locked
Event ID 50015 on a Windows 2008 Server RRS feed

  • Question

  • Hello

    I would like to ask for assistance with Event ID 50015 on a Windows 2008 Server, please.

    I recently setup Network Policy Server and Routing and Remote Access on a Windows 2008 32bit Standard Edition (SP2) Domain Controller. Just one network connection is used. Users dial-in to a router, configured as a RADIUS client which forwards the requests to the domain controller. A second domain controller (Windows 2003 R2), running DHCP gives out addresses to the clients.

    VPN access works fine. No problems at all. It is used for remote file access and for Remote Desktop Connections by myself to the servers/clients.

    During the last month Event ID 50015 has been logged in the System Event Log more than 2500 times. Here is the event:

    Log Name:      System
    Source:        Microsoft-Windows-RasServer
    Date:          04/08/2011 15:20:18
    Event ID:      50015
    Task Category: None
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      Phobos.htlincs.local
    Description:
    Specified interface was not present in MGM.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-RasServer" Guid="{29D13147-1C2E-48EC-9994-E29DFE496EB3}" EventSourceName="IPMGM" />
        <EventID Qualifiers="0">50015</EventID>
        <Version>0</Version>
        <Level>3</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2011-08-04T14:20:18.000Z" />
        <EventRecordID>185494</EventRecordID>
        <Correlation />
        <Execution ProcessID="0" ThreadID="0" />
        <Channel>System</Channel>
        <Computer>Phobos.htlincs.local</Computer>
        <Security />
      </System>
      <EventData Name="IPMGMLOG_IF_NOT_FOUND">
      </EventData>
    </Event>

    I have looked at the article http://technet.microsoft.com/en-us/library/cc733704(WS.10).aspx and have run the mrinfo command with the following results:

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\administrator.HTLINCS>mrinfo 192.168.0.10
    192.168.0.10 (Phobos.htlincs.local) [version 60.1,mtrace,snmp]

    C:\Users\administrator.HTLINCS>mrinfo 192.168.0.145
    192.168.0.145 (Phobos.htlincs.local) [version 60.1,mtrace,snmp]

    192.168.0.10 is the static address of the W2k8 domain controller. 192.168.0.145 is the DHCP address given to the Internal interface as reported in Routing and Remote Access.

    I don't know if this is something that I should be worried about. There are a lot of 50015 events being logged. Can I safely ignore this or is there a problem?

    Can anyone help with this?

    Thanks!

    Thursday, August 4, 2011 3:19 PM

Answers

All replies

  • Hi,

    Thank you for your post.

    192.168.0.10 is the static address of the W2k8 domain controller. 192.168.0.145 is the DHCP address given to the Internal interface as reported in Routing and Remote Access.

    DC (Phobos.htlincs.local) is not recommended to configure multihomed interface, so I suggest to disable 192.168.0.145 interface and then restart RRAS service on RRAS server.

    If your RRAS server is also DC server, suggest you to use another server run RRAS role and new server two interfaces ip address assign to different ip subnet.

    If there are more inquiries on this issue, please feel free to let us know.


    Regards,
    Rick Tan
    Wednesday, August 10, 2011 2:02 AM
  • Hello, Rick

    Thank you for your reply.

    I understand that it is best practice not to have a multi-homed DC, but we have no choice. We are unable to use another server for RRAS.

    My question was can this event be ignored?

    The error reported does not seem to affect VPN access. The VPN is not used for anything other than downloading/uploading files and IMAP by the staff and for Remote Desktop access by me. Neither myself, nor the other staff have experienced any issues using the VPN.

    Thanks.


    Wednesday, August 10, 2011 8:12 AM
  • Hi,

    My question was can this event be ignored?
    Yes, if your server & clients have no DNS issue.
    I suggest you read Ace blog article to follow manual steps to configure a Multihomed DC
    http://msmvps.com/blogs/acefekay/archive/2009/08/17/multihomed-dcs-with-dns-rras-and-or-pppoe-adapters.aspx

     


    Regards,
    Rick Tan
    • Marked as answer by Mark-Blood Thursday, August 11, 2011 10:46 AM
    Thursday, August 11, 2011 7:30 AM
  • Hi, Rick

    That's great, and many thanks for the link. I appreciate it :)

    Cheers!

    Thursday, August 11, 2011 10:46 AM
  • Hi RealBlood, did you get your problem resolved?

     

    I'm currently experiencing the same 50015 error.

     

    multiple server situation, primary DC (also handling RRAS) is Server 08 R2. Single NIC with switches and a Draytek Vigor so I do not think it's multi-homed (I may have misunderstood the term given in the link)

    We have no problems with the VPN or remote access, but the log is filling quickly. I tried disabling the logging on RRAS but these are still logged. Can anyone advise how to at least stop them logging?

     

    mrinfo "router's address" returns "The host specified did not reply to mrinfo"

    Friday, August 12, 2011 7:49 AM
  • Hi RealBlood, did you get your problem resolved?

     

    I'm currently experiencing the same 50015 error.

     

    multiple server situation, primary DC (also handling RRAS) is Server 08 R2. Single NIC with switches and a Draytek Vigor so I do not think it's multi-homed (I may have misunderstood the term given in the link)

    We have no problems with the VPN or remote access, but the log is filling quickly. I tried disabling the logging on RRAS but these are still logged. Can anyone advise how to at least stop them logging?

     

    mrinfo "router's address" returns "The host specified did not reply to mrinfo"


    Your situation would appear to be different to mine.

    Your server is multihomed - Open Server Manager>Network Policy and Access Services>IPV4>General and you will see your NIC listed, plus an Internal adaptor. This adaptor is virtual and will have a network address that is in the same subnet as your NIC. A multihomed machine does not need two or more NIC's to be multihomed.

    As your mrinfo results are different, I recommend starting your own thread as this one is marked as resolved and is unlikely to draw further attention from Microsoft.

     

    What you might want to consider in the meantime is to increase the size of the System log so that the 50015 events do not spam the log so much that they push older events out. Mine is set to 20MB and to automatically archive the log when it reaches 20MB and start a new one.

    As you can see from the answers here, there does not seem to be a solution to this. Because VPN and IMAP access remains unaffected I am ignoring this event.


    [edit]

    mrinfo needs to be run against your DC's IP address and the Internal adaptor's IP address

    Friday, August 12, 2011 3:58 PM