Microsoft KB Archive/273668

= Event 1339 Messages Are Logged When You Use Host Security =

Article ID: 273668

Article Last Modified on 2/20/2007

-

APPLIES TO


 * Microsoft Host Integration Server 2000 Standard Edition

-



This article was previously published under Q273668



SYMPTOMS
A system that is running the SNA Host Account Cache (User Credential Database) service that is included with Host Integration Server (HIS) 2000 may log the following event in the Application Event Log:

Event ID: 1339

Source: SNA Host Security

Description: The request database access is denied for the client account: NTAUTHORITY\\SYSTEM

NOTE: The event description may only contain two backslashes (\\) for the client account.

In this case, the Event 1339 is benign and does not cause any problems with host security functionality.



CAUSE
The Windows Management Instrumentation (WinMgmt.exe) service causes the SNA Manage Agent (MngAgent.exe) service to send a UDI_GET_VALID_DOMS_NT request to the SNA Host Account Cache database under some circumstances.

WinMgmt.exe runs under the local system account and this account cannot be authenticated by the Host Account Cache database. The failure to authenticate this account results in the Event 1339 being logged in the Application Event Log.



RESOLUTION
To resolve this problem, obtain the latest service pack for Host Integration Server 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

328152 How to Obtain the Latest Host Integration Server 2000 Service Pack



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Host Integration Server 2000 Service Pack 1.



MORE INFORMATION
If HIS 2000 and the HIS 2000 clients are configured to use Active Directory, HIS 2000 clients will use WMI calls to retrieve specific configuration information from HIS 2000 servers. For example, a client that is running a 3270 emulator will make a WMI call to determine what 3270 LUs are assigned to the user who is making the request.

If host security is being used, these WMI calls may result in a UDI_GET_VALID_DOMS_NT call being sent to the Host Account Cache database by MngAgent.exe on the behalf of WinMgmt.exe.

The following are two scenarios that appear to generate the Event 1339 messages:
 * Running the 3270 client.
 * Running the 5250 client and then on the Session menu, clicking Session Configuration to select a remote APPC LU alias.

Keywords: kbbug kbfix kbhostintegserv2000presp1fix kbhostintegserv2000sp1fix KB273668

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.