| Event Id | 1473 |
| Source | NTDS Intersite Messaging |
| Description | The Intersite Messaging Service failed to read the configuration of the Intersite Transports out of the Directory. The error message is as follows: Unable to update the password. The value provided as the current password is incorrect. The service has stopped. It will be necessary to correct the problem and restart the service in order for intersite communication to occur. The KCC will be unable to calculate intersite topology without this service. There may be a problem retrieving data from the LDAP server. Please verify that LDAP queries are succeeding on this machine. You may also wish to try restarting the Intersite Messaging Service manually. The record data is the status code. Data: 0000: 2b 05 00 00 |
| Event Information | "According to Microsoft: CAUSE: This behavior can occur if you lock the system partition and remove the Everyone group from various locations. RESOLUTION: To resolve the behavior, reset system default file permissions: 1. Set environment variables as follows: a. At a command prompt, type net share sysvol, and then press ENTER. Notice the path that is returned. b. Right-click My Computer, and then click Properties. c. On the Advanced tab, click Environment Variables. d. In the System Variables section, click New. e. In the Variable Name box, type Sysvol. f. In the Variable Value box, type the path that you noted in step a without the last \sysvol item. g. Repeat these steps to create the %DSDIT% variable and the %DSLOG% variable. To view the path for these variables, examine these variables in the registry under the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters .For example, the default location for the Database log files path and for the DSA Working Directory is the following:C:\WINNT\NTDS 2. At a command prompt, run the following commands: cd \winnt\security\templates secedit /configure /cfg ""setup security.inf"" /db ss.sdb /log ss.log /verbose secedit /configure /cfg basicdc.inf /db basicdc.sdb /log basicdc.log /verbose 3. Restart the computer." This information from some newsgroups may help you: ------------------------------------------------------------------------------ These events are logged even though Active Directory (AD) appears to be running, logons are successful, and various AD tools work. On a domain controller that runs Windows 2000, Event Viewer may log the this Domain Name System (DNS) event every 12 to 15 minutes.You can see following events also loged in (Event ID 4000 & Source=DNS,Event ID 4013 & Source=DNS). When you try to move a DNS zone, you may receive an error message that says, "The data on the Primar |
| Reference Links | DNS, Intersite Messaging, Global Catalog, NTFRS, and "Invalid Credentials" Error Messages on Domain Controller More information |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.