Event ID 1005 — Subsystem for UNIX-based Applications Functionality

Event ID 1005 — Subsystem for UNIX-based Applications Functionality

Updated: November 14, 2007

Applies To: Windows Server 2008

Subsystem for UNIX-based Applications (SUA) Functionality is a measure of how the SUA send-and-receive utility, Psxss.exe, is functioning. When Psxss.exe is operating normally, SUA is able to accept user commands, and port applications over to Windows-based operating systems from UNIX-based operating systems.

Event Details

Product: Windows Subsystem for UNIX-based Applications
ID: 1005
Source: Microsoft-Windows-SUA-Psxss
Version: 6.0
Symbolic Name: PSX_FATAL_RID_EXCEEDED
Message: PSXSS has encountered a user or group ID with a value too large to convert to a uid_t, and converted it to a reserved UID value. See Knowledge Base article Q306552 for more information. The internal UID is 0x%1%2.

Resolve
Check the POSIX offset for the affected domain/user

Unique UID mapping failed, and the current user cannot use Subsystem for UNIX-based Applications until the issue is resolved. An internal error related to PSX offset occurred.

Refer to Knowledge Base article Q306552 at http://support.microsoft.com/default.aspx?scid=kb;EN-US;306552 for more information about the root cause of the error and recovery procedures. If the problem persists, contact Product Support Services for assistance.

Verify

Verify that the Subsystem for UNIX-based Applications (SUA) Psxss.exe utility is functioning, first by viewing Psxss.exe in the Windows Task Manager, and then by using an SUA application that you have developed or are porting to Windows to transmit data over the network.

To verify that Psxss.exe is running:

  1. Open Windows Task Manager by pressing CTRL+ALT+DEL, and then clicking Task Manager.
  2. On the Processes tab, select the Show processes from all users check box.
  3. Verify that PSXSS.exe is running.

Next, use an application on which you are working in SUA, or that you are porting to Windows by using SUA, to send some data over the network. For example, attempt to use your application to modify files or documents in another location on the network. If PSXSS.exe is functioning properly, and is active in the list of processes in Task Manager, sending SUA application data over the network should succeed.

Related Management Information

Subsystem for UNIX-based Applications Functionality

Subsystem for UNIX-based Applications

Related:

Event ID 1005 — DHCP Server Communication

Event ID 1005 — DHCP Server Communication

Updated: December 11, 2007

Applies To: Windows Server 2008

For proper network communication between the Dynamic Host Configuration Protocol (DHCP) server and other network services, such as Active Directory Domain Services and Winsock, the DHCP server must have a working network connection.

Event Details

Product: Windows Operating System
ID: 1005
Source: Microsoft-Windows-DHCP-Server
Version: 6.0
Symbolic Name: EVENT_SERVER_INIT_WINSOCK_FAILED
Message: The DHCP service failed to initialize Winsock startup. The following error occurred: %1

Resolve
Identify and fix any network connectivity problems

To resolve this issue, identify and fix any network connectivity problems between the‚  DHCP server and domain controller by doing the following:

  • Determine if there is a network connectivity problem by using the ping command.
  • Perform additional troubleshooting steps, if necessary, to help identify the cause of the problem.

To perform these tasks, refer to the following sections.

Note: The following procedures include steps for using the ping command to perform troubleshooting. Therefore, before performing these steps, check whether the firewall or Internet Protocol security (IPsec) settings on your network allow Internet Control Message Protocol (ICMP) traffic. ICMP is the TCP/IP protocol that is used by the ping command.

To perform these procedures, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

Determine if there is a network connectivity problem

To determine if there is a network connectivity problem between the‚  DHCP‚  server and domain controller:

  1. At the DHCP server, click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type ping server_FQDN, where server_FQDN is the fully qualified domain name (FQDN) of the domain controller (for example, server1.contoso.com), and then press ENTER.

If the ping was successful, you will receive a reply similar to the following:

Reply from IP_address: bytes=32 time=3ms TTL=59

Reply from IP_address: bytes=32 time=20ms TTL=59

Reply from IP_address: bytes=32 time=3ms TTL=59

Reply from IP_address: bytes=32 time=6ms TTL=59

  1. At the command prompt, type ping IP_address, where IP_address is the IP address of the domain controller, and then press ENTER.

If you can successfully ping the domain controller by IP address, but not by FQDN, this indicates a possible issue with DNS host name resolution.

If you cannot successfully ping the domain controller by IP address, this indicates a possible issue with network connectivity, firewall configuration, or IPsec configuration.

