Microsoft KB Archive/135404

= Troubleshooting browser Event ID 8021 and 8032 on master browsers =

Article ID: 135404

Article Last Modified on 10/11/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard x64 Edition
 * Microsoft Windows Server 2003, Datacenter x64 Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
 * Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows XP Professional
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows NT Workstation 3.5
 * Microsoft Windows NT Workstation 3.51
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Server 3.5
 * Microsoft Windows NT Server 3.51
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT Server 4.0, Terminal Server Edition
 * Microsoft Windows NT Server 4.0 Enterprise Edition

-



This article was previously published under Q135404



Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows registry



SUMMARY
''This article discusses some of the common causes of Event ID 8021 and Event ID 8032 on a master browser system. The article also provides different methods that you can use to work around the issue.''



SYMPTOMS
A computer that runs Microsoft Windows NT or Microsoft Windows 2000 or later operating systems may occasionally log one or more of the following events in the System log.

Event message 1 Event ID: 8021

Source: Browser

Type: Warning

Description: The browser was unable to retrieve a list of servers from the browser master \\ on the network \Device\ _. The data is the error code.

Data Words:

0000: 00000005

Sample text:

The browser was unable to retrieve a list of servers from the browser master \\SERVER44 on the network \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}. The data is the error code.

Event message 2 Event ID: 8032

Source: Browser

Type: Error

Description: The Browser service has failed to retrieve the backup list too many times on transport \Device\ _. The backup browser is stopping.

Data Words:

0000: 00000005

Sample text:

The Browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}. The backup browser is stopping.

This problem may occur when the following conditions are true:
 * Your computer is a multihomed computer. A multihomed computer links at the same time to two or more subnets by using multiple network cards.
 * Your computer is a master browser.
 * Your computer is running the TCP/IP protocol.



CAUSE
This problem occurs when one or more of the following is true:
 * Your computer performs an acting role as a master browser because of a forced election.
 * Your computer network cards are linked to the same subnet.
 * Your computer network cards are not linked directly to the same subnet, but are linked indirectly to the same subnet through other subnets that they are connected to.
 * The master browser is using an incorrect subnet mask.

Note A virtual network adaptor (NLB/WLBS) could make a system logically multihomed. Also, active Routing and Remote Access or VPN connections on a computer make it multihomed.



Troubleshooting
Typically, these browser events appear every two hours. However, these browser events may not always have a major affect on the system's browser functionality. Use the following guidelines to troubleshoot these events.  ==== Multihomed browsers ====

For correct browser operation, you should not operate multihomed Windows NT 4.0 PDCs or Windows 2000 and later PDC Emulators. . Do not make a server multihomed if that server performs an active browser role. Make sure the Computer Browser service is disabled on multihomed computers. See the "Workaround" section for information about how to disable the Computer Browser service.  ==== Name resolution infrastructure ====

Name resolution among all browsers is very important. Therefore, make sure that you establish a robust name resolution infrastructure with WINS. For browsing to work correctly, name resolution must be functional. We strongly recommend that all WINS servers point to themselves as Primary and Secondary WINS in the TCP/IP configuration. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

150737 Setting primary and secondary WINS server options

 ==== Event details ====

The transport that did not work can be identified in Event Viewer by looking at the transport value that is shown in the message text. Consider the following examples:  

The browser was unable to retrieve a list of servers from the browser master  on the network \Device\

 

The Browser service has failed to retrieve the backup list too many times on transport \Device\.

</li></ul>

In the sample text listed in the Symptoms section, the failing transport is \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}. The prefix NetBT_Tcpip_ indicates that NetBIOS over TCP/IP and {D995825F-F226-49D6-8221-503BE0A9BBAD} is the GUID of the adaptor. The data section of the events may contain important information for troubleshooting. Change the view of the data section of the event from bytes to words. Investigate the status code in the data words of the events. The error code gives an additional hint for the reason why the event has been logged.

At a command prompt, type Net Helpmsg ErrorNumber to obtain an explanation of that error.

You can use the command-line utility Browstat or the NetBIOS Browsing Console (Browcon.exe) to investigate browsing errors more. For more information about browser errors, click the following article numbers to view the articles in the Microsoft Knowledge Base:

188305 Troubleshooting the Microsoft Computer Browser service

818092 Description of NetBIOS Browsing Console (Browcon.exe)

</li> ==== Verify connectivity ====

<ol style="list-style-type: lower-alpha;"> Test for general intermittent network connectivity issues.

