Troubleshooting browser Event ID 8021 and 8032 on master browsers (135404)

Troubleshooting

Typically, these browser events appear every two hours. However, these browser events may not always have a major affect on the system's browser functionality. Use the following guidelines to troubleshoot these events.

Multihomed browsers
For correct browser operation, you should not operate multihomed Windows NT 4.0 PDCs or Windows 2000 and later PDC Emulators. . Do not make a server multihomed if that server performs an active browser role. Make sure the Computer Browser service is disabled on multihomed computers. See the "Workaround" section for information about how to disable the Computer Browser service.
Name resolution infrastructure
Name resolution among all browsers is very important. Therefore, make sure that you establish a robust name resolution infrastructure with WINS. For browsing to work correctly, name resolution must be functional. We strongly recommend that all WINS servers point to themselves as Primary and Secondary WINS in the TCP/IP configuration. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
150737 Setting primary and secondary WINS server options
Event details
The transport that did not work can be identified in Event Viewer by looking at the transport value that is shown in the message text. Consider the following examples:
- The browser was unable to retrieve a list of servers from the browser master current_browser_master on the network \Device\protocol_netcard
- The Browser service has failed to retrieve the backup list too many times on transport \Device\protocol_netcard.
In the sample text listed in the Symptoms section, the failing transport is \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}. The prefix NetBT_Tcpip_ indicates that NetBIOS over TCP/IP and {D995825F-F226-49D6-8221-503BE0A9BBAD} is the GUID of the adaptor. The data section of the events may contain important information for troubleshooting. Change the view of the data section of the event from bytes to words. Investigate the status code in the data words of the events. The error code gives an additional hint for the reason why the event has been logged.

At a command prompt, type Net Helpmsg ErrorNumber to obtain an explanation of that error.

You can use the command-line utility Browstat or the NetBIOS Browsing Console (Browcon.exe) to investigate browsing errors more. For more information about browser errors, click the following article numbers to view the articles in the Microsoft Knowledge Base:
188305 Troubleshooting the Microsoft Computer Browser service
818092 Description of NetBIOS Browsing Console (Browcon.exe)
Verify connectivity
1. Test for general intermittent network connectivity issues.
  For more information about how to troubleshoot network connectivity problems, click the following article number to view the article in the Microsoft Knowledge Base:
  325487 How to troubleshoot network connectivity problems
2. Determine whether you can connect to the server \\current_browser_master at the time of the events that are logged on the master browser server or the backup browser server. Drive mappings or UNC connections work independently from browser operation. Therefore, a net use command should succeed. If this fails, investigate this problem first.
Access restrictions
1. On the \\current_browser_master server, where \\current_browser_master is the computer that is the master browser, verify that the "Access this computer from the network" user right is granted to the Everyone group.
2. In the System log, verify that the Server service has no intermittent problems, such as problems caused by file system filter drivers.
3. Locate the following registry subkey:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA
4. Verify the value of the RestrictAnonymous entry. When the RestrictAnonymous entry has a value of 2 on a Windows 2000-based domain controller, the Browser service cannot retrieve domain lists or server lists from backup browsers, master browsers, or domain master browsers if these computers also have the value of the RestrictAnonymous entry set to 2. Therefore, any program that relies on the Browser service does not function correctly. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  246261 How to use the RestrictAnonymous registry value in Windows 2000
Network Load Balancing (NLB)
If you are running NLB on Windows 2000 Advanced Server, or if you are running Windows Load Balancing Service (WLBS) on Windows NT 4.0 Server, set the appropriate bindings for NLB and WLBS. To do this, follow these steps:
1. Enable File and Printer Sharing for Microsoft Networks and Client for Microsoft Networks on the dedicated network adaptors.
2. Disable File and Printer Sharing for Microsoft Networks and Client for Microsoft Networks on the virtual NLB interface cards.
For more information about the appropriate settings on Microsoft Windows NT Server 4.0, click the following article numbers to view the articles in the Microsoft Knowledge Base:
197992 How to configure WLBS using a single network interface card
197991 How to configure WLBS using multiple network interface cards
Important Make sure to disable the bindings from the Windows Internet Name Service (WINS) client to the physical network adaptor when you use a single network adaptor. When you use multiple network adaptors, disable the WINS client from the cluster adaptor.
Cluster service (MSCS) cluster
If the events are seen on a MSCS cluster node, bind only TCP/IP protocol to the heartbeat adaptor. Unbind WINS and other protocols from the heartbeat network adaptor. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:
193890 Recommended WINS configuration for Microsoft Cluster Server
258750 Recommended private "Heartbeat" configuration on a cluster server
Microsoft Loopback adaptor
On systems that have the Microsoft Loopback adaptor enabled, verify that Netbios over TCP/IP is enabled on the LAN adaptor and not enabled on the Microsoft Loopback adaptor.
Network Infrastructure
If computers are hooked to a Cisco switch that is running a PIX firewall, the PIX may have a known issue with responding incorrectly to ARP queries. Turn off the Proxy ARP feature on the PIX. If this step resolves the problem, contact Cisco Systems for an updated IOS version.
Network adaptor teaming adaptors
There are network adaptors and accompanying drivers available from some hardware manufacturers that provide fault tolerance. This technology lets you group network adaptor ports for a connection to a single physical segment. If connectivity through one port is not working, another port is automatically enabled. This operation is transparent to the operating system and other devices on the network.

