Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 53258 Source: MSDTC

MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: d:\nt\com\complus\dtc\dtc\adme\uiname.cpp:8751 CmdLine: C:\WINNT\system32\msdtc.exe Pid: <PID>
No Callstack (0).
I had this warning on a Windows 2003 R2 server after promoting it to a PDC. ME923977 fixed it in my case.
I had this error after removing SCOM 2007 agent on a Domain Controller. I fixed this by changing the registry key HKLM\Software\Microsoft\MSDTC, and giving to the "Network Service" account "Create Subkey" and "Set Value" Permissions.

Then from command line:

net stop msdtc
net start msdtc
Uninstall MSDTC service and install it again by using the steps listed below (it solved my problem).

In a command line prompt type:
msdtc -uninstall

Reboot your machine

In a command line prompt type:
msdtc -install

Manually start your msdtc service.
I had this error on a Win2003 R2 domain controller while extending the schema for Exchange Server 2007 on a virtual machine on which I was doing some tests. The server displayed an error about a lack of virtual memory. I increased the physical memory and rebooted. Afterwards, the schema extension worked correctly.
This issue can occur if Windows Server 2003 unsuccessfully tries to configure the Microsoft Distributed Transaction Coordinator (MS DTC) service to use the default security settings. See ME923977 for more information regarding this issue.

I received this event when I promoted the server to a PDC. I chose a different folder for the Active Directory logs (D:\WINDOWS\NTDS instead of the default C:\WINDOWS\NTDS). Giving the Network Service account read rights over the D:\WINDOWS\NTDS folder fixed this problem.
I stopped this error by changing the COM+ System Application service from "disabled" to "manual".
I received this error after replacing a Windows 2000 DC with a Windows 2003 DC, and demoting the old DC without having changed the site license server setting in AD Sites & Services. After changing the site license server, I needed to restart the License Logging service and add my CALs to the Licensing interface.
Try to reset the log with the following command: msdtc -resetlog.
I had this error after upgrading from Win2k to Win2k3 and applying SP1. I fixed this by changing the registry key HKLM\Software\Microsoft\MSDTC, and giving to the Network Service account "Create Subkey" and "Set Value" Permissions.
I corrected the error by doing the following:
1. Click Start -> Administrative Tools -> Component Services.
2. Click the "+" next to Component services to expand it.
3. Right click "My Computer" in the right window pane and select Properties.
4. Click the MS DTC Tab.
5. Click the "Security Configuration" button, a dialog box appears. Click "OK".
6. Click "OK" on the "My Computer Properties" box; this will take you back to the console.
7. Right click "My Computer" and select "Stop MS DTC" (this stops the MSDTC service.
8. Again, right click "My Computer" and select "Start MS DTC".
By following the above steps, it appears that this sets the MS DTC defaults resolving the error messages. Check the event log to verify that the problem is gone. You might also want to restart the server to verify this.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.