Perform additional troubleshooting steps

The following are some additional troubleshooting steps that you can perform to help identify the root cause of the problem:

  • Ping other computers on the network to help determine the extent of the network connectivity issue.
  • If you can ping other servers but not the domain controller, try to ping the domain controller from another computer. If you cannot ping the domain controller from any computer, first ensure that the domain controller is running. If the domain controller is running, check the network settings on the domain controller.
  • Check the TCP/IP settings on the local computer by doing the following:
  1. Click Start, click Run, type cmd, and then click OK.
  2. At the command prompt, type ipconfig /all, and then press ENTER. Make sure that the information listed is correct.
  3. Type ping localhost to verify that TCP/IP is installed and correctly configured on the local computer. If the ping is unsuccessful, this may indicate a corrupt TCP/IP stack or a problem with your network adapter.
  4. Type ping IP_address, where IP_address is the IP address assigned to the computer. If you can ping the localhost address but not the local address, there may be an issue with the routing table or with the network adapter driver.
  5. Type ping DNS_server, where DNS_server is the IP address assigned to the DNS server. If there is more than one DNS server on your network, you should ping each one. If you cannot ping the DNS servers, this indicates a potential problem with the DNS servers, or with the network between the computer and the DNS servers.
  6. If the domain controller is on a different subnet, try to ping the default gateway. If you cannot ping the default gateway, this might indicate a problem with the network adapter, the router or gateway device, cabling, or other connectivity hardware.
  • In Device Manager, check the status of the network adapter. To open Device Manager, click Start, click Run, type devmgmt.msc, and then click OK.
  • Check network connectivity indicator lights on the computer and at the hub or router. Check network cabling.
  • Check firewall settings by using the Windows Firewall with Advanced Security snap-in.
  • Check IPsec settings by using the IP Security Policy Management snap-in.

Verify

To verify that clients are getting leased addresses from the DHCP server:

  1. At the DHCP-enabled client computer, click Start, click Run, and then type cmd.
  2. To verify the lease of the client with a DHCP server, type ipconfig /all to view lease-status information.
  3. If the client has a validly leased IP address, the ipconfig /all command displays a date and time for Lease Obtained and Lease Expires.

Related Management Information

DHCP Server Communication

DHCP Infrastructure

Related:

Event ID 1005 — Memory Leak Diagnoser

Event ID 1005 — Memory Leak Diagnoser

Updated: January 8, 2009

Applies To: Windows Server 2008 R2

In Windows Vista, the Memory Leak Diagnoser component of Windows Resource Exhaustion Detection and Resolution (RADAR) provides information about applications that are diagnosed as having memory leaks. You must review these applications to determine if their linear increase in memory usage represents a true memory leak or if it is expected behavior.

The Memory Leak Diagnoser will not run on:

  • Services or applications that run in Protected Mode. If an application uses protected memory space, it cannot be monitored by the Memory Leak Diagnoser.
  • Services or applications that run in Elevated Mode. If an application runs with elevated privileges, the Memory Leak Diagnoser will not have sufficient permissions to monitor it.
  • Services or applications that cannot be shut down cleanly. If an application is in an unresponsive state or cannot process a request to close, the Memory Leak Diagnoser cannot take corrective action.
  • Versions of Microsoft Windows other than Windows Vista.

Event Details

Product: Windows Operating System
ID: 1005
Source: Microsoft-Windows-Resource-Leak-Diagnostic
Version: 6.1
Symbolic Name: RDR_LEAK_DIAG_START_EVENT_FAILED
Message: Windows failed to initiate memory leak diagnostics on %1.

Resolve
Start the Diagnostic Policy service and enable Memory Leak Diagnosis

The Diagnostic Policy service provides support for the Memory Leak Diagnoser. In addition, local Group Policy configuration can be used to enable or disable memory leak diagnosis.

Start the Diagnostic Policy service

To start the Diagnostic Policy service:

  1. Click Start, click in the Start Search box, type services.msc, and then press ENTER. Microsoft Management Console (MMC) will open with the Services (Local) snap-in open.
  2. In the list of services, right-click Diagnostic Policy Service, and then click Start.

If the Diagnostic Policy service is not configured to start automatically, you will encounter the same error the next time you restart the system.

Configure the Diagnostic Policy service to start automatically

To configure the Diagnostic Policy service to start automatically:

  1. Click Start, click in the Start Search box, type services.msc, and then press ENTER. MMC will open with the Services (Local) snap-in open.
  2. In the list of services, right-click Diagnostic Policy Service, and then click Properties.
  3. Select Automatic from the Startup type drop-down list, and then click OK.

Enable Memory Leak Diagnosis

To enable the Memory Leak Diagnosis:

  1. Click Start, click in the Start Search box, type gpedit.msc, and then press ENTER. MMC will start with the Local Group Policy Editor open.
  2. In the navigation tree, expand Computer Configuration, expand Administrative Templates, expand System, expand Troubleshooting and Diagnostics, and click Windows Memory Leak Diagnosis.
  3. In the console pane, right-click Configure Scenario Execution Level, and then click Properties.
  4. On the Setting tab, click Enabled, and then click OK.

