| Event Id | 10001 |
| Source | MacFile |
| Description | Unable to start File Server for Macintosh service. |
| Event Information | According to Microsoft: CAUSE : These issues may occur after a malicious program removes the administrative shares on a computer that is running Windows Server 2003, Windows XP, Windows 2000, or Windows NT 4.0. Frequently, malicious users connect to these administrative shares by taking advantage of weak passwords, missing security updates, direct exposure of the computer to the Internet, or a combination of these factors. The malicious users then install malicious programs to expand their influence over the computer and over the rest of the computer network. In many cases, these malicious programs remove the administrative shares as a defensive move to prevent other competing malicious users from taking control of the infected systems. Infection by one of these malicious programs can come directly from the Internet or from another computer on the local network that is infected. This generally indicates that security on the network is weak. Therefore, if you see these symptoms, we recommend that you examine all other computers on the network for malicious programs by using antivirus software and spyware detection tools. We also recommend that you perform a security analysis to identify vulnerabilities on the network. See the "Resolution" section for information about how to detect malicious programs and how to analyze network security. RESOLUTION: Warning: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. To verify whether a computer is affected by this issue, follow these steps: 1. Examine the AutoShareServer and AutoShareWks registry values to make sure that they are not set to 0: a. Click Start, click Run, type regedit, and then press ENTER. b. Locate and then click the following registry sub-key: |
| Reference Links | Windows
NT 4.0 SFM Does Not Start in Windows 2000 Domain Model Overview of problems that may occur when administrative shares are missing |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.