Event Log has batches of Event ID: 1000

Don Thimsen · Post by **Don Thimsen** » Mon Aug 01, 2005 6:25 am

This weekend I took a look at the event log on our vault machine and noticed batches of event id 1000s. There can be four or five within a minute, or groups sometimes spread over 30 minutes. I think this started happening after the conversion to vault 3.1.0.

I haven't noticed any problems or degredation on the vault machine. The OS is Win2000 Server with all service packs and updates.

Event ID: 1000
Event Source: perflib
Message: Access to performance data was denied to ASPNET as attempted from C:\WINNT\System32\WBEM\WinMgmt.exe

There is some info in the MS KB about the event:

http://support.microsoft.com/default.as ... -us;226494

However, the ASPNET account looks to be disabled on our domain.
Also, we don't have anything special security-wise in vault. Vault uses a the machine account, and I don't think we use any folder security features.

Any idea what might be going on?

Don

lbauer · Post by **lbauer** » Mon Aug 01, 2005 8:11 am

We haven't seen this error before, so we'll need to gather more info.

This section of the KB article appears to relate to the perflib error in Win2000 Server.

Detail Text: Access to performance data was denied to (username) as attempted from (calling module name)

Interpretation: The following key is checked for security access: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

If the user associated with the client thread or process token is not on the ACL for this key then this event is posted.

Are you using sthe MACHINE\ASPNET account for the IIS Process Model?

Does the Vault MACHINE\ASPNET have access to this registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

Don Thimsen · Post by **Don Thimsen** » Mon Aug 01, 2005 9:58 am

Are you using sthe MACHINE\ASPNET account for the IIS Process Model?

Yes.

Does the Vault MACHINE\ASPNET have access to this registry key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

No. But I've now added the MACHINE\ASPNET account to the register entry using REGEDT32. I gave the new entry read permission.

I'll keep an eye on the event log for awhile.

Thanks,
Don

Don Thimsen · Post by **Don Thimsen** » Mon Aug 01, 2005 7:27 pm

After adding the MACHINE\ASPNET account to the registry key, the Vault machine ran all day without any additional event log errors.

Don

lbauer · Post by **lbauer** » Mon Aug 01, 2005 7:48 pm

Thanks for the update. Let us know if you encounter these errors again.

I'll log a bug to investigate registry permissions for the APNET account on Windows 2000.