For more information about how to troubleshoot network connectivity problems, click the following article number to view the article in the Microsoft Knowledge Base:

325487 How to troubleshoot network connectivity problems

</li> Determine whether you can connect to the server \\ at the time of the events that are logged on the master browser server or the backup browser server. Drive mappings or UNC connections work independently from browser operation. Therefore, a net use command should succeed. If this fails, investigate this problem first.</li></ol> </li> ==== Access restrictions ====

<ol style="list-style-type: lower-alpha;"> On the  server, where   is the computer that is the master browser, verify that the "Access this computer from the network" user right is granted to the Everyone group.</li> In the System log, verify that the Server service has no intermittent problems, such as problems caused by file system filter drivers.</li> Locate the following registry subkey:

</li> Verify the value of the RestrictAnonymous entry. When the RestrictAnonymous entry has a value of 2 on a Windows 2000-based domain controller, the Browser service cannot retrieve domain lists or server lists from backup browsers, master browsers, or domain master browsers if these computers also have the value of the RestrictAnonymous entry set to 2. Therefore, any program that relies on the Browser service does not function correctly. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

246261 How to use the RestrictAnonymous registry value in Windows 2000

</li></ol> </li> ==== Network Load Balancing (NLB) ====

If you are running NLB on Windows 2000 Advanced Server, or if you are running Windows Load Balancing Service (WLBS) on Windows NT 4.0 Server, set the appropriate bindings for NLB and WLBS. To do this, follow these steps: <ol> Enable File and Printer Sharing for Microsoft Networks and Client for Microsoft Networks on the dedicated network adaptors.</li> Disable File and Printer Sharing for Microsoft Networks and Client for Microsoft Networks on the virtual NLB interface cards.</li></ol>

For more information about the appropriate settings on Microsoft Windows NT Server 4.0, click the following article numbers to view the articles in the Microsoft Knowledge Base:

197992 How to configure WLBS using a single network interface card

197991 How to configure WLBS using multiple network interface cards

Important Make sure to disable the bindings from the Windows Internet Name Service (WINS) client to the physical network adaptor when you use a single network adaptor. When you use multiple network adaptors, disable the WINS client from the cluster adaptor. </li> ==== Cluster service (MSCS) cluster ====

If the events are seen on a MSCS cluster node, bind only TCP/IP protocol to the heartbeat adaptor. Unbind WINS and other protocols from the heartbeat network adaptor. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

193890 Recommended WINS configuration for Microsoft Cluster Server

258750 Recommended private "Heartbeat" configuration on a cluster server

</li> ==== Microsoft Loopback adaptor ====

On systems that have the Microsoft Loopback adaptor enabled, verify that Netbios over TCP/IP is enabled on the LAN adaptor and not enabled on the Microsoft Loopback adaptor. </li> ==== Network Infrastructure ====

If computers are hooked to a Cisco switch that is running a PIX firewall, the PIX may have a known issue with responding incorrectly to ARP queries. Turn off the Proxy ARP feature on the PIX. If this step resolves the problem, contact Cisco Systems for an updated IOS version. </li> ==== Network adaptor teaming adaptors ====

There are network adaptors and accompanying drivers available from some hardware manufacturers that provide fault tolerance. This technology lets you group network adaptor ports for a connection to a single physical segment. If connectivity through one port is not working, another port is automatically enabled. This operation is transparent to the operating system and other devices on the network.

Note Support for the fault-tolerant technology, the hardware and the drivers, is the responsibility of the hardware manufacturer. Many hardware manufacturers have updated drivers to correct this problem. If problems that occur seem to be related to teaming, disable teaming when you troubleshoot the problem. If the problem is resolved when you disable teaming, seek assistance from the hardware manufacturer. Contact the hardware manufacturer and update the network adaptor drivers and agents to the latest available versions. </li> ==== Third-party software ====

Third-party software can affect browsing issues. Some examples include the following: <ul> <li>SAMBA servers</li> <li>Trend Micro antivirus software and antivirus software generally</li> <li>Arc Serve backup client</li> <li>Personal firewalls</li></ul> </li></ul>

<div class="workaround_section">

WORKAROUND
To work around this problem, use one of the following procedures: <ul> <li>Unbind all but one of the TCP/IP subnet transport bindings from the workstation service.</li> <li>Remove all but one of the network cards or remote access connections.</li> <li>At the command prompt, type the following command:

net stop browser

Note This option prevents you from receiving computer browse lists from other networks.</li></ul>

After you use one of these procedures, wait at least 10 minutes to see whether the errors still occur. If they do, continue troubleshooting by cross-referencing two pieces of information. First, note the transport that failed in the event log. For example, error 8021 displays a message that is similar to the following:

The browser was unable to retrieve a list of servers from the browser master \\ on the network \Device\NetBT_. The data is the error code.