Verify

The Diagnostic Policy service provides support for Resource Exhaustion Detection and Resolution (RADAR). In addition, Group Policy settings control whether the Memory Leak Diagnoser is active on the system.

Verify that the Diagnostic Policy service is running

To verfy that the Diagnostic Policy service is running:

  1. Click Start, click in the Start Search box, type services.msc, and then press ENTER. Microsoft Management Console (MMC) will open with the Services (Local) snap-in open.
  2. In the list of services, verify that the Diagnostic Policy Service status is Started.

Verify that the Memory Leak Diagnoser is running

To verify that the Memory Leak Diagnoser is running:

  1. Click Start, click in the Start Search box, type gpedit.msc, and then press ENTER. Microsoft Management Console will start with the Local Group Policy snap-in open.
  2. In the navigation tree, expand Computer Configuration, expand Administrative Templates, expand System, expand Troubleshooting and Diagnostics, and double-click Windows Memory Leak Diagnosis.
  3. In the console pane, right-click Configure Scenario Execution Level, and then click Properties.
  4. On the Setting tab, verify that Enabled is selected.

Related Management Information

Memory Leak Diagnoser

Reliability Infrastructure

Related:

Windows cannot connect to %1 domain. (%2). Group Policy processing aborted.

Details
Product: Windows Operating System
Event ID: 1005
Source: Userenv
Version: 5.2
Symbolic Name: EVENT_FAILED_DS_CONNECT
Message: Windows cannot connect to %1 domain. (%2). Group Policy processing aborted.
   
Explanation

A network connectivity or network configuration problem is preventing Group Policy settings from being applied. Group Policy processing for the computer or user has failed and will continue to fail until this error is resolved.

   
User Action

To troubleshoot this problem, try one or all of the following:

  • Review the event description to obtain additional details regarding why the machine has an account problem.
  • In the Event Viewer, click System, and then look for any networking-related messages, such as Netlogon messages, that indicate a network connectivity issue.
  • At the command prompt, type netdiag, and look for any errors. Typically, these errors have to be resolved before Group Policy processing can continue.For more information about using NetDiag, see article Q265706, “DCDiag and NetDiag Facilitate Join and DC Creation,” in the Microsoft Knowledge Base.
  • At the command prompt, type gpupdate, and then check the Event Viewer to see if the Userenv events are logged again.
  • To verify that the domain controller can be contacted through Domain Name System (DNS), try to access \\mydomain.com\sysvol\mydomain.com, where mydomain.com represents the fully qualified DNS name of your domain.
  • Verify that you can access the domain controller by using tools such as Active Directory Users and Computers.
  • Check whether other computers on your network are having the same problem.
  • If this is a forest trust scenario, ensure that the forest for the user account is currently available and can be contacted from the computer where policy processing failed.
  • Use verbose logging to debug this error. The log file explains the specific error.For more information about enabling userenv logging, see article 221833 , “How to Enable User Environment Debug Logging in Retail Builds of Windows” at the Microsoft Knowledge Base.

If none of the previous user actions identified the problem, follow the steps in “Troubleshooting Group Policy in Windows Server 2003” at the Microsoft Web site.

Related:

The EdgeSync credential %1 could not be decrypted by using the certificate with thumbprint %2. The exception is %3. To resolve this problem, unsubscribe and resubscribe your Edge Transport server.

Details
Product: Exchange
Event ID: 1005
Source: MSExchange Message Security
Version: 8.0
Symbolic Name: CouldNotDecryptPassword
Message: The EdgeSync credential %1 could not be decrypted by using the certificate with thumbprint %2. The exception is %3. To resolve this problem, unsubscribe and resubscribe your Edge Transport server.
   
Explanation

This Error event indicates that the public key that is used to decrypt the Active Directory Application Mode (ADAM) directory service credentials that are used during the EdgeSync process is unavailable or invalid.

   
User Action

To resolve this error, do the following:

  • Remove the Edge Subscription from the Hub Transport server by using the Remove-EdgeSubscription cmdlet in the Exchange Management Shell. After you have removed the Edge Subscription from the Exchange organization, resubscribe the Edge Transport server by using the New-EdgeSubscription cmdlet. This process will generate new credentials. For more information, see Understanding Edge Subscriptions.

  • Review other related Error and Warning events in the Application log. These related events may help you find the root cause of this error.

  • If the recommended steps do not resolve this error, contact Microsoft Customer Support Services. For more information about how to contact support, visit the Microsoft Help and Support Web site.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related:

Unable to start the Microsoft Exchange Information Store. Error {error code}.

Details
Product: Exchange
Event ID: 1005
Source: MSExchangeIS Public Store
Version: 6.0
Component: Information Store
Symbolic Name: msgidFailedStart
Message: Unable to start the Microsoft Exchange Information Store. Error {error code}.
   