Note Support for the fault-tolerant technology, the hardware and the drivers, is the responsibility of the hardware manufacturer. Many hardware manufacturers have updated drivers to correct this problem. If problems that occur seem to be related to teaming, disable teaming when you troubleshoot the problem. If the problem is resolved when you disable teaming, seek assistance from the hardware manufacturer. Contact the hardware manufacturer and update the network adaptor drivers and agents to the latest available versions.
Third-party software
Third-party software can affect browsing issues. Some examples include the following:
- SAMBA servers
- Trend Micro antivirus software and antivirus software generally
- Arc Serve backup client
- Personal firewalls

WORKAROUND

To work around this problem, use one of the following procedures:

Unbind all but one of the TCP/IP subnet transport bindings from the workstation service.
Remove all but one of the network cards or remote access connections.
At the command prompt, type the following command:
net stop browser
Note This option prevents you from receiving computer browse lists from other networks.

After you use one of these procedures, wait at least 10 minutes to see whether the errors still occur. If they do, continue troubleshooting by cross-referencing two pieces of information. First, note the transport that failed in the event log. For example, error 8021 displays a message that is similar to the following:

The browser was unable to retrieve a list of servers from the browser master \\server name on the network \Device\NetBT_driver name. The data is the error code.

The important data is NetBT_driver name. This indicates the protocol and netcard binding, also known as an "endpoint." The potential protocols you may see are as follows:

Nbf_netcard = NetBEUI
NetBT_netcard = TCP/IP (NetBIOS over TCP/IP)
NwlnkIpx = IPX/SPX (NwLink) [will not indicate netcard]
NwlnkNB = NetBIOS over NwLink [will not indicate netcard]

After you have determined the failed protocol endpoint, verify the working status of the Browser service on all installed protocols with the Windows NT resource kit program Browstat.exe. At a command prompt, type the following command:

browstat status

This will enumerate the browser status on all endpoints. Look for the following message under each endpoint:Browser is NOT active on domain Ignore data about endpoints that list "NdisWanX," such as Device\NetBT_NdisWan5. These are remote access endpoints, which usually list the error anyway.

You should find a protocol match between these two steps. The next step is to record any important information about the protocol from Protocol Setup in the Network tool in Control Panel. Then, remove the protocol, restart the computer, and see whether the error no longer is logged.

Note Remember to wait at least 10 minutes.
Then, try to reinstall the protocol, to check for the error, and then to reapply the service pack that exists on the current Windows NT installation.

If the error persists after a protocol reinstallation, you may have problems with the network adaptor card. Contact the vendor to see if an updated driver is available or try another network adaptor card.

