From: sonsie on
After hitting a couple of dead ends with regard to help, I was directed here.
I have 10 errors/warnings on my event logs, one of which is about IIS. I'm
going to post all of them here with the understanding that this forum may not
be able to help with all of them. Normally I click on the link to MS that
reports the problem, but for the past 4-5 days I've gotten either a blank
page or the message that they have no info on the problem. Whatever help you
can give would be greatly appreciated.

sonsie

Writing in double brackets indicates notes I've made about frequency.

APPLICATION LOG

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 63
Date: 1/15/2006
Time: 6:20:04 PM
User: NT AUTHORITY\SYSTEM
Computer: NL4-658OL-MJG
Description:
A provider, HiPerfCooker_v1, has been registered in the WMI namespace,
Root\WMI, to use the LocalSystem account. This account is privileged and the
provider may cause a security violation if it does not correctly impersonate
user requests.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

xxxxxxxx

Event Type: Warning [[this one x2 on 1/18, x2 on 1/19]]
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 1/18/2006
Time: 2:26:15 PM
User: NT AUTHORITY\SYSTEM
Computer: NLA-65801-MJG
Description:
A provider, OffProv10, has been registered in the WMI namespace,
Root\MSAPPS10, but did not specify the HostingModel property. This provider
will be run using the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests. Ensure that provider has been reviewed for
security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

xxxxxxxxx

Event Type: Warning
Event Source: ASP.NET 1.1.4322.0
Event Category: Setup
Event ID: 1020
Date: 1/19/2006
Time: 4:44:58 AM
User: N/A
Computer: NLA-65801-MJG
Description:
Updates to the IIS metabase were aborted because IIS is either not installed
or is disabled on this machine. To configure ASP.NET to run in IIS, please
install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

xxxxxxxxxx

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 62
Date: 1/19/2006
Time: 4:46:36 AM
User: N/A
Computer: NLA-65801-MJG
Description:
WMI ADAP was unable to process the .NET CLR Data performance library since
one of the data blobs reported to have classes but had zero size

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

xxxxxxxxxx

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 62
Date: 1/19/2006
Time: 4:46:36 AM
User: N/A
Computer: NLA-65801-MJG
Description:
WMI ADAP was unable to process the .NET CLR Networking performance library
since one of the data blobs reported to have classes but had zero size

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


xxxxxxxxxxxx

SECURITY LOG

Event Type: Failure Audit [[several warnings since 1/16]]
Event Source: Security
Event Category: Policy Change
Event ID: 615
Date: 1/18/2006
Time: 1:06:04 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: NLA-65801-MJG
Description:
IPSec Services: IPSec Services failed to get the complete list of network
interfaces on the machine. This can be a potential security hazard to the
machine since some of the network interfaces may not get the protection as
desired by the applied IPSec filters. Please run IPSec monitor snap-in to
further diagnose the problem.



For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

xxxxxxxxxxx

SYSTEM LOG

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date: 1/16/2006
Time: 12:48:11 PM
User: NT AUTHORITY\SYSTEM
Computer: NLA-65801-MJG
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to
start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

xxxxxxxxx

Event Type: Warning [[often get these a couple of times/day]]
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 1/17/2006
Time: 11:59:35 PM
User: N/A
Computer: NLA-65801-MJG
Description:
TCP/IP has reached the security limit imposed on the number of concurrent
TCP connect attempts.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....?..?
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

xxxxxxxxx

Event Type: Error - [[several of these, the latest being 1/20]]
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 1/18/2006
Time: 5:27:53 PM
User: NLA-65801-MJG\nancy
Computer: NLA-65801-MJG
Description:
The server {F3A614DC-ABE0-11D2-A441-00C04F795683} did not register with DCOM
within the required timeout.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



From: sonsie on
Additional note: I'm sorry, forgot to mention that I'm using Windows XP home
sp2 and my PC has 512MB ram, 2 HD.

