Event ID 2025 is logged in the System log on a 64-bit version of Windows Server 2003 (898468)
The information in this article applies to:
- Microsoft Windows Server 2003, Datacenter x64 Edition
- Microsoft Windows Server 2003, Enterprise x64 Edition
- Microsoft Windows Server 2003, Standard x64 Edition
- Microsoft Windows Server 2003, Datacenter Edition for Itanium-based Systems
- Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base: 256986 Description of the Microsoft Windows registry SYMPTOMS
The following event is logged in the System log of Event Viewer on a computer that is running a 64-bit version of Microsoft Windows Server 2003:
Event ID: 2025
Source: SRV
Description: "The server has detected an attempted Denial-Of-Service attack from client \\computer_name, and has disconnected the connection."
Additionally, client computers are disconnected from the server.
CAUSE
This problem may occur under high-stress conditions, such as when there is heavy traffic on the network.
WORKAROUNDWarning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
To work around this problem, use one of the following methods. Method 1: Increase the MaxMpxCt value
Increase the MaxMpxCt value for the Server Service. MaxMpxCt is the maximum number of concurrent outstanding network requests that are allowed. By default, this value is set to 50 in Windows Server 2003. To avoid this issue, increase the MaxMpxCt value.
To do this, follow these steps:
- Click Start, click Run, type regedit in the Open box, and then click OK.
- Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
- On the Edit menu, point to New, and then click DWORD Value.
- Type MaxMpxCt for the name of the DWORD value, and then press ENTER.
- Right-click MaxMpxCt, and then click Modify.
- In the Value data box, type a value from the range of 50 through 65535, and then click OK.
Note By following these steps, you increase the upper limit on the number of concurrent commands that can be outstanding between a client and a server. However, make sure that you do not set this value too high. The larger the number of outstanding connections, the more memory that will be used by the server. If you set this value too high, the server may run out of resources such as paged pool memory. Therefore, do not significantly increase this value unless you know that there will be a limited number of clients that are connected to the server at the same time. - Quit Registry Editor.
Method 2: Disable denial of service attack detection Important These steps may increase your security risk. These steps may also make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We recommend the process that this article describes to enable programs to operate as they are designed to, or to implement specific program capabilities. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this process in your particular environment. If you choose to implement this process, take any appropriate additional steps to help protect your system. We recommend that you use this process only if you really require this process.
You can disable denial of service attack detection at the operating system level. By doing this, you prevent errors from being logged. To do this, follow these steps:
- Click Start, click Run, type regedit in the Open box, and then click OK.
- Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters
- On the Edit menu, point to New, and then click DWORD Value.
- Type DisableDos for the name of the DWORD value, and then press ENTER.
- Right-click DisableDos, and then click Modify.
- In the Value data box, type 1 to disable denial of service attack detection, and then click OK.
Note To enable denial of service attack detection, type 0 in the Value data box. - Quit Registry Editor.
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Modification Type: | Major | Last Reviewed: | 1/31/2006 |
---|
Keywords: | kbtshoot kbnetwork kbwinservnetwork KB898468 kbAudITPRO |
---|
|