To permanently prevent multihomed Windows-based servers from becoming browser servers, use one of the following methods. Method 1: Use Microsoft Management Console (MMC) or Control PanelWindows NT 4.0

Click Start, point to Settings, click Control Panel, and then double-click Services.
Click Computer Browser, click Properties, and then click Manual.
Click OK, click Close, and then restart the browser service or restart the computer.

Windows 2000 or later operating systems

Click Start, click Run, and then type services.msc
Right-click the Computer Browser service, and then click Properties.
In the Startup type list, select Manual, and then click OK.
Right-click the Computer Browser service, and then click Restart.

Method 2: Use Registry EditorWarning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

Windows 2000

Click Start, click Run, type Regedt32, and then click OK.
Locate the following registry entry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\
Change the value to of MaintainServerList to No.
Restart the computer.

Windows NT and Windows XP

Click Start, click Run, type Regedt32, and then click OK.
Locate the following registry entry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\
Change the value to of MaintainServerList to false.
Restart the computer.

If the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\ MaintainServerList is No, this server is not a browser.

If the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\ MaintainServerListis Yes, this server becomes a browser.

The Computer Browser service tries to contact the master browser to obtain a current browser list. If the Computer Browser service cannot find the master browser, it forces an election and is a candidate to become the master browser. Additionally, setting MaintainServerList to Yes causes an election to be generated when the browser starts. Method 3: Use the Service Controller (SC) utility You can use the command-line Service Controller utilities Sc.exe and Netsvc.exe to switch the start value of a service. You can find these utilities in the Windows 2000 Resource Kit You can also use these utilities to remotely start and stop a service.

To disable the Browser service on a remote system type the following command at a command prompt:

SC \\ServerName config Browser start= disabled

Note The option name includes an equal sign followed by a blank character.

For more information about the Sc.exe tool, see the Sc-dev.txt file. This file is located in the Windows 2000 Resource Kit.

MORE INFORMATION

The Computer Browser service maintains an updated list of computers on the network. The service also supplies this list to computers. The browser maintains all its server information on a per-transport basis. A transport is the physical network card bound to a protocol. The browser service depends on the workstation service to collect a list of servers over all installed transport and adaptor combinations.

There is a common misunderstanding about when the Computer Browser service is needed. You should run this service only on Windows-based systems that perform the role of a browser:

Domain Master
Master
Backup
Potential

The Workstation service (redirector) on your computer is responsible for obtaining the list of servers and domains in the network.

The term "physically multihomed" refers to having more than one network interface. The term "logically multihomed" refers to having more than one IP address on one interface.

The browsing role can be disabled on a transport basis, as described here, or on an adaptor basis by using the following registry subkey:

HKEY_LOCAL_MACHINE\CurrentControlSet\Services\Browser\Parameters\UnboundBindings

Data type: REG_MULTI_SZ
String Value:
NetBT_name of network adaptor driver to be disabled (on Windows NT 4.0 systems)
NetBT_Tcpip_{adaptor GUID} (On Windows 2000 and later systems)

If you have more than two network adaptors in the multihomed Windows based server, type each driver instance that you want to disable on a separate line in the multi-string field.

Caution Follow these steps to unbind a transport from the browser only if you are sure that this transport is no longer required on the browser computer because of redundancy. Make sure to back up the registry first.

To determine the transport number to be unbound, run the net config workstation command, the net config workstation command, the ipconfig/all command, and the browstat unbindtransport number command at a command prompt. To do this, use the following procedure.

Note The Browstat utility is included in the Windows 2000 Support Tools. For more information the Windows 2000 Support Tools, click the following article number to view the article in the Microsoft Knowledge Base:

301423 How to install the Windows 2000 Support Tools to a Windows 2000 Server-based computer

At a command prompt, type net config workstation, and then press ENTER.

The output on Windows 2000 or later operating systems will be similar to the following:

Workstation active on
        NetbiosSmb (000000000000)

        NetBT_Tcpip_{adaptor GUID} (MAC Address)
        NetBT_Tcpip_{adaptor GUID} (MAC Address)
        NetBT_Tcpip_{adaptor GUID} (MAC Address)
        NetBT_Tcpip_{adaptor GUID} (MAC Address)

At a command prompt, type Ipconfig/all, and then press ENTER.
The output will show the MAC address for each adaptor:
```
Physical Address. . . . . . . . . : 00-02-A5-44-7C-E5
```
Now you have determined an association of the MAC address for a specific adaptor together with the transport (device\protocol_GUID) for the browser service.