Explanation
File or disk corruption caused the startup of Information Store to fail. In a cluster environment, the routing groups may not be set up correctly.
   
User Action
If the error is file corruption, repair, reinstall, or replace the corrupted file. If a disk error occurred, run the Chkdsk.exe utility with the /r option on the hard disk. If this message reappears, run hardware diagnostics on the disk drive and its controller.In a cluster environment, verify the set up of your routing groups.

Related:

Your Windows product has not been activated with Microsoft yet. Please use the Product Activation Wizard within %1 days.

Details
Product: Windows Operating System
Event ID: 1005
Source: Windows Product Activation
Version: 5.2
Symbolic Name: WPA_NOT_ACTIVATED_EVENT
Message: Your Windows product has not been activated with Microsoft yet. Please use the Product Activation Wizard within %1 days.
   
Explanation

Product Activation for Windows Server 2003 reduces software piracy and helps ensure that Microsoft customers receive genuine products.

Windows Server 2003 must be activated within a specific grace period, which began the first time you turned on the computer running Windows Server 2003. During this period, the system will operate normally. The time remaining for activation is specified in the message.

Activation can be done either over the Internet or by telephoning a Microsoft customer service representative.

For more information about activating Windows Server 2003, see Microsoft Product Activation.

   
User Action

To activate Windows Server 2003 over the Internet or by telephone, click Start, point to All Programs, and then click Activate Windows. Follow the instructions in the Windows Product Activation Wizard.

Alternatively, to manually start this wizard, click Start, click Run, and then type the following command:
%windir%\system32\oobe\msoobe.exe /a.

Related:

Process %1 (PID=%2). %3 operation has failed for %4. Exception message: %5 Current file synchronization operation is aborted.

Details
Product: Exchange
Event ID: 1005
Source: MSExchangeFDS
Version: 8.0
Symbolic Name: IOOperationFailedOneArgument
Message: Process %1 (PID=%2). %3 operation has failed for %4. Exception message: %5 Current file synchronization operation is aborted.
   
Explanation

This Warning event indicates that the Microsoft® Exchange File Distribution service (MSExchangeFDS) did not perform one of the file synchronization operations. The MSExchangeFDS is used to distribute offline address books and custom Unified Messaging prompts. This event may occur for various reasons.

   
User Action

To determine the root cause of this Warning event, follow these steps:

  1. Use the following Exchange Management Shell cmdlet to increase the diagnostic logging level on the FileReplication counter of the MSExchangeFDS performance object to the High setting:

    1. Set-EventLogLevel MSExchangeFDS\FileReplication -Level High

      Note   For detailed information about increasing logging, see How to Change Logging Levels for Exchange Processes.

  2. Review other related Error and Warning events in the Application log. These related events may help you determine the root cause of this error.

  3. Use the following Exchange Management Shell cmdlet to set the diagnostic logging level on the FileReplication counter of the MSExchangeFDS performance object back to the default Lowest setting:

    1. Set-EventLogLevel MSExchangeFDS\FileReplication -Level Lowest

      Important   After you have completed troubleshooting this issue, you should always return logging to the default level to avoid filling your event logs.

If you are not already doing so, consider running the tools that Microsoft Exchange offers to help administrators analyze and troubleshoot their Exchange environment. These tools can help you make sure that your configuration is in line with Microsoft best practices. They can also help you identify and resolve performance issues, improve mail flow, and better manage disaster recovery scenarios. Go to the Toolbox node of the Exchange Management Console to run these tools now. For more information about these tools, see Toolbox in the Exchange Server 2007 Help.

Related:

Unexpected error %1 occurred.

Details
Product: Exchange
Event ID: 1005
Source: MSExchangeSA
Version: 6.5.6940.0
Message: Unexpected error %1 occurred.
   
Explanation

Event ID 1005 in the application log is often accompanied by the problem of the System Attendant not starting.

  • Domain Name System issues. For example, DNS may not be configured correctly on the Exchange server. This is particularly possible if there is more than one Network Card on the server.

  • System Attendant Service configured to start with some other account and not the Local System Account.

  • Exchange Domain Servers Global Security Group may be missing, may have been moved to another container, or may have permissions on it modified.

  • File and Print Sharing may be disabled. NetBIOS over TCP/IP may be disabled.

  • NetBIOS TCP/IP Helper Service may be disabled.

   
User Action
  • Check DNS Settings on the server and ensure that they are correct.

  • Ensure that the System Attendant service is starting with the Local System Accountant.

  • Ensure that the Exchange Domain Servers Global Security Group is present in the USERS Container.

  • Ensure that File and Print Sharing and NetBIOS over TCP/IP are not disabled.

  • Ensure that the TCP/IP Helper Service is not disabled.

Related: