none
vmxnet3 NIC Resetting RRS feed

  • Question

  • We are seeing random network interface resets on several of our VMs. Whenever the reset happens, event id 10400 is logged in the system event log.

    During our preliminary investigation we aren't seeing any Application or System events around the reset. 

    Is there a tool that could extract the logs from other event collectors with a specific time range? We are hoping to find something under Applications and Services logs around the time of the reset.

    What's making it this issue more challenging is the resets are happening even with no one logged on to the system.

    Could someone post the conditions what would cause the NIC reset by the OS? (Windows 10 1607)

    VMWare 6.5, VMWare tools 10.2.5

    Thank you


    • Edited by net_tech Sunday, June 10, 2018 10:45 PM
    Sunday, June 10, 2018 10:45 PM

All replies

  • Hi, 

    I have tested in my environment and noticed that when we reset the Network settings, we can get system logs as below:

    We can just know when it was reset but difficult to know who change it. Hope this information could be helpful for you. 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, June 11, 2018 7:46 AM
    Owner
  • In addition, As a workaround, if we can try to audit the network related service from the side to know who reset Network interface. 

    In short, you need to create a domain based GPO linked to the OU where target computer resides. In the GPO, go to Computer Configuration->Policies->Windows Settings->Security Settings->System Services, locate the service you want to audit, and define its policy settings by clicking on Edit Security commmand button, which will display Security dialog box. Click on Advanced and define Auditing settings from there

    Refer to http://www.windowsitpro.com/article/auditing/access-denied-auditing-users-who-might-be-starting-and-stopping-services


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Monday, June 11, 2018 7:54 AM
    Owner
  •  Hi Kate and thank you for your posts, unfortunately I don't see any helpful info in the information provided. 

    Thanks for trying 

    Wednesday, June 13, 2018 10:49 PM
  • Have you tried to audit the changes of network settings?

    Best Regards, StarSprite

    Thursday, June 14, 2018 12:48 AM
  • No we have not tried to audit. Could you please elaborate?

    We were actually thinking of getting the counters to watch in perfmon to see what actually triggers the reset. 

    There is also an NDIS log that we just enabled and are waiting for the next network reset.

    

    Thursday, June 14, 2018 2:18 AM
  • Hi, 

    To configure audit for network related service, please refer to these steps: 

    In the GPO, go to Computer Configuration->Policies->Windows Settings->Security Settings->System Services, locate the service you want to audit, and define its policy settings by clicking on Edit Security commmand button, which will display Security dialog box. 

    In addition, please know that when resetting happens, such services will restart. 

    In addition, after deploy this policy, please run gpudate /force on client PC to make sure it used. 

    We can see the audit log under Event viewer -> Windows logs -> Security. 


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, June 15, 2018 3:06 AM
    Owner
  • Kate,

    Thank you for the post, but what you are suggesting isn't helpful. Please stop and remove your posts. 

    Thank you

    Friday, June 15, 2018 3:10 AM