environment for a test.

1. Click Start, click Run, type "msconfig" (without the quotation marks) in
the Open box, and then click OK.
2. In the Startup tab, click the "Disable All" button.
3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button.
4. Click OK and restart your computer.

Step 4: Meanwhile, we also noticed similar issues which is caused by the
offload checksum of the NIC on the client workstation.

So, if the issue still persists, you can open the properties of the NIC on
the client workstation, click Configure button, in the Advanced button, set
the value of offload checksum to Disable. After that, check if the issue is
resolved.

If the issue still occurs, please help me to collect some information on
the problematic workstation, and I will then perform further research on
this issue.

1. Userenv Log.

a. On the machine, use Registry Editor to add the following registry value
(or modify it, if the value already exists):
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
Value: UserEnvDebugLevel
Value Type: REG_DWORD
Value Data: 10002 (Hexadecimal)

b. Restart the machine, make sure the issue is reproduced. It is better to
delete the userenv.log file if it exists before restarting the computer.

c. The log file is written to the %Systemroot%\Debug\UserMode\Userenv.log
file. Please send the file to me.

Note: To disable logging, change the registry value to 0.

For more information please refer to the following KB article.
How to Enable User Environment Event Logging:
http://support.microsoft.com/?id=221833

2. MPS Report.

a. Download MPSReport tool from below URL:
<http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd
915706/MPSRPT_NETWORK.EXE>

b. Execute the tool on the computer, and if you are prompted "Include the
MSINFO32 report?", please type Y.
c. Please send the result file (CAB file) to me.

Please send the information to v-robeli@xxxxxxxxxxxxx with subject:
39709408-Event ID: 1104.

If anything is unclear or you have any concerns, please feel free to post
back. I am glad to be of assistance.

Best regards,

Robert Li(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================

This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
<Thread-Topic: Event ID: 1104
<thread-index: Ace3e9zVUfIpTN3IT26A7o59B6Z2uw==
<X-WBNR-Posting-Host: 207.46.192.207
<From: =?Utf-8?B?RGF2ZWluZmxh?= <Daveinfla@xxxxxxxxxxxxxxxxxxxxxxxxx>
<Subject: Event ID: 1104
<Date: Mon, 25 Jun 2007 15:55:01 -0700
<Lines: 54
<Message-ID: <75D5B31C-B7EA-4873-8845-2F054FCC8E0C@xxxxxxxxxxxxx>
<MIME-Version: 1.0
<Content-Type: text/plain;
< charset="Utf-8"
<Content-Transfer-Encoding: 7bit
<X-Newsreader: Microsoft CDO for Windows 2000
<Content-Class: urn:content-classes:message
<Importance: normal
<Priority: normal
<X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2826
<Newsgroups: microsoft.public.windows.server.sbs
<Path: TK2MSFTNGHUB02.phx.gbl
<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:46201
<NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
<X-Tomcat-NG: microsoft.public.windows.server.sbs
<
<
<My client is running SBS 2003 w/SP2 applied.
<
<One of the client desktops, running Windows XP w/SP2, was experiencing
<issues with Outlook hanging/pausing excessively when opening messages and
<creating new e-mail messages. The following errors were noted in the event
<log but since the desktop had a previous spyware/virus issue we decided to
<reload it from scratch, thinking the errors were left over from the
infection.
<
<After a fresh install of Windows XP Pro w/SP2 (the drive was formatted),
the
<desktop is still generating the same errors.
<
<We applied the hotfix described in the following article but it did not
<correct the issue.
<
<http://support.microsoft.com/default.aspx/kb/935512/en-us
<
<Your assistance is greatly appreciated, the errors follow:
<
<
<Windows cannot perform filter check for Group Policy object
<CN={240DD185-3ACE-4D7A-A64F-6C6F97198A13},CN=Policies,CN=System,DC=Law,DC=l
ocal.
<The associated filter cannot be found. This Group Policy Object will be
<skipped.
<
<Windows cannot perform filter check for Group Policy object
<CN={7A8E35BE-7006-4BCC-A388-403E305234DA},CN=Policies,CN=System,DC=Law,DC=l
ocal.
<The associated filter cannot be found. This Group Policy Object will be
<skipped.
<
<Windows cannot perform filter check for Group Policy object
<CN={D1A524CE-7D73-4468-BEDF-3A44E308E345},CN=Policies,CN=System,DC=Law,DC=l
ocal.
<The associated filter cannot be found. This Group Policy Object will be
<skipped.
<
<Windows cannot perform filter check for Group Policy object
<CN={240DD185-3ACE-4D7A-A64F-6C6F97198A13},CN=Policies,CN=System,DC=Law,DC=l
ocal.
<The associated filter cannot be found. This Group Policy Object will be
<skipped.
<
<Windows cannot perform filter check for Group Policy object
<CN={7A8E35BE-7006-4BCC-A388-403E305234DA},CN=Policies,CN=System,DC=Law,DC=l
ocal.
<The associated filter cannot be found. This Group Policy Object will be
<skipped.
<
<Windows cannot perform filter check for Group Policy object
<CN={D1A524CE-7D73-4468-BEDF-3A44E308E345},CN=Policies,CN=System,DC=Law,DC=l
ocal.
<The associated filter cannot be found. This Group Policy Object will be
<skipped.
<
<
<
<
<
<


.