Alistair McMillan's questions

Since last week, machines in my network are not properly recording events from MsiInstaller. For instance:

The description for Event ID ( 11724 ) in Source ( MsiInstaller ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Product: Java Auto Updater -- Removal completed successfully., (NULL), (NULL), (NULL), (NULL), , .

Machines having this issue have the following Registry key "HKLM\SYSTEM\ControlSet001\Services\Eventlog\Application\MsiInstaller" set to:

"%SystemRoot%\system32\msimsg.dll"

While on machines that don't exhibit this behavior, the value is:

"C:\windows\system32\msi.dll"

Manually fixing the key's value fixes the issue and messages from MsiInstaller are successfully recorded with all details. However, I would like to understand what could have caused this. Any hints?

We have a number of process chains that run during the day loading data from our SAP R/3 system into SAP BW. They usually take about thirty minutes to run. This week they've been taking over an hour.

We compared this weeks runs against last weeks runs using /SSA/BWT but the runtimes of the individual load and activation steps are roughly the same.

The one thing that we've noticed is that the chain appears to pause ("On Hold") while SAPLRSSM deletes data from TESTDATRNRPART0.

Haven't managed to find much information about this online, but it seems to be a temporary table that is used when data is moved from the PSA tables to an InfoObject.

Can anyone tell us more about this table, and give us any pointers why it could be taking longer than normal?

My AD account gives me admin privileges on our PCs (allowing me to install software, add PCs to our domain, change network configuration, etc). But with a small handful of PCs (Windows 2000 and Windows XP) when I log in I only seem to have standard privileges.

It does accept my username and password so it must be talking to one of our domain controllers (can't be using cached credentials because it's the first time I'm logging into these PCs). I've tried pointing it to different domain controllers, but that doesn't make any difference.

I've tried refreshing group policy on the PCs, that completes without errors but doesn't make any difference.

I've tried moving the PCs into different OUs, including ones that other PCs work okay in, again it doesn't make any difference.

Asked my colleagues (who have similar accounts) to log in using their accounts. No difference.

What other things should I be checking?

We have a handful of Windows XP SP3 users whose mapped drives don't always appear in Windows Explorer when they initially log in. "net use" shows the drives are mapped correctly and they can see them in File Open dialogs in other applications. However they don't appear in Windows Explorer.

The current workaround we have is to kill Windows Explorer and then immediately start it again, then they do reliably appear.

Any ideas?

UPDATE: Still seeing this problem on some of our PCs. We're in the habit now of checking for any foreign DLLs being loaded into explorer.exe (Novell, Roxio, etc) and removing them, and making sure the PCs/users are in the correct OUs. This seems to solve the problem most of the time, but we've still got a number of PCs that won't show their network drives in My Computer when the PC first starts up even though they do show up in "net use" in a Command Prompt. But if you kill explorer.exe and launch it again, they do show up in My Computer. Anything else we should be checking for?

Trying to create a shortcut for someone else. It needs to point to files on one of their mapped drives. Instead of waiting for them to be available and create the shortcut on their PC, I was hoping to just create the shortcut on my PC and then transfer it over to their PC.

However Windows tries to validate the path as you create the shortcut and since I don't have access to the same files it is throwing up an error and won't create the shortcut.

Is there a way to create a shortcut without the path being validated?

When a colleague tries to open attachments in her email (Outlook 2003 talking to an Exchange 2007 server) they take ages to open. The files are relatively small, all less than 1MB.

We've tried creating a new Windows profile for the user and tried creating new Outlook profiles, however that hasn't made any difference.

And we've tried accessing her account from someone else's PC, and the attachments open immediately there.

The only thing that might provide a clue is that Process Monitor shows Outlook on her PC trying to write the file to a folder within the user's "Temporary Internet Files" folder with FAST I/O DISALLOWED errors. Can't find a lot of useful information on that message online though.

What causes the FAST I/O DISALLOWED errors?

And would that make opening attachments so incredibly slow that opening a < 1MB file can take a matter of minutes?

UPDATE: Discovered that this isn't just an issue with Outlook. Other files being accessed over the network show the same FAST I/O DISALLOWED errors in Process Monitor. The problem is just more noticeable with Outlook, because although other applications take a while to open files it isn't a matter of minutes.

User's AD accounts keep being locked automatically. I'm confident it isn't the obvious problem with users typing in the wrong password repeatedly.

Whenever this happens the System log in Event Viewer is full of messages like:

Event ID 8005 The browser has received a server announcement indicating that the computer X is a master browser, but this computer is not a master browser.

Event ID 8009 The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is X.

Event ID 8019 The browser was unable to promote itself to master browser. The browser will continue to attempt to promote itself to the master browser, but will no longer log any events in the event log in Event Viewer.

I'm assuming the two are related, but am having trouble finding anything to back this up.