Note A Netdiag output shows the association of the MAC address (Physical Address), and GUID for a specific adaptor. It also shows the list of transports that are currently bound to the browser.
At the command prompt, type browstat dumpnet, and then press ENTER.
This command will list the transports (device/protocol_GUID) that are bound to the computer browser service.

The output on Windows 2000 or later operating systems will be similar to the following:
```
List of transports currently bound to the browser

1 \Device\NetBT_Tcpip_{A5CC1CF0-B511-48B5-84C2-AB2FABD39EFD}
     
2 \Device\NetBT_Tcpip_{4D6B03BC-1539-46C3-A10D-C5C8E5D25A4B}
     
3 \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}
     
4 \Device\NetBT_Tcpip_{C9FAA151-E451-4B54-8C75-0EB2F77CCB5F}
```
Note the number that appears in front of the transports (\Device\protocol_GUID). Select the one for the transport that you want to unbind.
At the command prompt, type the following at a command line and then press ENTER.

Note transport_number is the number that comes before the transport of the output in step 3, and the transport has the format of device\protocol_GUID.

browstat unbind transport_number

This command unbinds the \Device\NetBT_Tcpip_{4AA35768-983C-4A7C-B266-357BCB4BB160} from the browser service.
To verify that the procedure worked correctly, type browstat dumpnet at a command prompt, and then press ENTER.
To display the status of a domain, type browstat status at the command prompt, and then press ENTER.

The Browstat utility has the following additional commands:
Usage: browstat Command [Options | /HELP] Where Command is one of the following:
ELECT ( EL) - Force election on remote domain
GETBLIST ( GB) - Get backup list for domain
GETMASTER ( GM) - Get remote Master Browser name (by using NetBIOS)
GETPDC ( GP) - Get PDC name (by using NetBIOS)
LISTWFW (WFW) - List WFW servers that are actually running browser
STATS (STS) - Dump browser statistics
STATUS (STA) - Display status about a domain
TICKLE (TIC) - Force remote master to stop
VIEW ( VW) - Remote NetServerEnum to a server or domain on transport
DUMPNET ( DN) - Display the list of transports bound to browser

There is an additional Browstat command option:

browstat unbind /help

Usage: browstat unbind transport [EmulatedDomain] Unbind a transport from the browser.

REFERENCES

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

102878 Information on browser operation

117633 How browsing browsing over a multi-subnet TCP/IP network works in a domain and in a workgroup

133241 Browsing domain master browsers w/ multiple NICs and protocols

136712 Common questions about browsing with Windows

176321 Unable to resolve NetBIOS names through PPTP connection

180094 How to write an Lmhosts file for domain validation and other name resolution issues

188305 Troubleshooting the Microsoft Computer Browser service

181774 Multihomed issues with Windows NT

191611 Symptoms of multihomed browsers

197991 How to configure WLBS using multiple network interface cards

197992 How to configure WLBS using a single network interface card

224834 Setting filter to capture view only browser frames in network monitor

231312 Computer name missing in the Browsing list when server comment more than 48 characters

246261 How to use the RestrictAnonymous registry value in Windows 2000

254527 Browse list problems when File and Print Sharing is not installed

314872 Browse list issues on servers and clients include error messages about Event ID 8032 and inability to browse

278431 Using teaming adapters with network load balancing may cause network problems

301423 How to install the Windows 2000 Support Tools to a Windows 2000 Server-based computer

318232 The "browstat.exe status" command does not return a server list

325487 How to troubleshoot network connectivity problems

166819 Using Sc.exe and Netsvc.exe to control services remotely

818092 Description of NetBIOS Browsing Console (Browcon.exe)

830578 NBLookup.exe command-line tool

Troubleshooting browser Event ID 8021 and 8032 on master browsers (135404)

SUMMARY

SYMPTOMS

CAUSE