Event ID: 11 From Microsoft-Windows-RPC-Events Are Indicating Possible Memory Leaks With MMC

After finishing putting some brand new servers in place with Windows 2008 R2, installing its rolls and leaving a happy client I’m usually very happy about a job well done. That feeling can last for a while when doing the paperwork involved with the project. It can also go away blazingly fast when you get a call that there is an “RPC memory leak or something no right” on the servers.  Not good. So you remotely access the server and start looking. Luckily for me this was to be a non issue. The event logged was the following:

Log Name:      Application

Source:        Microsoft-Windows-RPC-Events

Date:          06/01/2011 22:26:18

Event ID:      11

Task Category: None

Level:         Warning

Keywords:     

User:          BIGBillyTheServerAdmin

Computer:      infra01.big.corp

Description:

Possible Memory Leak.  Application ("C:Windowssystem32mmc.exe" "C:Windowssystem32dhcpmgmt.msc" ) (PID: 5000) has passed a non-NULL pointer to RPC for an [out] parameter marked [allocate(all_nodes)].  [allocate(all_nodes)] parameters are always reallocated; if the original pointer contained the address of valid memory, that memory will be leaked.  The call originated on the interface with UUID ({6bffd098-a112-3610-9833-46c3f874532d}), Method number (2).  User Action: Contact your application vendor for an updated version of the application.

If you do a search for this you’ll find several unresolved news group and support site questions but also a Microsoft knowledge base article http://support.microsoft.com/kb/974814. It states that when you run the Server Manager Snap-in (servermanager.msc) for extended periods of time, the application event log warning as seen above is logged. It also says it only happens on DHCP servers, which is exactly a roll these servers have and the warning entry we see in the application even log. As long as the UUID is {6bffd098-a112-3610-9833-46c3f874532d} and you have no other indications of a memory leak you’re good to go. Armed with the link we quickly put the owners mind at easy and all is well again. Back to the paperwork.

Windows 2008 R2 & Windows 7 SP1 RTM Today!!!!

UPDATE: The Russian TechNet blog retracted it’s statement about SP1 being RTM. We’ll see.

A quick heads up. According to WinRumors Microsoft has confirmed the release of Windows 7 / Windows 2008 R2 SP1. http://www.winrumors.com/microsoft-confirms-windows-7-sp1-rtm-released-to-oems-today/?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=Feed%3A+WinRumors+%28WinRumors%29. My busy days just got busier. Cluster nodes with Hyper-V in the lab are being fired up already for final testing before wisely introducing it into production. My current workstation of cause is going to be updated faster than I can download the service pack Smile I’ll update this post with a download link when I get it.

The Dilbert® Life Series: Enterprise Architecture Revisited One Year Later

The Dilbert® Life series is a string of post on corporate culture from hell and dysfunctional organizations running wild. This can be quite shocking and sobering. The amount of damage that can be done by "merely" taking solid technology, methodologies, people and organizations, which you then abuse the hell out of, is amazing. A sense of humor will help when reading this. If you need to live in a sugar coated world were all is well and bliss and think all you do is close to godliness, stop reading right now and forget about the blog entries. It’s going to be dark. Pitch black at times actually, with a twist of humor, if you can laugh at yourself that is. And no, there is no light to shine on things, not even when you lite it. You see, pointing a beam in to the vast empty darkness of human nature doesn’t make you see anything. You do realize there is an endless, vast and cold emptiness out there. This is not unlike the cerebral content of way to many people I come across by in this crazy twilight zone called “the workplace”. I believe some US colleagues refer to those bio carbon life forms as “sheeple”.

Last year my very first blog post (https://blog.workinghardinit.work/2010/01/16/hello-world/) was about the one and only meeting I ever had with the Enterprise Architecture consultants that came in to help out at place where I do some IT Infrastructure Fu. Now one year, lots of time, money, training and Power Point slide decks after that meeting, the results on the terrain are nowhere to be seen. Sure there were lots of meetings, almost none of which I attended unless they dragged enterprise architecture into an IT related meeting on some other also vague action items like the IT strategy that was never heard of again. They’ve also created some new jobs specifications and lots of lip service and they’ll probably hire some more consultants to help out in 2011. But for now the interaction with and impact of any Enterprise Architecture on their IT infrastructure is nowhere to be found.

We put a good infrastructure plan in place for them. It’s pretty solid for 2011, pretty decent for 2012 and more like a road map for the time span 2013-2014. Meaning it’s flexible as in IT the world can change fast, very fast. But none of all this has come to be due to insights, needs, demands or guidance of any enterprise architecture, IT strategy or business plan.  No, it’s past experience and gut feeling, knowing the culture of the organization etc.  Creating strategies, building architectures is difficult enough in the best of circumstances. Combine this with fact that there is a bunch of higher pay grade roles up for grabs and the politics become very dominant. Higher pay grades baby? What do I need to get one? Skills and expertise in a very critical business area of cause!  Marketing yourself as a trusted business advisor, taught leader and architect becomes extremely important. As you can imagine getting the job done becomes a lot more difficult and not because of technical reasons. My predictions for 2011 are that by the end the year those pay grades will have been assigned. Together with a boatload of freshly minted middle management, who’ll be proud as hell and will need to assert their new found status, they’ll start handing out work to their staff.  Will that extra work materialize into results or only hold them back from making real progress? Well, we’ll need to wait for 2012 to know as 2011 will be about politics.

Basically from the IT infrastructure point of view and experience we have not yet seen an Enterprise Architecture and I don’t think they’ll have one in the next 12 months. Perhaps in 24 to 36 months but by then the game plan in IT infrastructure will be up and running. So realistically, I expect, if it leads anywhere against expectations, the impact of an Enterprise Architecture will be for 2014 and beyond. Which means an entirely new ball game and that will need a revised architecture. The success of the effort will no doubt be that they detected the need to change. This sounds uncomfortable similar to the IT strategy plan they had made. So for now we’ll do for them what’ we’ve always done. We’ll work with one year plans, two to three year roadmaps combined with a vision on how to improve the IT infrastructure. The most important thing is to stay clear of ambition and politics. Too much of that makes for bad technical decisions.

You got to love corporate bull. They don’t lie, no sir, they just sell bull crap. Which is worse, truth or lies don’t even matter, just the personal agendas. Liars at least, by the very fact of lying, acknowledge the value of truth, so much in fact, they’d rather have you not knowing it. Most consultancy firms send out kids that are naïve enough to believe the scripts and don’t even realize they are talking crap. They are told over and over again they are right, the best and they like to believe this so much they really do. It’s a bit like civil servants at the EU. Pay people double their market value, sweet talk their ego’s all day long and they will become prophets for the religion of the day. No, I’m not saying Enterprise Architecture is bull crap. I’m saying that way too many people & companies claiming to do enterprise architecture are turning it into exactly that. IT strategies, architectures that are so empty and void of content that all those binders are thrown in a drawer never to be seen again. A fool with a tool is still but a fool. Agile methodologies or tools don’t make your programmers agile gurus just like owning a race car doesn’t make you a race car pilot. All of this has happened before, and all of this will happen again. Every new, innovative process, methodology or concept falls victim to this. The money grabbing sales crowd gets there paws on it and starts selling it as competitive advantage or even innovation in a bottle to the corporate sheeple & management failures that should know better. They end with less money, loads of wasted time and a shitload of dead trees. As a side node, this whole “* Architect” thing  has runs it’s inflationary course. We need a new professional status currency once more. Take care and keep laughing clip_image001!

DCDIAG.EXE Problem On Windows 2008(R2): VerifyEnterpriseReferences indicates problem “Missing Expected Value” & points to Knowledge Base Article: Q312862

I was preparing to replace some 5 year old DELL PE1850 servers running Active Directory with new DELL R610 servers when the DCDIAG.exe output showed a possible issue with SYSVOL FRS and some missing expected value.

Starting test: VerifyEnterpriseReferences

The following problems were found while verifying various important DN

references.  Note, that  these problems can be reported because of

latency in replication.  So follow up to resolve the following

problems, only if the same problem is reported on all DCs for a given

domain or if  the problem persists after replication has hadreasonable time to replicate changes.

[1] Problem: Missing Expected Value

Base Object: CN=DC1,OU=CITY,OU=Domain Controllers,DC=corp,DC=com

Base Object Description: "DC Account Object"

Value Object Attribute Name: msDFSR-ComputerReferenceBL

Value Object Description: "SYSVOL FRS Member Object"

Recommended Action: See Knowledge Base Article: Q312862

The log points to a knowledge base article at  but that has no relevance here.This is a phantom error when found under following circumstances. It occurs on Windows 2008 or Windows 2008 R2 when you are running in Windows 2008 or Windows 2008 R2 domain functional level. Since Windows 2008 the File Replication Service (FRS) that sysvol uses has been replaced with the  Distributed File Replication service (DFRS) as used by DFS. If you’re not yet running DFRS when you can (which is highly recommend  http://blogs.technet.com/b/askds/archive/2010/04/22/the-case-for-migrating-sysvol-to-dfsr.aspx but not required), you’ll see this error show up when running DCDIAG.exe, so no real issue at all.

There are lots of posts on the internet pointing to various possible issues or causes: http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/2ce07c3f-9956-4bec-ae46-055f311c5d96/  & http://social.technet.microsoft.com/Forums/en-IE/winserverDS/thread/3062d40a-b73e-42ea-b27a-e817ee29abc1. But before you worry to much I suggest you check that everything that has to do with replication is running well. Is so and you’re running in Windows 2008 or Windows 2008 R2 domain functional level you’ll see this error go way once you complete your migration to DFRS.

So, to recapture, if you have a well maintained & working Active Directory, do not panic when you see some warning or failures in diagnostic test results. Make sure things are indeed fine and if you conclude that you don’t have any lingering problems, do some further research on what the real reason might . This pahnatom error is a fine example of this.

There is an absolute brilliant step by step guide to get the move from FRS to DFRS completed without a problem in a series by the storage team at Microsoft . You can find the first of a 5 part blog series over here http://blogs.technet.com/b/filecab/archive/2008/02/08/sysvol-migration-series-part-1-introduction-to-the-sysvol-migration-process.aspx.

While you are at it. If your still running DFS in Windows 2000 native mode, you might want to upgrade that as well. More on that later Smile