none
Event 4012 (Inside/Outside probe failed) RRS feed

  • Question

  • Every 1024 seconds, the NCSI Operational log on a DirectAccess client shows 3 instances of Event 4012 - Inside/Outside probe failed for interface 0x6000006000000, interface 0x83000005000000, and interface 0x83000006000000.  In each instance the Network Location Server (nls1.mydomain.com) name or address could not be resolved.

    Is this normal for a client that is outside the corpnet?   My guess is yes, but I wanted to ask since Event 4012 is a Warning event, as opposed to an Information event. 

    Event 4102 is part of a series of events that recur every 1024 seconds

    1.  Information Event 4009 - Inside/Outside detection started for interface ...

    2.  Warning Event 4012 - Inside/Outside probe failed for interface ...

    3.  Information Event 4010 - Inside/Outside detection finished for interface ... (OUTSIDE)

    Also, where do these interface identifiers come from?  The don't seem to show up in the output of ipconfig or netsh interface ipv6 show interfaces.

    Thanks.

    Tuesday, November 16, 2010 3:32 PM

Answers

  • Hi,

    Yes, these events are completely normal when the computer is outside the organization network.

    Inside/Outside detection ocurres periodically or on any network change event to determine whether you are inside or outside the corporate network. It does this by trying to access the Network Location server HTTPS URL. When the client is on the internet, this URL is not resolvable, the inside/outside detection "fails" and DirectAccess is used to provide corporate connectivity.

    The interface identifiers can be found using this command: netsh trace show int

    Wednesday, November 17, 2010 5:06 PM

All replies

  • Hi,

    Yes, these events are completely normal when the computer is outside the organization network.

    Inside/Outside detection ocurres periodically or on any network change event to determine whether you are inside or outside the corporate network. It does this by trying to access the Network Location server HTTPS URL. When the client is on the internet, this URL is not resolvable, the inside/outside detection "fails" and DirectAccess is used to provide corporate connectivity.

    The interface identifiers can be found using this command: netsh trace show int

    Wednesday, November 17, 2010 5:06 PM
  • Perfect.  Thanks.  I marked your reply as answer.
    Wednesday, November 17, 2010 5:14 PM
  • Hi,

    Yes, these events are completely normal when the computer is outside the organization network.

    Inside/Outside detection ocurres periodically or on any network change event to determine whether you are inside or outside the corporate network. It does this by trying to access the Network Location server HTTPS URL. When the client is on the internet, this URL is not resolvable, the inside/outside detection "fails" and DirectAccess is used to provide corporate connectivity.

    The interface identifiers can be found using this command: netsh trace show int


    Hi Yaniv,

    So is 1024s (17 mins) the default detection interval for the NLS then? I thought it only probed during a network change event as opposed to periodic.

    Cheers

    JJ


    Jason Jones | Forefront MVP | Silversands Ltd | My Blogs: http://blog.msedge.org.uk and http://blog.msfirewall.org.uk
    Thursday, November 18, 2010 1:40 AM
    Moderator
  • While waiting for an authoritative reply from Yaniv, I'll mention that after a network change event, the detection interval for all interfaces is reset and starts at 1s, then 2s, 4s, 8s, etc. until it maxes out at 1024s.
    Thursday, November 18, 2010 3:24 PM
  • sejongs answer sounds about right. most of the checks in NCSI have an increasing interval, which is reset on a network change event
    Thursday, November 18, 2010 7:51 PM