"sonsie" wrote:

> After hitting a couple of dead ends with regard to help, I was directed here.
> I have 10 errors/warnings on my event logs, one of which is about IIS. I'm
> going to post all of them here with the understanding that this forum may not
> be able to help with all of them. Normally I click on the link to MS that
> reports the problem, but for the past 4-5 days I've gotten either a blank
> page or the message that they have no info on the problem. Whatever help you
> can give would be greatly appreciated.
>
> sonsie
>
> Writing in double brackets indicates notes I've made about frequency.
>
> APPLICATION LOG
>
> Event Type: Warning
> Event Source: WinMgmt
> Event Category: None
> Event ID: 63
> Date: 1/15/2006
> Time: 6:20:04 PM
> User: NT AUTHORITY\SYSTEM
> Computer: NL4-658OL-MJG
> Description:
> A provider, HiPerfCooker_v1, has been registered in the WMI namespace,
> Root\WMI, to use the LocalSystem account. This account is privileged and the
> provider may cause a security violation if it does not correctly impersonate
> user requests.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> xxxxxxxx
>
> Event Type: Warning [[this one x2 on 1/18, x2 on 1/19]]
> Event Source: WinMgmt
> Event Category: None
> Event ID: 5603
> Date: 1/18/2006
> Time: 2:26:15 PM
> User: NT AUTHORITY\SYSTEM
> Computer: NLA-65801-MJG
> Description:
> A provider, OffProv10, has been registered in the WMI namespace,
> Root\MSAPPS10, but did not specify the HostingModel property. This provider
> will be run using the LocalSystem account. This account is privileged and
> the provider may cause a security violation if it does not correctly
> impersonate user requests. Ensure that provider has been reviewed for
> security behavior and update the HostingModel property of the provider
> registration to an account with the least privileges possible for the
> required functionality.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> xxxxxxxxx
>
> Event Type: Warning
> Event Source: ASP.NET 1.1.4322.0
> Event Category: Setup
> Event ID: 1020
> Date: 1/19/2006
> Time: 4:44:58 AM
> User: N/A
> Computer: NLA-65801-MJG
> Description:
> Updates to the IIS metabase were aborted because IIS is either not installed
> or is disabled on this machine. To configure ASP.NET to run in IIS, please
> install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> xxxxxxxxxx
>
> Event Type: Warning
> Event Source: WinMgmt
> Event Category: None
> Event ID: 62
> Date: 1/19/2006
> Time: 4:46:36 AM
> User: N/A
> Computer: NLA-65801-MJG
> Description:
> WMI ADAP was unable to process the .NET CLR Data performance library since
> one of the data blobs reported to have classes but had zero size
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> xxxxxxxxxx
>
> Event Type: Warning
> Event Source: WinMgmt
> Event Category: None
> Event ID: 62
> Date: 1/19/2006
> Time: 4:46:36 AM
> User: N/A
> Computer: NLA-65801-MJG
> Description:
> WMI ADAP was unable to process the .NET CLR Networking performance library
> since one of the data blobs reported to have classes but had zero size
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> xxxxxxxxxxxx
>
> SECURITY LOG
>
> Event Type: Failure Audit [[several warnings since 1/16]]
> Event Source: Security
> Event Category: Policy Change
> Event ID: 615
> Date: 1/18/2006
> Time: 1:06:04 PM
> User: NT AUTHORITY\NETWORK SERVICE
> Computer: NLA-65801-MJG
> Description:
> IPSec Services: IPSec Services failed to get the complete list of network
> interfaces on the machine. This can be a potential security hazard to the
> machine since some of the network interfaces may not get the protection as
> desired by the applied IPSec filters. Please run IPSec monitor snap-in to
> further diagnose the problem.
>
>
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> xxxxxxxxxxx
>
> SYSTEM LOG
>
> Event Type: Error
> Event Source: DCOM
> Event Category: None
> Event ID: 10005
> Date: 1/16/2006
> Time: 12:48:11 PM
> User: NT AUTHORITY\SYSTEM
> Computer: NLA-65801-MJG
> Description:
> DCOM got error "This service cannot be started in Safe Mode " attempting to
> start the service EventSystem with arguments "" in order to run the server:
> {1BE1F766-5536-11D1-B726-00C04FB926AF}
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> xxxxxxxxx
>
> Event Type: Warning [[often get these a couple of times/day]]
> Event Source: Tcpip
> Event Category: None
> Event ID: 4226
> Date: 1/17/2006
> Time: 11:59:35 PM
> User: N/A
> Computer: NLA-65801-MJG
> Description:
> TCP/IP has reached the security limit imposed on the number of concurrent
> TCP connect attempts.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 00 00 00 00 01 00 54 00 ......T.
> 0008: 00 00 00 00 82 10 00 80 ....?..?
> 0010: 01 00 00 00 00 00 00 00 ........
> 0018: 00 00 00 00 00 00 00 00 ........
> 0020: 00 00 00 00 00 00 00 00 ........
>
> xxxxxxxxx
>
> Event Type: Error - [[several of these, the latest being 1/20]]
> Event Source: DCOM
> Event Category: None
> Event ID: 10010
> Date: 1/18/2006
> Time: 5:27:53 PM
> User: NLA-65801-MJG\nancy
> Computer: NLA-65801-MJG
> Description:
> The server {F3A614DC-ABE0-11D2-A441-00C04F795683} did not register with DCOM
> within the required timeout.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>
From: David Wang [Msft] on
I'm not certain what your actual problem is...

