Small Business Susan

Event 4143 and 53258

Event Type: Information
Event Source: MSDTC
Event Category: SVC
Event ID: 4143
Date:  3/24/2007
Time:  1:21:50 AM
User:  N/A
Computer: KIKIBITZFINAL
Description:
MS DTC has detected that a DC Promotion has happened since the last time the MS DTC service was started.


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: MSDTC
Event Category: SVC
Event ID: 53258
Date:  3/24/2007
Time:  1:21:50 AM
User:  N/A
Computer: KIKIBITZFINAL
Description:
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: d:\nt\com\complus\dtc\dtc\adme\uiname.cpp:9351, Pid: 1284
No Callstack,
 CmdLine: C:\WINDOWS\system32\msdtc.exe


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 05 00 07 80               …€   
Event Type: Warning
Event Source: MSDTC
Event Category: SVC
Event ID: 53258
Date:  3/24/2007
Time:  1:21:50 AM
User:  N/A
Computer: KIKIBITZFINAL
Description:
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: %1


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


Now before we freak out and go ohmygawdwhatdoesthismeantoourserver, to that message up in that event viewer, filter on those codes and you will find that this server has been doing that before this….


…in fact as far back as December…


Event Type: Warning
Event Source: MSDTC
Event Category: SVC
Event ID: 53258
Date:  12/7/2006
Time:  11:34:02 PM
User:  N/A
Computer: KIKIBITZFINAL
Description:
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: d:\nt\com\complus\dtc\dtc\adme\uiname.cpp:9280, Pid: 1800
No Callstack,
 CmdLine: C:\WINDOWS\system32\msdtc.exe


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 05 00 07 80               …€   


EventID.Net:
http://www.eventid.net/display.asp?eventid=4143&eventno=2461&source=MSDTC&phase=1
EventID.Net:
http://www.eventid.net/display.asp?eventid=53258&eventno=4493&source=MSDTC&phase=1


Sounds to me like this is a bit of SBS tripping on our toes and we can ignore it…but if you want to get the warning to go away….
Event ID 53258 is logged in Event Viewer after you install or remove Active Directory in Windows Server 2003:
http://support.microsoft.com/default.aspx?scid=kb;en-us;923977
 
(p.s.  I’m really a fan of www.eventid.net …and the subscription is cheap and so worth it)