Knowledge Base for Windows

Description/Problem:
The new server installed with Microsoft Windows Server 2008 (Service Pack 2) was not able execute some applications. Small window informed us that “Error messages: A referral was returned from the server.” After several minutes of investigation we have identified that system has problem to execute unsigned applications. It happens if user try to execute unsigned application that requires elevation and policy called “User Account Control: Only elevate executables that are signed and validated” is enabled. To void this error message from system is necessary to make a change in Group Policy settings or simply modify one value in system registry.

Solution:

• Execute Command Line (CMD) as Administrator
• Execute RegEdit from Command Line
• Modify registry key and set value from “1″ to “0″

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
"ValidateAdminCodeSignatures"=dword:00000000

Description/Problem:
Everything worked fine for several weeks. After that we identify on Windows 2003 Terminal Server (Service Pack 2) strange issue related to Event ID 333 written to the system event log. This error indicate that operating system is not able to flush out or write to the registry hive.  The symptoms that accompany an Event ID 333 can vary between server hangs, “Insufficient resources exist to complete the requested service” errors, etc. In our case the solution was not so easy because all user profiles contain NTUSER.DAT file with size about 40 – 60 MB!

Solution:

• Took a backup of registry key and delete all the entries under it:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Hewlett-Packard

• Disable the PML Driver HPZ12 service,
• Took a backup of numerous entries under below registry keys and delete them:

  HKEY_LOCAL_MACHINE\System\ControlSet001\Control\DeviceClasses\{28d78fad-5a12-11d1-ae5b-0000f803a8c2}\##?#Root#RDPDR#0000#{28d78fad-5a12-11d1-ae5b-0000f803a8c2}
  HKEY_LOCAL_MACHINE\System\ControlSet003\Control\DeviceClasses\{28d78fad-5a12-11d1-ae5b-0000f803a8c2}\##?#Root#RDPDR#0000#{28d78fad-5a12-11d1-ae5b-0000f803a8c2}

• Delete all the user profiles on the Terminal Server,
• Logon to the Terminal Server with valid user account,
• Check that NTUSER.DAT file size will be about 200 – 400 kB.

Some additional information related to this issue are published also in TechNet article: Troubleshooting Event ID 333 Errors.

Description/Problem:
Several users inform us that they have problem on Microsoft Windows 2003 – Terminal Servers with latest version of HP Universal Print Driver (4.7). Installation of this driver was not finished successfully and now after each user login to the system the installer tries to continue with installation of “32 Bit HP CIO Components”. This installer is running for a long time without success and blocked also installation of another applications which are using Microsoft Installer (MSI). We identify that Microsoft Installer related to the “32 Bit HP CIO Components” creates thousands registry API calls as a result of over 2000 – 4000 subkeys created in the registry for every mapped printer. The HP Support provides to us information that issue will be fixed in next update for HP Universal Print Driver (version 4.7.x).

Solution:

• Stop Print Spooler service
• Remove manually all HP Universal Print Driver (4.7) from Print Server
• Client side – delete all the registry keys that were created by the 32 Bit HP CIO Components Installer
  
  • HKEY_USERS\.DEFAULT\Software\Hewlett-Packard
• Server side – delete all the registry keys that were created by the 32 Bit HP CIO Components Installer
  
  • HKEY_USERS\.DEFAULT\Software\Hewlett-Packard
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\ Terminal Server\Install\Software\ Hewlett-Packard
• Reinstall old version of HP Universal Print Driver on Print Server
• Restart server

More info about this issue is described on HP IT Resource Center Forum.

Description/Problem:
This article describe how to solve “faulting application EXCEL.EXE, version 12.0.6323.5000, time stamp 0x486cf744, faulting module OLEAUT32.dll, version 6.0.6000.16609, time stamp 0x4757753e, exception code 0xc0000005, fault offset 0x000041c0, process id 0x22c, application start time 0x01c90de938eb338b”.

Solution:

• Open System Registry (via command RegEdit)
• Find default registry key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Excel\Addins”
• Identify sub-key called “BtOfficeAddin.BtOfficeIntegration.1″
• Change value “LoadBehavior” from 3 to 0
• Close System Registry and try start Microsoft Excel

Description/Problem:
This article describes how to manually rebuild the performance counter library values.

Solution:
KB300956

Description/Problem:
It’s possible that after disabling Removable Storage Management (RSM) services on MS Windows 2000/2003, the system event viewer log reports Event ID 10005 which is related to the NtmsSvc DCOM errors. The same error is presented in the event viewer log if you are using HP OpenView Storage Data Protector as a backup solution.

Solution:
Support Veritas.com

Description/Problem:
Compact information about saving and restoring existing Windows shares which can be helpful for you during system reinstallation or system restore.

Solution:
KB125996

Description/Problem:
This article describes how to solve issue with backup. When you try to create a backup by using NTBackup.exe or by using a third-party backup program that uses the NT Backup API, the backup may not be completed successfully. This behavior may occur even if you run the program locally on the server.

Solution:
KB304101