Are you just trying to have no errors/warnings show up in the Event Log?

None of them look critical.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//

"sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message
news:8F3FA611-9AC8-426D-959B-EE4F29630838(a)microsoft.com...
> Additional note: I'm sorry, forgot to mention that I'm using Windows XP
> home
> sp2 and my PC has 512MB ram, 2 HD.
>
> "sonsie" wrote:
>
>> After hitting a couple of dead ends with regard to help, I was directed
>> here.
>> I have 10 errors/warnings on my event logs, one of which is about IIS.
>> I'm
>> going to post all of them here with the understanding that this forum may
>> not
>> be able to help with all of them. Normally I click on the link to MS that
>> reports the problem, but for the past 4-5 days I've gotten either a blank
>> page or the message that they have no info on the problem. Whatever help
>> you
>> can give would be greatly appreciated.
>>
>> sonsie
>>
>> Writing in double brackets indicates notes I've made about frequency.
>>
>> APPLICATION LOG
>>
>> Event Type: Warning
>> Event Source: WinMgmt
>> Event Category: None
>> Event ID: 63
>> Date: 1/15/2006
>> Time: 6:20:04 PM
>> User: NT AUTHORITY\SYSTEM
>> Computer: NL4-658OL-MJG
>> Description:
>> A provider, HiPerfCooker_v1, has been registered in the WMI namespace,
>> Root\WMI, to use the LocalSystem account. This account is privileged and
>> the
>> provider may cause a security violation if it does not correctly
>> impersonate
>> user requests.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> xxxxxxxx
>>
>> Event Type: Warning [[this one x2 on 1/18, x2 on 1/19]]
>> Event Source: WinMgmt
>> Event Category: None
>> Event ID: 5603
>> Date: 1/18/2006
>> Time: 2:26:15 PM
>> User: NT AUTHORITY\SYSTEM
>> Computer: NLA-65801-MJG
>> Description:
>> A provider, OffProv10, has been registered in the WMI namespace,
>> Root\MSAPPS10, but did not specify the HostingModel property. This
>> provider
>> will be run using the LocalSystem account. This account is privileged
>> and
>> the provider may cause a security violation if it does not correctly
>> impersonate user requests. Ensure that provider has been reviewed for
>> security behavior and update the HostingModel property of the provider
>> registration to an account with the least privileges possible for the
>> required functionality.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> xxxxxxxxx
>>
>> Event Type: Warning
>> Event Source: ASP.NET 1.1.4322.0
>> Event Category: Setup
>> Event ID: 1020
>> Date: 1/19/2006
>> Time: 4:44:58 AM
>> User: N/A
>> Computer: NLA-65801-MJG
>> Description:
>> Updates to the IIS metabase were aborted because IIS is either not
>> installed
>> or is disabled on this machine. To configure ASP.NET to run in IIS,
>> please
>> install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> xxxxxxxxxx
>>
>> Event Type: Warning
>> Event Source: WinMgmt
>> Event Category: None
>> Event ID: 62
>> Date: 1/19/2006
>> Time: 4:46:36 AM
>> User: N/A
>> Computer: NLA-65801-MJG
>> Description:
>> WMI ADAP was unable to process the .NET CLR Data performance library
>> since
>> one of the data blobs reported to have classes but had zero size
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> xxxxxxxxxx
>>
>> Event Type: Warning
>> Event Source: WinMgmt
>> Event Category: None
>> Event ID: 62
>> Date: 1/19/2006
>> Time: 4:46:36 AM
>> User: N/A
>> Computer: NLA-65801-MJG
>> Description:
>> WMI ADAP was unable to process the .NET CLR Networking performance
>> library
>> since one of the data blobs reported to have classes but had zero size
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>> xxxxxxxxxxxx
>>
>> SECURITY LOG
>>
>> Event Type: Failure Audit [[several warnings since 1/16]]
>> Event Source: Security
>> Event Category: Policy Change
>> Event ID: 615
>> Date: 1/18/2006
>> Time: 1:06:04 PM
>> User: NT AUTHORITY\NETWORK SERVICE
>> Computer: NLA-65801-MJG
>> Description:
>> IPSec Services: IPSec Services failed to get the complete list of network
>> interfaces on the machine. This can be a potential security hazard to the
>> machine since some of the network interfaces may not get the protection
>> as
>> desired by the applied IPSec filters. Please run IPSec monitor snap-in to
>> further diagnose the problem.
>>
>>
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> xxxxxxxxxxx
>>
>> SYSTEM LOG
>>
>> Event Type: Error
>> Event Source: DCOM
>> Event Category: None
>> Event ID: 10005
>> Date: 1/16/2006
>> Time: 12:48:11 PM
>> User: NT AUTHORITY\SYSTEM
>> Computer: NLA-65801-MJG
>> Description:
>> DCOM got error "This service cannot be started in Safe Mode " attempting
>> to
>> start the service EventSystem with arguments "" in order to run the
>> server:
>> {1BE1F766-5536-11D1-B726-00C04FB926AF}
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> xxxxxxxxx
>>
>> Event Type: Warning [[often get these a couple of times/day]]
>> Event Source: Tcpip
>> Event Category: None
>> Event ID: 4226
>> Date: 1/17/2006
>> Time: 11:59:35 PM
>> User: N/A
>> Computer: NLA-65801-MJG
>> Description:
>> TCP/IP has reached the security limit imposed on the number of concurrent
>> TCP connect attempts.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>> Data:
>> 0000: 00 00 00 00 01 00 54 00 ......T.
>> 0008: 00 00 00 00 82 10 00 80 ....?..?
>> 0010: 01 00 00 00 00 00 00 00 ........
>> 0018: 00 00 00 00 00 00 00 00 ........
>> 0020: 00 00 00 00 00 00 00 00 ........
>>
>> xxxxxxxxx
>>
>> Event Type: Error - [[several of these, the latest being 1/20]]
>> Event Source: DCOM
>> Event Category: None
>> Event ID: 10010
>> Date: 1/18/2006
>> Time: 5:27:53 PM
>> User: NLA-65801-MJG\nancy
>> Computer: NLA-65801-MJG
>> Description:
>> The server {F3A614DC-ABE0-11D2-A441-00C04F795683} did not register with
>> DCOM
>> within the required timeout.
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>>
>>