The important data is NetBT_. This indicates the protocol and netcard binding, also known as an "endpoint." The potential protocols you may see are as follows:

Nbf_netcard = NetBEUI

NetBT_netcard = TCP/IP (NetBIOS over TCP/IP)

NwlnkIpx = IPX/SPX (NwLink) [will not indicate netcard]

NwlnkNB = NetBIOS over NwLink [will not indicate netcard]

After you have determined the failed protocol endpoint, verify the working status of the Browser service on all installed protocols with the Windows NT resource kit program Browstat.exe. At a command prompt, type the following command:

browstat status

This will enumerate the browser status on all endpoints. Look for the following message under each endpoint:

Browser is NOT active on domain

Ignore data about endpoints that list "NdisWanX," such as Device\NetBT_NdisWan5. These are remote access endpoints, which usually list the error anyway.

You should find a protocol match between these two steps. The next step is to record any important information about the protocol from Protocol Setup in the Network tool in Control Panel. Then, remove the protocol, restart the computer, and see whether the error no longer is logged.

Note Remember to wait at least 10 minutes.

Then, try to reinstall the protocol, to check for the error, and then to reapply the service pack that exists on the current Windows NT installation.

If the error persists after a protocol reinstallation, you may have problems with the network adaptor card. Contact the vendor to see if an updated driver is available or try another network adaptor card.

To permanently prevent multihomed Windows-based servers from becoming browser servers, use one of the following methods.

Method 1: Use Microsoft Management Console (MMC) or Control Panel
Windows NT 4.0
 * 1) Click Start, point to Settings, click Control Panel, and then double-click Services.
 * 2) Click Computer Browser, click Properties, and then click Manual.
 * 3) Click OK, click Close, and then restart the browser service or restart the computer.

Windows 2000 or later operating systems
 * 1) Click Start, click Run, and then type services.msc
 * 2) Right-click the Computer Browser service, and then click Properties.
 * 3) In the Startup type list, select Manual, and then click OK.
 * 4) Right-click the Computer Browser service, and then click Restart.

Method 2: Use Registry Editor
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

Windows 2000 <ol> <li>Click Start, click Run, type Regedt32, and then click OK.</li> <li>Locate the following registry entry:

</li> <li>Change the value to of MaintainServerList to No .</li> <li>Restart the computer.</li></ol>

Windows NT and Windows XP <ol> <li>Click Start, click Run, type Regedt32, and then click OK.</li> <li>Locate the following registry entry:

</li> <li>Change the value to of MaintainServerList to false .</li> <li>Restart the computer.</li></ol>

If the value of  is No, this server is not a browser.

If the value of is Yes, this server becomes a browser.

The Computer Browser service tries to contact the master browser to obtain a current browser list. If the Computer Browser service cannot find the master browser, it forces an election and is a candidate to become the master browser. Additionally, setting MaintainServerList to Yes causes an election to be generated when the browser starts.

Method 3: Use the Service Controller (SC) utility
You can use the command-line Service Controller utilities Sc.exe and Netsvc.exe to switch the start value of a service. You can find these utilities in the Windows 2000 Resource Kit You can also use these utilities to remotely start and stop a service.

To disable the Browser service on a remote system type the following command at a command prompt:

SC \\ServerName config Browser start= disabled

Note The option name includes an equal sign followed by a blank character.

For more information about the Sc.exe tool, see the Sc-dev.txt file. This file is located in the Windows 2000 Resource Kit.

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

<div class="moreinformation_section">

MORE INFORMATION
The Computer Browser service maintains an updated list of computers on the network. The service also supplies this list to computers. The browser maintains all its server information on a per-transport basis. A transport is the physical network card bound to a protocol. The browser service depends on the workstation service to collect a list of servers over all installed transport and adaptor combinations.

There is a common misunderstanding about when the Computer Browser service is needed. You should run this service only on Windows-based systems that perform the role of a browser:
 * Domain Master
 * Master
 * Backup
 * Potential

The Workstation service (redirector) on your computer is responsible for obtaining the list of servers and domains in the network.

The term "physically multihomed" refers to having more than one network interface. The term "logically multihomed" refers to having more than one IP address on one interface.

The browsing role can be disabled on a transport basis, as described here, or on an adaptor basis by using the following registry subkey:

Data type: REG_MULTI_SZ

String Value:

NetBT_ (on Windows NT 4.0 systems)

NetBT_Tcpip_{ } (On Windows 2000 and later systems)

If you have more than two network adaptors in the multihomed Windows based server, type each driver instance that you want to disable on a separate line in the multi-string field.

Caution Follow these steps to unbind a transport from the browser only if you are sure that this transport is no longer required on the browser computer because of redundancy. Make sure to back up the registry first.

To determine the transport number to be unbound, run the net config workstation command, the net config workstation command, the ipconfig/all command, and the browstat unbind command at a command prompt. To do this, use the following procedure.

Note The Browstat utility is included in the Windows 2000 Support Tools. For more information the Windows 2000 Support Tools, click the following article number to view the article in the Microsoft Knowledge Base:

301423 How to install the Windows 2000 Support Tools to a Windows 2000 Server-based computer

<ol> <li> At a command prompt, type net config workstation, and then press ENTER.

The output on Windows 2000 or later operating systems will be similar to the following: <pre class="fixed_text">Workstation active on       NetbiosSmb (000000000000)

NetBT_Tcpip_{adaptor GUID} (MAC Address) NetBT_Tcpip_{adaptor GUID} (MAC Address) NetBT_Tcpip_{adaptor GUID} (MAC Address) NetBT_Tcpip_{adaptor GUID} (MAC Address) </li> <li> At a command prompt, type Ipconfig/all, and then press ENTER.

The output will show the MAC address for each adaptor:

<pre class="fixed_text">Physical Address. . . . . . . . . : 00-02-A5-44-7C-E5

Now you have determined an association of the MAC address for a specific adaptor together with the transport (device\protocol_GUID) for the browser service.

Note A Netdiag output shows the association of the MAC address (Physical Address), and GUID for a specific adaptor. It also shows the list of transports that are currently bound to the browser. </li> <li> At the command prompt, type browstat dumpnet, and then press ENTER.

This command will list the transports (device/protocol_GUID) that are bound to the computer browser service.

The output on Windows 2000 or later operating systems will be similar to the following:

<pre class="fixed_text">List of transports currently bound to the browser

1 \Device\NetBT_Tcpip_{A5CC1CF0-B511-48B5-84C2-AB2FABD39EFD}

2 \Device\NetBT_Tcpip_{4D6B03BC-1539-46C3-A10D-C5C8E5D25A4B}

3 \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}

4 \Device\NetBT_Tcpip_{C9FAA151-E451-4B54-8C75-0EB2F77CCB5F}

Note the number that appears in front of the transports (\Device\protocol_GUID). Select the one for the transport that you want to unbind. </li> <li>At the command prompt, type the following at a command line and then press ENTER.

Note transport_number is the number that comes before the transport of the output in step 3, and the transport has the format of device\protocol_GUID.

browstat unbind

This command unbinds the \Device\NetBT_Tcpip_{4AA35768-983C-4A7C-B266-357BCB4BB160} from the browser service.</li> <li>To verify that the procedure worked correctly, type browstat dumpnet at a command prompt, and then press ENTER.

</li> <li>To display the status of a domain, type browstat status at the command prompt, and then press ENTER.</li></ol>

The Browstat utility has the following additional commands:

Usage: browstat  [Options | /HELP] Where   is one of the following:

ELECT ( EL) - Force election on remote domain

GETBLIST ( GB) - Get backup list for domain

GETMASTER ( GM) - Get remote Master Browser name (by using NetBIOS)

GETPDC ( GP) - Get PDC name (by using NetBIOS)

LISTWFW (WFW) - List WFW servers that are actually running browser

STATS (STS) - Dump browser statistics

STATUS (STA) - Display status about a domain

TICKLE (TIC) - Force remote master to stop

VIEW ( VW) - Remote NetServerEnum to a server or domain on transport

DUMPNET ( DN) - Display the list of transports bound to browser

There is an additional Browstat command option:

browstat unbind /help

Usage: browstat unbind  [ ] Unbind a transport from the browser.

<div class="moreinformation_section">

Technical support for x64-based versions of Microsoft Windows
Your hardware manufacturer provides technical support and assistance for x64-based versions of Windows. Your hardware manufacturer provides support because an x64-based version of Windows was included with your hardware. Your hardware manufacturer might have customized the installation of Windows with unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with your x64-based version of Windows. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware.

For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site:

http://www.microsoft.com/windowsxp/64bit/default.mspx

For product information about x64-based versions of Microsoft Windows Server 2003, visit the following Microsoft Web site:

http://www.microsoft.com/windowsserver2003/64bit/x64/default.mspx

<div class="references_section">