Event ID 1006 — Resource Exhaustion Detector

Event ID 1006 — Resource Exhaustion Detector

Updated: January 8, 2009

Applies To: Windows Server 2008 R2

The Resource Exhaustion Detector component of Windows Resource Exhaustion Detection and Resolution (RADAR) identifies the top three consumers of commited memory and warns you when the system commit charge reaches a critical level.

Event Details

Product: Windows Operating System
ID: 1006
Source: Microsoft-Windows-Resource-Exhaustion-Detector
Version: 6.1
Symbolic Name: RDR_DET_STOP_FAIL_EVENT
Message: The Windows Resource Exhaustion Detector failed to stop due to an error.

Resolve
Start the Diagnostic Policy service

The Diagnostic Policy service provides support for Resource Exhaustion Detection and Resolution (RADAR).

Start the Diagnostic Policy service

To start the Diagnostic Policy service:

  1. Click Start, click in the Start Search box, type services.msc, and then press ENTER. Microsoft Management Console will open with the Services (Local) snap-in open.
  2. In the list of services, right-click Diagnostic Policy Service, and then click Start.

If the Diagnostic Policy service is not configured to start automatically, you will encounter the same error the next time you restart the system.

Configure the Diagnostic Policy service to start automatically

To configure the Diagnostic Policy service to start automatically:

  1. Click Start, click in the Start Search box, type services.msc, and then press ENTER. Microsoft Management Console will open with the Services (Local) snap-in open.
  2. In the list of services, right-click Diagnostic Policy Service, and then click Properties.
  3. In the Startup type drop-down list, click Automatic, and then click OK.

Verify

To verify that the Resource Exhaustion Detector is running:

  1. Click Start, expand All Programs, and expand Accessories.
  2. Right-click Command Prompt, and then click Run as administrator.
  3. At the command prompt, type sc queryex dps, press ENTER, and review the results to ensure that the Diagnostic Policy service and the Windows Diagnostic Infrastructure (WDI) service are running.
  4. At the command prompt, type tasklist /m radardt.dll, press ENTER, and review the results to ensure that Radardt.dll is loaded.

Note: The file Radardt.dll is not loaded until approximately ten minutes after the Diagnostic Policy service starts. It may not appear to be enabled if you check the system status immediately after a restart.

Related Management Information

Resource Exhaustion Detector

Reliability Infrastructure

Related:

Event ID 1006 — Group Policy Preprocessing (Active Directory)

Event ID 1006 — Group Policy Preprocessing (Active Directory)

Updated: September 21, 2007

Applies To: Windows Server 2008

Group Policy processing requires Active Directory. The Group Policy service reads and updates information stored in Active Directory. The absence of Active Directory (or a domain controller) prevents Group Policy from applying to the computer or user.

Event Details

Product: Windows Operating System
ID: 1006
Source: Microsoft-Windows-GroupPolicy
Version: 6.0
Symbolic Name: gpEvent_FAILED_DS_BIND
Message: The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the Details tab for error code and description.

Resolve
Correct binding to the directory

The Group Policy service logs the error code. This information appears on the Details tab of the error message in Event Viewer. The error code (displayed as a decimal) and error description fields further identify the reason for the failure. Evaluate the error code with the list below:

  • Error code 5
  • Error code 49
  • Error code 258

Error code 5 (Access is denied)

This error code might indicate that the user does not have permisson to Active Directory.

To correct permisssions for accessing Active Directory: 

Error code 49 (Invalid credentials)

This error code might indicate that the user’s password expired while the user is still logged on the computer.

To correct invalid credentials: 

  1. Change the user’s password.
  2. Lock/unlock the workstation.
  3. Check if there are any system services running as the user account.
  4. Verify the password in service configuration is correct for the user account.

Error code is 258 (Timeout)

This error code might indicate that the DNS configuration is incorrect.

To correct timeout issues:

  1. Use the nslookup tool to confirm _ldap._tcp.<domain-dns-name> records are registered and point to correct servers (where domain-dns-name is the fully qualified domain name of your Active Directory domain).
  2. Use Active Directory troubleshooting procedures to further diagnose the problem (http://go.microsoft.com/fwlink/?LinkId=92707).

Note: These steps may have varying results if your network constrains or blocks ICMP packets.

Verify

Group Policy applies during computer startup and user logon. Afterward, Group Policy applies every 90 to 120 minutes. Events appearing in the event log may not reflect the most current state of Group Policy. Therefore, you should always refresh Group Policy to determine if Group Policy is working correctly.