From: sonsie on
I don't know what the problem is either, that's why I turned to the experts.
I don't know what any of those errors/warnings mean, but I know enough to
take notice when a log tells me that "this can be a potential security
hazard", or tells me to perform a task because something can't be installed.

"None of them look critical" doesn't tell me much. I'm not just "trying to
have no errors show up" - I figure if there are problems, which there are or
it wouldn't give me errors and warnings, then I'd like to fix them, rather
than wait and have them turn into something much worse in the future.

Sorry, but that's twice in one day that Microsoft chose not to give a
helpful response - the first time the person directed me to this forum.

Thanks anyway

"David Wang [Msft]" wrote:

> I'm not certain what your actual problem is...
>
> Are you just trying to have no errors/warnings show up in the Event Log?
>
> None of them look critical.
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no rights.
> //
>
> "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message
> news:8F3FA611-9AC8-426D-959B-EE4F29630838(a)microsoft.com...
> > Additional note: I'm sorry, forgot to mention that I'm using Windows XP
> > home
> > sp2 and my PC has 512MB ram, 2 HD.
> >
> > "sonsie" wrote:
> >
> >> After hitting a couple of dead ends with regard to help, I was directed
> >> here.
> >> I have 10 errors/warnings on my event logs, one of which is about IIS.
> >> I'm
> >> going to post all of them here with the understanding that this forum may
> >> not
> >> be able to help with all of them. Normally I click on the link to MS that
> >> reports the problem, but for the past 4-5 days I've gotten either a blank
> >> page or the message that they have no info on the problem. Whatever help
> >> you
> >> can give would be greatly appreciated.
> >>
> >> sonsie
> >>
> >> Writing in double brackets indicates notes I've made about frequency.
> >>
> >> APPLICATION LOG
> >>
> >> Event Type: Warning
> >> Event Source: WinMgmt
> >> Event Category: None
> >> Event ID: 63
> >> Date: 1/15/2006
> >> Time: 6:20:04 PM
> >> User: NT AUTHORITY\SYSTEM
> >> Computer: NL4-658OL-MJG
> >> Description:
> >> A provider, HiPerfCooker_v1, has been registered in the WMI namespace,
> >> Root\WMI, to use the LocalSystem account. This account is privileged and
> >> the
> >> provider may cause a security violation if it does not correctly
> >> impersonate
> >> user requests.
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >> xxxxxxxx
> >>
> >> Event Type: Warning [[this one x2 on 1/18, x2 on 1/19]]
> >> Event Source: WinMgmt
> >> Event Category: None
> >> Event ID: 5603
> >> Date: 1/18/2006
> >> Time: 2:26:15 PM
> >> User: NT AUTHORITY\SYSTEM
> >> Computer: NLA-65801-MJG
> >> Description:
> >> A provider, OffProv10, has been registered in the WMI namespace,
> >> Root\MSAPPS10, but did not specify the HostingModel property. This
> >> provider
> >> will be run using the LocalSystem account. This account is privileged
> >> and
> >> the provider may cause a security violation if it does not correctly
> >> impersonate user requests. Ensure that provider has been reviewed for
> >> security behavior and update the HostingModel property of the provider
> >> registration to an account with the least privileges possible for the
> >> required functionality.
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >> xxxxxxxxx
> >>
> >> Event Type: Warning
> >> Event Source: ASP.NET 1.1.4322.0
> >> Event Category: Setup
> >> Event ID: 1020
> >> Date: 1/19/2006
> >> Time: 4:44:58 AM
> >> User: N/A
> >> Computer: NLA-65801-MJG
> >> Description:
> >> Updates to the IIS metabase were aborted because IIS is either not
> >> installed
> >> or is disabled on this machine. To configure ASP.NET to run in IIS,
> >> please
> >> install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >> xxxxxxxxxx
> >>
> >> Event Type: Warning
> >> Event Source: WinMgmt
> >> Event Category: None
> >> Event ID: 62
> >> Date: 1/19/2006
> >> Time: 4:46:36 AM
> >> User: N/A
> >> Computer: NLA-65801-MJG
> >> Description:
> >> WMI ADAP was unable to process the .NET CLR Data performance library
> >> since
> >> one of the data blobs reported to have classes but had zero size
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >> xxxxxxxxxx
> >>
> >> Event Type: Warning
> >> Event Source: WinMgmt
> >> Event Category: None
> >> Event ID: 62
> >> Date: 1/19/2006
> >> Time: 4:46:36 AM
> >> User: N/A
> >> Computer: NLA-65801-MJG
> >> Description:
> >> WMI ADAP was unable to process the .NET CLR Networking performance
> >> library
> >> since one of the data blobs reported to have classes but had zero size
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >>
> >> xxxxxxxxxxxx
> >>
> >> SECURITY LOG
> >>
> >> Event Type: Failure Audit [[several warnings since 1/16]]
> >> Event Source: Security
> >> Event Category: Policy Change
> >> Event ID: 615
> >> Date: 1/18/2006
> >> Time: 1:06:04 PM
> >> User: NT AUTHORITY\NETWORK SERVICE
> >> Computer: NLA-65801-MJG
> >> Description:
> >> IPSec Services: IPSec Services failed to get the complete list of network
> >> interfaces on the machine. This can be a potential security hazard to the
> >> machine since some of the network interfaces may not get the protection
> >> as
> >> desired by the applied IPSec filters. Please run IPSec monitor snap-in to
> >> further diagnose the problem.
> >>
> >>
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >> xxxxxxxxxxx
> >>
> >> SYSTEM LOG
> >>
> >> Event Type: Error
> >> Event Source: DCOM
> >> Event Category: None
> >> Event ID: 10005
> >> Date: 1/16/2006
> >> Time: 12:48:11 PM
> >> User: NT AUTHORITY\SYSTEM
> >> Computer: NLA-65801-MJG
> >> Description:
> >> DCOM got error "This service cannot be started in Safe Mode " attempting
> >> to
> >> start the service EventSystem with arguments "" in order to run the
> >> server:
> >> {1BE1F766-5536-11D1-B726-00C04FB926AF}
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >> xxxxxxxxx
> >>
> >> Event Type: Warning [[often get these a couple of times/day]]
> >> Event Source: Tcpip
> >> Event Category: None
> >> Event ID: 4226
> >> Date: 1/17/2006
> >> Time: 11:59:35 PM
> >> User: N/A
> >> Computer: NLA-65801-MJG
> >> Description:
> >> TCP/IP has reached the security limit imposed on the number of concurrent
> >> TCP connect attempts.
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >> Data:
> >> 0000: 00 00 00 00 01 00 54 00 ......T.
> >> 0008: 00 00 00 00 82 10 00 80 ....?..?
> >> 0010: 01 00 00 00 00 00 00 00 ........
> >> 0018: 00 00 00 00 00 00 00 00 ........
> >> 0020: 00 00 00 00 00 00 00 00 ........
> >>
> >> xxxxxxxxx
> >>
> >> Event Type: Error - [[several of these, the latest being 1/20]]
> >> Event Source: DCOM
> >> Event Category: None
> >> Event ID: 10010
> >> Date: 1/18/2006
> >> Time: 5:27:53 PM
> >> User: NLA-65801-MJG\nancy
> >> Computer: NLA-65801-MJG
> >> Description:
> >> The server {F3A614DC-ABE0-11D2-A441-00C04F795683} did not register with
> >> DCOM
> >> within the required timeout.
> >>
> >> For more information, see Help and Support Center at
> >> http://go.microsoft.com/fwlink/events.asp.
> >>
> >>
> >>
>
>
>
From: David Wang [Msft] on
Please understand that this is a free peer-support forum. Answers are not
guaranteed. If you want guaranteed support, you can call Microsoft PSS.

