{"id":759,"date":"2010-08-18T16:07:30","date_gmt":"2010-08-18T08:07:30","guid":{"rendered":"http:\/\/www.alfredivy.per.sg\/blogger\/?p=759"},"modified":"2015-11-23T22:38:21","modified_gmt":"2015-11-23T14:38:21","slug":"to-err-is-divine","status":"publish","type":"post","link":"https:\/\/www.alfredivy.sg\/blogger\/2010\/08\/to-err-is-divine\/","title":{"rendered":"To Err is divine"},"content":{"rendered":"<p>Have you ever wondered what do the hex codes in the Windows Server event viewer meant?<\/p>\n<blockquote><p>Event Type:\u00a0\u00a0 \u00a0Failure Audit<br \/>\nEvent Source:\u00a0\u00a0 \u00a0Security<br \/>\nEvent Category:\u00a0\u00a0 \u00a0Account Logon<br \/>\nEvent ID:\u00a0\u00a0 \u00a0675<br \/>\nDate:\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a08\/18\/2010<br \/>\nTime:\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a03:45:54 PM<br \/>\nUser:\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0NT AUTHORITY\\SYSTEM<br \/>\nComputer:\u00a0\u00a0\u00a0 ComputerName<br \/>\nDescription:<br \/>\nPre-authentication failed:<br \/>\nUser Name:\u00a0\u00a0\u00a0 username<br \/>\nUser ID:\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 Domainname\\username<br \/>\nService Name:\u00a0\u00a0 \u00a0krbtgt\/domainname.suffix<br \/>\nPre-Authentication Type:\u00a0\u00a0 \u00a00x2<br \/>\nFailure Code:\u00a0\u00a0 \u00a00x18<br \/>\nClient Address:\u00a0\u00a0\u00a0 xx.yy.zz.kk<\/p>\n<p>For more information, see Help and Support Center at http:\/\/go.microsoft.com\/fwlink\/events.asp.<\/p><\/blockquote>\n<p>Using the err tool with 0x18 code, it reveals the following:<\/p>\n<blockquote><p>F:\\&gt;err 0x18<br \/>\n# for hex 0x18 \/ decimal 24 :<br \/>\nBTH_ERROR_PAIRING_NOT_ALLOWED\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 bthdef.h<br \/>\nREFERENCE_BY_POINTER\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 bugcodes.h<br \/>\nEVENT_MSCEP_FAIL_NUMBER_FROM_MESSAGE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ceplog.mc<br \/>\n# SCEP Add-on cannot find the certificate&#8217;s serial number in<br \/>\n# the client&#8217;s PKCS7 message (%2).\u00a0 %3\u00a0 Please find support<br \/>\n# information at http:\/\/%1\/certsrv\/mscep\/mscephlp.htm.<br \/>\nMSG_E_CANNOT_GET_CSP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 certlog.mc<br \/>\n# Certificate Services did not start: Unable to get<br \/>\n# certificate server CSP information from registry for %1.<br \/>\n# %2.<br \/>\nCR_APM_VETOED\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 cfgmgr32.h<br \/>\nLOG_MODULE_LKQRM\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 clusvmsg.h<br \/>\nLLC_STATUS_INVALID_BUFFER_LENGTH\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 dlcapi.h<br \/>\nIAAPI_BADIDENTIFIER\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 iaapi.h<br \/>\n# \/* Bad identifier in a parsing display value *\/<br \/>\nKDC_ERR_PREAUTH_FAILED\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 kerberr.h<br \/>\n# Pre-authentication information was invalid<br \/>\nPOLICY_ERRV_SUBNET_UNAUTH_USER_FLOW_RATE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 lpmapi.h<br \/>\nMAPI_DIAG_ALPHABETIC_CHARACTER_LOST\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 mapidefs.h<br \/>\nMSIDBERROR_BADKEYTABLE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 msiquery.h<br \/>\n# table in KeyTable column of _Validation table could not be<br \/>\n# found\/loaded<br \/>\nNRC_SABORT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 nb30.h<br \/>\n# \/* session ended abnormally\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *\/<br \/>\nNDDE_CANT_ACCESS_SERVER\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 nddeapi.h<br \/>\nNMERR_OUT_OF_RANGE\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 netmon.h<br \/>\nOLE_ERROR_NOT_LINK,\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ole.h<br \/>\n# Not a linked object\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 *\/<br \/>\nMSG_DOMHIER_PEER_TIMEOUT\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 w32timemsg.mc<br \/>\n# Time Provider NtpClient: No valid response has been<br \/>\n# received from domain controller %1<br \/>\n# after 8 attempts to contact it. This domain controller will<br \/>\n# be<br \/>\n# discarded as a time source and NtpClient will attempt to<br \/>\n# discover a<br \/>\n# new domain controller from which to synchronize.<br \/>\nERROR_BAD_LENGTH\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 winerror.h<br \/>\n# The program issued a command but the command length is<br \/>\n# incorrect.<br \/>\n# 18 matches found for &#8220;0x18&#8221;<\/p><\/blockquote>\n<p>Nice?\u00a0 Err tool pulls together all the error headers and returns all possible occurrence of the error code.\u00a0 It does not give you an definite answer the cause, but it points the possible way.\u00a0 This is originally an Exchange Server tool, but it works for Windows Server problems too.\u00a0 Watch your path.<\/p>\n<p>Download it <a href=\"http:\/\/www.microsoft.com\/downloads\/details.aspx?familyid=be596899-7bb8-4208-b7fc-09e02a13696c&amp;displaylang=en\" target=\"_blank\">here<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Using Err Tool to decode hex codes.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73,23],"tags":[374],"class_list":["post-759","post","type-post","status-publish","format-standard","hentry","category-windows","category-work","tag-windows"],"_links":{"self":[{"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/posts\/759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/comments?post=759"}],"version-history":[{"count":3,"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/posts\/759\/revisions"}],"predecessor-version":[{"id":3620,"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/posts\/759\/revisions\/3620"}],"wp:attachment":[{"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/media?parent=759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/categories?post=759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.alfredivy.sg\/blogger\/wp-json\/wp\/v2\/tags?post=759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}