Windows Server 2008 DNS Troubleshooting: DNS Event ID 4000 & 4015 and Userenv Event ID 1053 & 1054 (dsforum2wiki)
Applies to:
Windows Server 2008
Issue
Any failure of DNS can cause DNS Event ID 4000, DNS Event ID 4015, Userenv Event ID 1053, and User Event ID 1054 appear in Event Viewer. If this situation is happening intermittently in Windows Server 2008, the likely resolution is to apply a software patch (hotfix 961775). Questions related to hotfixes should be referred to Microsoft Support (http://support.microsoft.com/contactus).
Troubleshooting
If you have not yet done any DNS troubleshooting, then
- Ensure that the DNS server service is running on the computer providing DNS services and logging this error. If it is not running, you should start it. If it is already running, you may want to restart it. See Start, stop, pause, or restart a DNS server for steps on how to accomplish that task.
- Verify the IP configuration of the DNS server and any of the servers that depend upon it. For example, if you are seeing Event ID 1053 and 1054 on other computers, this is likely because the DNS failure is not allowing those computers to refresh their Group Policy Objects (GPOs).
There are many other conditions that can cause DNS issues that can help to be identified by DCDIAG in Windows Server 2008 and NETDIAG in Windows Server 2003, Windows Server 2000, and their derivative operating system versions. You may want to try running DCDIAG /FIX and in pre-Windows Server 2008 operating systems NETDIAG /FIX to help resolve DNS issues from a command prompt. In Windows Server 2008, be sure to run from an elevated command prompt.
Additional information
Troubleshooting DNS Servers (Windows Server 2003 timeframe update)
EventID.NET has information on Userenv Event ID 1053 and Userenv Event ID 1054 - When DNS stops working properly, group policy cannot be applied either. Therefore, you will receive additional errors from additional sources. That is the most likely reason, in the scenario presented here, that Userenv 1054 is displayed.
EventID.NET has information on DNS Event ID 4000 and DNS Event ID 4015 - There are a number of reasons that DNS can stop working. Review the comments of DNS Event ID 4015 on EventID.net to gain a broader perspective of what people have run into in the past.
Note: This article was inspired by the Directory Services forum thread DNS Stop Working on Windows Server 2008 (event ih 4000,4015,1053,1054)