In general, people are not psychic, so the best way to get a helpful
response is to ask a helpful question.

Which is what I tried to ask of you -- what is your question/problem -- and
you said "I don't know". Please understand that if I did not want to help
you, I would not have bothered asking you to clarify. So please don't just
insult me by saying that I "chose not to give a helpful response" -- you
gave me nothing to work with.

Now, I already did my analysis of the events and none are "critical".

Application Log:
- XP Home does not have IIS, which is what one of the warning references.
Benign
- WinMgmt events are all about WMI namespace registration made by
applications you have installed, which unless you are programming/scripting,
you can ignore.

Security Log:
- You care about IPSec only in a Domain or Stand-alone configuration. Since
XP Home cannot join a domain, you only care about stand-alone configuration.
And if you run a firewall, this warning is irrelevant. You are probably
running a firewall from a security perspective, hence this warning is
benign.

System Log:
- EventSystem is set to always auto-start but does not work in SafeMode
(which is ok because SafeMode is mostly for fixing driver issues). You
rebooted into SafeMode at some point, hence this event is expected and
benign.
- XP Home and XP Pro have built-in unalterable connection limits. The
warning just says that it's been reached, which is expected and hence
benign.
- Windows Messenger failed for some reason. If you are not using Windows
Messenger (MSN Messenger != Windows Messenger) then this is not interesting


So as you can see, all the events are benign and require no action from you.

FYI: I suggest that you fix your incorrect assumption that any
warnings/errors in the Event Log mean that something is wrong and need to be
fixed. Not all errors show up in the event log, and not all errors in the
event log require action. Sorry, in general computing, there aren't
clear-cut answers - you just have to learn how to evaluate which events are
important and where the errors are logged. If you have a locked down and
fixed system, I would react differently, but not for general computers that
consumers maintain and use.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//

"sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message
news:6D22115C-EDCA-4BAC-A4A4-BF573C02DE1C(a)microsoft.com...
>I don't know what the problem is either, that's why I turned to the
>experts.
> I don't know what any of those errors/warnings mean, but I know enough to
> take notice when a log tells me that "this can be a potential security
> hazard", or tells me to perform a task because something can't be
> installed.
>
> "None of them look critical" doesn't tell me much. I'm not just "trying to
> have no errors show up" - I figure if there are problems, which there are
> or
> it wouldn't give me errors and warnings, then I'd like to fix them, rather
> than wait and have them turn into something much worse in the future.
>
> Sorry, but that's twice in one day that Microsoft chose not to give a
> helpful response - the first time the person directed me to this forum.
>
> Thanks anyway
>
> "David Wang [Msft]" wrote:
>
>> I'm not certain what your actual problem is...
>>
>> Are you just trying to have no errors/warnings show up in the Event Log?
>>
>> None of them look critical.
>>
>> --
>> //David
>> IIS
>> http://blogs.msdn.com/David.Wang
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>> //
>>
>> "sonsie" <nancyarnold(removethis)@hotmail.com> wrote in message
>> news:8F3FA611-9AC8-426D-959B-EE4F29630838(a)microsoft.com...
>> > Additional note: I'm sorry, forgot to mention that I'm using Windows XP
>> > home
>> > sp2 and my PC has 512MB ram, 2 HD.
>> >
>> > "sonsie" wrote:
>> >
>> >> After hitting a couple of dead ends with regard to help, I was
>> >> directed
>> >> here.
>> >> I have 10 errors/warnings on my event logs, one of which is about IIS.
>> >> I'm
>> >> going to post all of them here with the understanding that this forum
>> >> may
>> >> not
>> >> be able to help with all of them. Normally I click on the link to MS
>> >> that
>> >> reports the problem, but for the past 4-5 days I've gotten either a
>> >> blank
>> >> page or the message that they have no info on the problem. Whatever
>> >> help
>> >> you
>> >> can give would be greatly appreciated.
>> >>
>> >> sonsie
>> >>
>> >> Writing in double brackets indicates notes I've made about frequency.
>> >>
>> >> APPLICATION LOG
>> >>
>> >> Event Type: Warning
>> >> Event Source: WinMgmt
>> >> Event Category: None
>> >> Event ID: 63
>> >> Date: 1/15/2006
>> >> Time: 6:20:04 PM
>> >> User: NT AUTHORITY\SYSTEM
>> >> Computer: NL4-658OL-MJG
>> >> Description:
>> >> A provider, HiPerfCooker_v1, has been registered in the WMI namespace,
>> >> Root\WMI, to use the LocalSystem account. This account is privileged
>> >> and
>> >> the
>> >> provider may cause a security violation if it does not correctly
>> >> impersonate
>> >> user requests.
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >>
>> >> xxxxxxxx
>> >>
>> >> Event Type: Warning [[this one x2 on 1/18, x2 on 1/19]]
>> >> Event Source: WinMgmt
>> >> Event Category: None
>> >> Event ID: 5603
>> >> Date: 1/18/2006
>> >> Time: 2:26:15 PM
>> >> User: NT AUTHORITY\SYSTEM
>> >> Computer: NLA-65801-MJG
>> >> Description:
>> >> A provider, OffProv10, has been registered in the WMI namespace,
>> >> Root\MSAPPS10, but did not specify the HostingModel property. This
>> >> provider
>> >> will be run using the LocalSystem account. This account is privileged
>> >> and
>> >> the provider may cause a security violation if it does not correctly
>> >> impersonate user requests. Ensure that provider has been reviewed for
>> >> security behavior and update the HostingModel property of the provider
>> >> registration to an account with the least privileges possible for the
>> >> required functionality.
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >>
>> >> xxxxxxxxx
>> >>
>> >> Event Type: Warning
>> >> Event Source: ASP.NET 1.1.4322.0
>> >> Event Category: Setup
>> >> Event ID: 1020
>> >> Date: 1/19/2006