To refresh Group Policy on a specific computer:

  1. Open the Start menu. Click All Programs and then click Accessories.
  2. Click Command Prompt.
  3. In the command prompt window, type gpupdate and then press ENTER.
  4. When the gpupdate command completes, open the Event Viewer.

Group Policy is working correctly if the last Group Policy event to appear in the System event log has one of the following event IDs:

  • 1500
  • 1501
  • 1502
  • 1503

Related Management Information

Group Policy Preprocessing (Active Directory)

Group Policy Infrastructure

Related:

An attempt to open the requested database failed.

Details
Product: SQL Server Notification Services
Event ID: 1006
Source: NotificationServices
Version: 2.0.9999.9
Message: An attempt to open the requested database failed.
   
Explanation
This error maps to SQL Server error 4060, which indicates that the current user does not have permissions to log in to the specified database.

The event log entry for this error includes the description of the SQL Server error that caused it, which looks similar to the following:

Cannot open database requested in login ‘<database_name>’. Login fails.</database_name>

   
User Action
Check that the account used by Notification Services has login permissions on the database noted in the error message.

Related:

Process %1 (PID=%2). %3 operation has failed for %4 to %5. Exception message: %6 Current file synchronization operation is aborted.

Details
Product: Exchange
Event ID: 1006
Source: MSExchangeFDS
Version: 8.0
Symbolic Name: IOOperationFailedTwoArguments
Message: Process %1 (PID=%2). %3 operation has failed for %4 to %5. Exception message: %6 Current file synchronization operation is aborted.
   
Explanation

This Warning event indicates that Microsoft® Exchange File Distribution service (MSExchangeFDS) did not finish a copy, replace or move file operation when it performed a file synchronization task. The MSExchangeFDS is used to distribute offline address books and custom Unified Messaging prompts. This event may occur for of various reasons.

   
User Action

To determine the root cause of this Warning event, follow these steps:

  1. Use the following Exchange Management Shell cmdlet to increase the diagnostic logging level on the FileReplication counter of the MSExchangeFDS performance object to the High setting:

    1. Set-EventLogLevel MSExchangeFDS\FileReplication -Level High

      Note   For detailed information about increasing logging, see How to Change Logging Levels for Exchange Processes.

  2. Review other related Error and Warning events in the Application log. These related events may help you determine the root cause of this error.

  3. Use the following Exchange Management Shell cmdlet to set the diagnostic logging level on the FileReplication counter of the MSExchangeFDS performance object back to the default Lowest setting:

    1. Set-EventLogLevel MSExchangeFDS\FileReplication -Level Lowest

      Important   After you have completed troubleshooting this issue, you should always return logging to the default level to avoid filling your event logs.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related:

: Failed to perform the resource control function ”.

Details
Product: Exchange
Event ID: 1006
Source: MSExchangeCluster
Version: 6.5.6940.0
Component: Microsoft Exchange Cluster Service
Message: <resource name>: Failed to perform the resource control function ‘<code>‘.
   
Explanation

This event can occur under a variety of conditions. It basically indicates that the Cluster service failed when attempting to control the named resource.

  • The Active Directory Connections object is missing from Active Directory.
  • Duplicate computer name in Active Directory.
   
User Action
  • Use ADSIEDIT to create the Active Directory Connections object or use SETUP/FORESTPREP (if this is a mixed mode environment).
  • Make sure that the network name resource that was created does not conflict with a computer name in the domain.

Related:

Your computer was unable to automatically configure the IP parameters for the Network Card with the network address %1. The following error occurred during configuration: %2.

Details
Product: Windows Operating System
Event ID: 1006
Source: DHCP
Version: 5.2
Symbolic Name: EVENT_IPAUTOCONFIGURATION_FAILED
Message: Your computer was unable to automatically configure the IP parameters for
the Network Card with the network address %1. The following error occurred
during configuration: %2.
   
Explanation

The computer could not configure its IP address automatically.

Possible causes include:

  • The Windows Sockets registry subkeys might be corrupted.
  • A third-party program is using Windows Ssockets and the ipconfig, release, and renew commands.
   
User Action

If this problem is caused by a third-party program, remove the program.

If the Windows Sockets registry subkeys are corrupted, do one of the following:

To re-create the winsock and winsock2 registry keys

  • At the command prompt, typenetsh int ip reset resetlog.txt

To reinstall the winsock registry subkeys

  1. Uninstall the TCP/IP protocol.Caution:Do not restart the computer now.
  2. Delete the following registry keys:[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock
  3. Restart the computer.
  4. Reinstall the TCP/IP protocol.
  5. For more information about repairing the Windows Sockets registry subkeys, see article 817571 in the Microsoft Knowledge Base.

