Need help resolving Event ID 1054 errors appearing in event log every 5 mins!

Discussion in 'Windows Networking' started by thelotus99, Jul 13, 2007.

  1. thelotus99

    thelotus99 Guest

    Hello all:

    I have a newly installed domain controller for a client of mine that
    I'm having a problem with, and am hoping I can get some good advice
    on
    tracking down the problem. This is for a small office, with about 8
    computers total. This server is the first domain controller, as
    previously the network was set up with all stand-alone computers.
    It's
    a custom built box running Windows 2003 Small Business Server SP2.
    Hardware specs are AMD Athlon 64 X2 Dual Core 3800+ with 2GB RAM.


    The problem I'm trying to solve is Event ID 1054 appearing in the
    Application Log every 5 minutes like clockwork, for the last few
    months now.


    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1054
    Date: 7/10/2007
    Time: 10:47:45 AM
    User: NT AUTHORITY\SYSTEM
    Computer:
    Description:
    Windows cannot obtain the domain controller name for your computer
    network. (An unexpected network error occurred. ). Group Policy
    processing aborted.


    I'm thinking this is a TCP/IP or DNS issue, and I'll explain why. I
    thought I had the problem solved recently, after noticing some
    invalid
    entries in the DNS server. I saw entries pointing to the server's
    hostname, with an IP address of 169.254.x.x, which reminded me of
    many
    forum posts and articles in the past referring to problems you can
    have on a domain controller with multiple NICs, and this server does
    have 2 NICs. One I had configured with a valid static IP address, and
    the other was enabled, but not connected to the network and no IP
    address assigned. I think that this second network card was causing
    the 169.254 entries to appear in DNS. So, I disabled the 2nd NIC, and
    cleaned up all the bad entries in DNS. I thought I had fixed it!
    There
    were no further errors for 4 hours, but during the night, they
    started
    again. It was strange though, because the first night, they were only
    happening every 15-30 minutes, instead of the standard 5 minutes that
    it has been happening with for the last few months. But, even now,
    it's back up to every single 5 minutes, I get a new entry in the
    event
    log.

    Also, I have thried the suggestions in this article:
    http://support.microsoft.com/kb/298656 but this has not helped.

    Can anyone offer any advice as to further troubleshooting steps I
    should take with this server? I really don't want to scrub the hard
    drives and start over, but I'm afraid that might be my only choice at
    this point! Thanks much in advance!!!!
     
    thelotus99, Jul 13, 2007
    #1
    1. Advertisements

  2. thelotus99

    Ryan Hanisco Guest

    This is a DNS issue. I would clean out the 169 addresses and disable the
    NICs that aren't plugged in that are getting these addresses. These usually
    come from dual NOC servers where you didn't plug one of them in.

    From there, restart the netlogon services to repopulate the srv records and
    you shoudl be OK.
    --
    Ryan Hanisco
    MCSE, MCTS: SQL 2005, Project+
    Chicago, IL

    Remember: Marking helpful answers helps everyone find the info they need
    quickly.
     
    Ryan Hanisco, Jul 14, 2007
    #2
    1. Advertisements

  3. thelotus99

    thelotus99 Guest

    thelotus99, Jul 16, 2007
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.