>> >> Time: 4:44:58 AM
>> >> User: N/A
>> >> Computer: NLA-65801-MJG
>> >> Description:
>> >> Updates to the IIS metabase were aborted because IIS is either not
>> >> installed
>> >> or is disabled on this machine. To configure ASP.NET to run in IIS,
>> >> please
>> >> install or enable IIS and re-register ASP.NET using aspnet_regiis.exe
>> >> /i.
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >>
>> >> xxxxxxxxxx
>> >>
>> >> Event Type: Warning
>> >> Event Source: WinMgmt
>> >> Event Category: None
>> >> Event ID: 62
>> >> Date: 1/19/2006
>> >> Time: 4:46:36 AM
>> >> User: N/A
>> >> Computer: NLA-65801-MJG
>> >> Description:
>> >> WMI ADAP was unable to process the .NET CLR Data performance library
>> >> since
>> >> one of the data blobs reported to have classes but had zero size
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >>
>> >> xxxxxxxxxx
>> >>
>> >> Event Type: Warning
>> >> Event Source: WinMgmt
>> >> Event Category: None
>> >> Event ID: 62
>> >> Date: 1/19/2006
>> >> Time: 4:46:36 AM
>> >> User: N/A
>> >> Computer: NLA-65801-MJG
>> >> Description:
>> >> WMI ADAP was unable to process the .NET CLR Networking performance
>> >> library
>> >> since one of the data blobs reported to have classes but had zero size
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >>
>> >>
>> >> xxxxxxxxxxxx
>> >>
>> >> SECURITY LOG
>> >>
>> >> Event Type: Failure Audit [[several warnings since 1/16]]
>> >> Event Source: Security
>> >> Event Category: Policy Change
>> >> Event ID: 615
>> >> Date: 1/18/2006
>> >> Time: 1:06:04 PM
>> >> User: NT AUTHORITY\NETWORK SERVICE
>> >> Computer: NLA-65801-MJG
>> >> Description:
>> >> IPSec Services: IPSec Services failed to get the complete list of
>> >> network
>> >> interfaces on the machine. This can be a potential security hazard to
>> >> the
>> >> machine since some of the network interfaces may not get the
>> >> protection
>> >> as
>> >> desired by the applied IPSec filters. Please run IPSec monitor snap-in
>> >> to
>> >> further diagnose the problem.
>> >>
>> >>
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >>
>> >> xxxxxxxxxxx
>> >>
>> >> SYSTEM LOG
>> >>
>> >> Event Type: Error
>> >> Event Source: DCOM
>> >> Event Category: None
>> >> Event ID: 10005
>> >> Date: 1/16/2006
>> >> Time: 12:48:11 PM
>> >> User: NT AUTHORITY\SYSTEM
>> >> Computer: NLA-65801-MJG
>> >> Description:
>> >> DCOM got error "This service cannot be started in Safe Mode "
>> >> attempting
>> >> to
>> >> start the service EventSystem with arguments "" in order to run the
>> >> server:
>> >> {1BE1F766-5536-11D1-B726-00C04FB926AF}
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >>
>> >> xxxxxxxxx
>> >>
>> >> Event Type: Warning [[often get these a couple of times/day]]
>> >> Event Source: Tcpip
>> >> Event Category: None
>> >> Event ID: 4226
>> >> Date: 1/17/2006
>> >> Time: 11:59:35 PM
>> >> User: N/A
>> >> Computer: NLA-65801-MJG
>> >> Description:
>> >> TCP/IP has reached the security limit imposed on the number of
>> >> concurrent
>> >> TCP connect attempts.
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >> Data:
>> >> 0000: 00 00 00 00 01 00 54 00 ......T.
>> >> 0008: 00 00 00 00 82 10 00 80 ....?..?
>> >> 0010: 01 00 00 00 00 00 00 00 ........
>> >> 0018: 00 00 00 00 00 00 00 00 ........
>> >> 0020: 00 00 00 00 00 00 00 00 ........
>> >>
>> >> xxxxxxxxx
>> >>
>> >> Event Type: Error - [[several of these, the latest being 1/20]]
>> >> Event Source: DCOM
>> >> Event Category: None
>> >> Event ID: 10010
>> >> Date: 1/18/2006
>> >> Time: 5:27:53 PM
>> >> User: NLA-65801-MJG\nancy
>> >> Computer: NLA-65801-MJG
>> >> Description:
>> >> The server {F3A614DC-ABE0-11D2-A441-00C04F795683} did not register
>> >> with
>> >> DCOM
>> >> within the required timeout.
>> >>
>> >> For more information, see Help and Support Center at
>> >> http://go.microsoft.com/fwlink/events.asp.
>> >>
>> >>
>> >>
>>
>>
>>