Related:

The default profile was used for user %1.

Details
Product: Windows Operating System
Event ID: 1006
Source: Winlogon
Version: 5.0
Component: Application Event Log
Symbolic Name: EVENT_DEFAULT_PROFILE_USED
Message: The default profile was used for user %1.
   
Explanation

This event record indicates that the user was assigned the system default profile.

Related:

%1: Failed to perform the resource control function ‘%2’.

Details
Product: Exchange
Event ID: 1006
Source: MSExchangeCluster
Version: 6.5.0000.0
Message: %1: Failed to perform the resource control function ‘%2’.
   
Explanation
This event can occur under a variety of conditions. It basically indicates that the Cluster Service failed when attempting to control the named resource.

  • The Active Directory Connections object is missing from the AD.
  • Duplicate computer name in AD.
   
User Action
  • Use ADSIEDIT to create the Active Directory Connections object or use

    SETUP/FORESTPREP (if this is a mixed mode environment).

  • Make sure that the network name resource that was created does not

    conflict with a computer name in the domain.

Related:

An interoperability error occurred. Association error with entity {object name}, invalid message in chunking/segmentation. The message has not negotiated a proper chunking/segmentation size. Control Block Index: {index name}. Contact Microsoft Technical Support. [{value}{value}{value}{value}] (14)

Details
Product: Exchange
Event ID: 1006
Source: MSExchangeMTA
Version: 6.0
Component: Message Transfer Agent
Symbolic Name: MTA01006
Message: An interoperability error occurred. Association error with entity {object name}, invalid message in chunking/segmentation. The message has not negotiated a proper chunking/segmentation size. Control Block Index: {index name}. Contact Microsoft Technical Support. [{value}{value}{value}{value}] (14)
   
Explanation
The diagnostics logging levels of the message transfer agent (MTA) interface and interoperability categories should be increased to create interoperability logs.These logs are text logs that consist of the binary contents of communication among MTAs in different sites and between MTA and client applications within a site. They are stored in the \Exchsrvr\Mtadata directory. The current log is always named Bf0.log. Prior logs are named Bfx.log, where x increases as the age of the log increases.
   
User Action
To help Microsoft Product Support Services track down the problem, create log files. For more information, see Knowledge Base articles Q163032 and Q168906. To create Ap*.log files, in the Diagnostics Logging tab of the Server Properties dialog box, select MSExchangeMTA and set the logging level of the Interoperability and Interface categories to Maximum. To create Bf*.log files, set the logging level of the APDU and X.400 Service categories to Maximum.Save all MTA log files (Mtadata\*.log), Event Viewer output, and database files. Contact Microsoft Product Support Services.You can enable text event log files (Ev*.log) by modifying the Registry. Contact Microsoft Product Support Services for assistance.

Related:

The EdgeSync credential %1 was not updated in the Active Directory Application Mode (ADAM) directory service. The exception is %2. Verify that ADAM is running.

Details
Product: Exchange
Event ID: 1006
Source: MSExchange Message Security
Version: 8.0
Symbolic Name: CredentialsRenewalFailure
Message: The EdgeSync credential %1 was not updated in the Active Directory Application Mode (ADAM) directory service. The exception is %2. Verify that ADAM is running.
   
Explanation

This Error event indicates that renewal of the EdgeSync replication account (ESRA) has failed for the specified server with the noted transient exception. The ESRA is used by a Hub Transport server to authenticate to the Edge Transport server in order to replicate Active Directory directory service data to the Active Directory Application Mode (ADAM) directory service by using the Microsoft Exchange EdgeSync service. To comply with password policies, these credentials must be renewed periodically. Each Hub Transport server uses a unique set of credentials during the EdgeSync process.

   
User Action

To resolve this error, do the following:

  • Because this is a transient exception, no action is required. If you receive this error message frequently, you should remove the Edge Subscription from the Exchange organization by using the Remove-EdgeSubscription cmdlet in the Exchange Management Shell on a Hub Transport server. After you have removed the Edge Subscription from the Exchange organization, use the New-EdgeSubscription cmdlet to resubscribe the Edge Transport server.

  • Verify that the Microsoft Exchange server that logged this event can communicate with one or more Active Directory servers available in the organization.

  • Review other related Error and Warning events in the Application log. These related events may help you find the root cause of this error.

  • If the recommended steps do not resolve this error, contact Microsoft Customer Support Services. For more information about how to contact support, visit the Microsoft Help and Support Web site.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related: