Applies to: Windows Server 2008

Any failure of DNS can cause DNS Event ID 4000, DNS Event ID 4015, Userenv Event ID 1053, and User Event ID 1054 appear in Event Viewer. If this situation is happening intermittently in Windows Server 2008, the likely resolution is to apply a software patch (hotfix 961775). Questions related to hotfixes should be referred to Microsoft Support (

If you have not yet done any DNS troubleshooting, then 
  1. Ensure that the DNS server service is running on the computer providing DNS services and logging this error. If it is not running, you should start it. If it is already running, you may want to restart it. See Start, stop, pause, or restart a DNS server for steps on how to accomplish that task.
  2. Verify the IP configuration of the DNS server and any of the servers that depend upon it. For example, if you are seeing Event ID 1053 and 1054 on other computers, this is likely because the DNS failure is not allowing those computers to refresh their Group Policy Objects (GPOs).

There are many other conditions that can cause DNS issues that can help to be identified by DCDIAG in Windows Server 2008 and NETDIAG in Windows Server 2003, Windows Server 2000, and their derivative operating system versions. You may want to try running DCDIAG /FIX and in pre-Windows Server 2008 operating systems NETDIAG /FIX to help resolve DNS issues from a command prompt. In Windows Server 2008, be sure to run from an elevated command prompt.

Additional information 

Note: This article was inspired by the Directory Services forum thread DNS Stop Working on Windows Server 2008 (event ih 4000,4015,1053,1054)