none
Event 6037, lsasrv RRS feed

  • Question

  • Hi,

    Environment: SCOM 2007 R2 with CU 5.

    I'm getting the following error in the System Eventlog every 4 hours on all clients i installed the SCOM 2007 agent on:

    The program svchost.exe, with the assigned process ID 4152, could not authenticate locally by using the target name HOST/.. The target name used is not valid. A target name should refer to one of the local computer names, for example, the DNS host name.
     Try a different target name.

    The process ID varies, but always points to the Remote Registry service on the local machine.

    I have seen posts of people having the 6037 error, but always related to a target name http:/ which could not be resolved to a SPN.

    This would not apply here, because

    A: the error occurs on ALL servers i install the SCOM client to

    B: this error doesn't point to a specifice service like http or w3wp, just to HOST/..

    This issue seems exactly like this post , too bad i cannot find any followup on it.

     

    Anyone have any ideas?

     

    Thanks,


    Thursday, September 29, 2011 9:50 AM

Answers

  • This settings should fix it:

    HKLM\system\CurrentControlSet\Services\Lanmanserver\parameters

    DisableStrictNameChecking:DWORD=1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

    DisableLoopbackCheck:DWORD=1


    http://OpsMgr.ru/

    • Proposed as answer by Jay Pounds Thursday, March 1, 2012 3:44 PM
    • Marked as answer by Rik van Berendonk Monday, March 12, 2012 6:06 PM
    Friday, February 24, 2012 2:42 PM
    Moderator

All replies

  •  

    Hi,

     

    Could you please let us know if there were any changes before the issue occurred? If you disable an agent, will the issue persists on the computer?

     

    Meanwhile, please check the Event Log on the problematic computers; if there are any related errors, please let us know the details.

     

    Thanks.
    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, September 30, 2011 9:43 AM
    Moderator
  • Hi, we're having the exact same issue.

    Running only 2008 R2 systems.

    Thanks.

    Tuesday, October 4, 2011 9:13 AM
  • Hi Nicholas,

     

    Thanks for your reply.

    I am trying to get a remote login possibility for the customer so i can test some things.

    About the question of "Any changes before the errors occured" ; not that i know of.

    Also i was not able to find any related errors in the eventlogs unfortunately, so i am at a complete loss here.

     

    Tuesday, October 4, 2011 10:31 AM
  • Hi,


    Just checked some servers on this;

    When the OpsMgr Agent is disabled (or rather, the System Center Management service), the events no longer occur.

    When the agent is re-enabled the events return.

    Currently i have set up a SCOM monitor to keep track of the event occuring on all monitored servers.

    This way i hope to see more correlation in the events.

    Regards,

    rik

    Friday, October 14, 2011 8:57 AM
  • Hi rick,

    We see the same problems with lsaSrv on a few 2008R2 servers, stopping the system center management services on the servers resolves the error but this is not a solution for us

    did you find the cause of this issue?

    regards

    martijn

     

     

    Wednesday, November 2, 2011 1:01 PM
  • Hi martijn,

     

    Alas, no progres yet. Looks like i might have to make a MS ticket out of this one..

     

    regards

    rik

    Wednesday, November 2, 2011 6:52 PM
  • have this on newly installed MS Win2008R2. digging.

    so. +1

    Wednesday, November 2, 2011 7:05 PM
  • We have the same issue on our Win2007 R2 servers. It occurs every 4th hour.
    Monday, November 7, 2011 12:40 PM
  • I have the exact same issue but only on my Exchange Mailbox server. It is throwing the error every hour.
    It's not the load that breaks you down it's the way you carry it. ~Lou Holtz~
    Monday, November 28, 2011 4:57 PM
  • Hi,

    I have also the same issue on my newly installed Exchange 2010 SP1 Mailbox-Servers with Windows Server 2008 R2 SP1

    Tuesday, November 29, 2011 9:00 AM
  • Piling on. This occurs on our two Exchange 2010 SP1 mailbox servers, but not on any of our Exchange CAS/HT/UM servers. It sure would be nice to find a solution.  I stopped the SCOM service and the warnings stopped.  Restarted it and they start up again.  I noticed that the host name that appears in the event is the correct FQDN, but with a backslash on the end.  I asked the folks that manage SCOM to check on their end, and said they don't see any difference in the way these two Exchange servers are registered on the SCOM, and they said SCOM is successfully monitoring these servers.
    Tuesday, December 6, 2011 3:40 PM
  • I am also seeing these same errors on my Exchange 2010 SP1 mailbox servers.

    If anyone gets a fix please post it here.

    Thursday, December 15, 2011 8:29 AM
  • same issue here. Has anyone resolved this?

    Windows 2008 R2 + Exchange 2010 SP1 MBX + SCOM

    Wednesday, January 25, 2012 3:26 PM
  • Hello,

    I'm having the exact same issue - Event 6037 appears on Exchange 2010 mailbox server every hour on Windows 2008 R2 server with SCOM agent installed. Svchost.exe points to Remote Registry.

    If anyone has any ideas, I'd love to hear them!


    Jan
    Monday, February 6, 2012 3:05 PM
  • Did you try register the SPN?

    http://blogs.technet.com/b/jonathanalmquist/archive/2008/08/14/operations-manager-2007-spn-s.aspx

     

    Hope this can help,

     

    Regards,

    Mazen Ahmed

    Monday, February 6, 2012 7:46 PM
  • I have too this problem on Exchange Mailbox Servers. SPN needed is only for management servers.

    Friday, February 24, 2012 5:43 AM
  • And I also just noticed these today.  I see them going back for a month.  Originally once every 4 hours, then once every 2 hours.  Kind of odd.
    Friday, February 24, 2012 2:41 PM
  • This settings should fix it:

    HKLM\system\CurrentControlSet\Services\Lanmanserver\parameters

    DisableStrictNameChecking:DWORD=1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

    DisableLoopbackCheck:DWORD=1


    http://OpsMgr.ru/

    • Proposed as answer by Jay Pounds Thursday, March 1, 2012 3:44 PM
    • Marked as answer by Rik van Berendonk Monday, March 12, 2012 6:06 PM
    Friday, February 24, 2012 2:42 PM
    Moderator
  • Hi Alexey,

    Thanks for the reply, gonna try it out soon, i'll post back the results.

    Cheers,

    Rik

    Friday, March 2, 2012 9:53 AM
  • Alexey

    I have the same issue in a Lync deployment on Windows 2008 R2 virtual server deployment

    Only happening on servers that are monitored by SCOM

    I used your regedit's and it seems to have resolved the issues.

    thanks

    Sunday, March 4, 2012 5:15 PM
  • I made the two registry settings recommended by Alexey and we are still getting LsaSrv 6037 events on both Exchange 2010 mailbox servers.  :-(
    • Proposed as answer by Dmitry Zobnin Thursday, June 9, 2016 9:47 AM
    Monday, March 5, 2012 4:11 PM
  • You must restart the server for DisableLoopbackCheck to take effect

    http://OpsMgr.ru/

    Monday, March 5, 2012 6:43 PM
    Moderator
  • I am happy to report that after restarting the servers the warning has been eliminated.  Thanks so much, Alexey!
    Wednesday, March 7, 2012 12:14 PM
  • This settings should fix it:

    HKLM\system\CurrentControlSet\Services\Lanmanserver\parameters

    DisableStrictNameChecking:DWORD=1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

    DisableLoopbackCheck:DWORD=1


    http://OpsMgr.ru/

    interesting...

    just googled around these values.

    after you set  DisableStrictNameChecking=1 and reboot computer,  you will have two options.

    1. more secure... Update BackConnectionHostNames=.
    2. or less secure... set  DisableLoopbackCheck=1

    both ways described in kb http://support.microsoft.com/kb/896861

    • Proposed as answer by PvDro Thursday, October 9, 2014 12:21 PM
    Wednesday, March 7, 2012 2:26 PM
  • Hi,
    Is the proposed solution can be applied to the "Home Premium" version of Windows 7x64?

    WodzuAS      
    • Edited by WodzuAS Tuesday, March 26, 2013 9:43 AM
    Tuesday, March 26, 2013 9:31 AM
  • Hi,

    these settings would work on any modern Windows OS. Just out of curiosity, why do you need this on Home OS?


    http://OpsMgr.ru/

    Tuesday, March 26, 2013 10:23 AM
    Moderator
  • Hi,

    Microsoft Fix it 50306 does not apply for Windows 7 x64 "Home Premium".

    (Applies to Microsoft Office Communications Server 2007 Enterprise Edition, when used with: Microsoft Windows Server 2003 Service Pack 1 ). 

    WodzuAS  

    • Edited by WodzuAS Saturday, September 21, 2013 5:56 PM
    Tuesday, March 26, 2013 10:29 AM
  • This settings should fix it:

    HKLM\system\CurrentControlSet\Services\Lanmanserver\parameters

    DisableStrictNameChecking:DWORD=1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

    DisableLoopbackCheck:DWORD=1


    http://OpsMgr.ru/

    This Question may be old, But solution worked like a Charm in SCVMM as well.

    Thanks a lot.


    Gautam.75801

    Tuesday, May 8, 2018 6:34 PM