Common causes and solutions of browser Event ID 8021 and Event ID 8032 on domain master browsers

A computer that runs Microsoft Windows NT or Microsoft Windows 2000 or later operating systems may occasionally log one or more of the following events in the System log.

Event message 1

Event ID: 8021
Source: Browser
Type: Warning
Description: The browser was unable to retrieve a list of servers from the browser master \\CurrentMasterBrowser on the network \Device\Protocol_NetworkAdaptor. The data is the error code.
Data Words:
0000: 00000005

Sample text:
The browser was unable to retrieve a list of servers from the browser master \\SERVER44 on the network \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}. The data is the error code.

Event message 2

Event ID: 8032
Source: Browser
Type: Error
Description: The Browser service has failed to retrieve the backup list too many times on transport \Device\Protocol_NetworkAdaptor. The backup browser is stopping.
Data Words:
0000: 00000005

Sample text:
The Browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}. The backup browser is stopping.

This problem may occur when the following conditions are true:

• Your computer is a multihomed computer. A multihomed computer links at the same time to two or more subnets by using multiple network cards.
• Your computer is a master browser.
• Your computer is running the TCP/IP protocol.

This problem occurs when one or more of the following is true:

• Your computer performs an acting role as a master browser because of a forced election.
• Your computer network cards are linked to the same subnet.
• Your computer network cards are not linked directly to the same subnet, but are linked indirectly to the same subnet through other subnets that they are connected to.
• The master browser is using an incorrect subnet mask.

Note A virtual network adaptor (NLB/WLBS) could make a system logically multihomed. Also, active Routing and Remote Access or VPN connections on a computer make it multihomed.

Troubleshooting

Typically, these browser events appear every two hours. However, these browser events may not always have a major affect on the system's browser functionality. Use the following guidelines to troubleshoot these events.

• Multihomed browsers

  For correct browser operation, you should not operate multihomed Windows NT 4.0 PDCs or Windows 2000 and later PDC Emulators. . Do not make a server multihomed if that server performs an active browser role. Make sure the Computer Browser service is disabled on multihomed computers. See the "Workaround" section for information about how to disable the Computer Browser service.

• Name resolution infrastructure

  Name resolution among all browsers is very important. Therefore, make sure that you establish a robust name resolution infrastructure with WINS. For browsing to work correctly, name resolution must be functional. We strongly recommend that all WINS servers point to themselves as Primary and Secondary WINS in the TCP/IP configuration. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  150737  (http://support.microsoft.com/kb/150737/ ) Setting primary and secondary WINS server options

• Event details

  The transport that did not work can be identified in Event Viewer by looking at the transport value that is shown in the message text. Consider the following examples:
  • The browser was unable to retrieve a list of servers from the browser master current_browser_master on the network \Device\protocol_netcard
  • The Browser service has failed to retrieve the backup list too many times on transport \Device\protocol_netcard.
  In the sample text listed in the Symptoms section, the failing transport is \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}. The prefix NetBT_Tcpip_ indicates that NetBIOS over TCP/IP and {D995825F-F226-49D6-8221-503BE0A9BBAD} is the GUID of the adaptor. The data section of the events may contain important information for troubleshooting. Change the view of the data section of the event from bytes to words. Investigate the status code in the data words of the events. The error code gives an additional hint for the reason why the event has been logged.
  
  At a command prompt, type Net Helpmsg ErrorNumber to obtain an explanation of that error.
  
  You can use the command-line utility Browstat or the NetBIOS Browsing Console (Browcon.exe) to investigate browsing errors more. For more information about browser errors, click the following article numbers to view the articles in the Microsoft Knowledge Base:
  188305  (http://support.microsoft.com/kb/188305/ ) Troubleshooting the Microsoft Computer Browser service
  818092  (http://support.microsoft.com/kb/818092/ ) Description of NetBIOS Browsing Console (Browcon.exe)

• Verify connectivity

  1. Test for general intermittent network connectivity issues.
     For more information about how to troubleshoot network connectivity problems, click the following article number to view the article in the Microsoft Knowledge Base:
     325487  (http://support.microsoft.com/kb/325487/ ) How to troubleshoot network connectivity problems
  2. Determine whether you can connect to the server \\current_browser_master at the time of the events that are logged on the master browser server or the backup browser server. Drive mappings or UNC connections work independently from browser operation. Therefore, a net use command should succeed. If this fails, investigate this problem first.

• Access restrictions

  1. On the \\current_browser_master server, where \\current_browser_master is the computer that is the master browser, verify that the "Access this computer from the network" user right is granted to the Everyone group.
  2. In the System log, verify that the Server service has no intermittent problems, such as problems caused by file system filter drivers.
  3. Locate the following registry subkey:
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA
  4. Verify the value of the RestrictAnonymous entry. When the RestrictAnonymous entry has a value of 2 on a Windows 2000-based domain controller, the Browser service cannot retrieve domain lists or server lists from backup browsers, master browsers, or domain master browsers if these computers also have the value of the RestrictAnonymous entry set to 2. Therefore, any program that relies on the Browser service does not function correctly. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
     246261  (http://support.microsoft.com/kb/246261/ ) How to use the RestrictAnonymous registry value in Windows 2000

• Network Load Balancing (NLB)

  If you are running NLB on Windows 2000 Advanced Server, or if you are running Windows Load Balancing Service (WLBS) on Windows NT 4.0 Server, set the appropriate bindings for NLB and WLBS. To do this, follow these steps:
  1. Enable File and Printer Sharing for Microsoft Networks and Client for Microsoft Networks on the dedicated network adaptors.
  2. Disable File and Printer Sharing for Microsoft Networks and Client for Microsoft Networks on the virtual NLB interface cards.
  For more information about the appropriate settings on Microsoft Windows NT Server 4.0, click the following article numbers to view the articles in the Microsoft Knowledge Base:
  197992  (http://support.microsoft.com/kb/197992/ ) How to configure WLBS using a single network interface card
  197991  (http://support.microsoft.com/kb/197991/ ) How to configure WLBS using multiple network interface cards
  Important Make sure to disable the bindings from the Windows Internet Name Service (WINS) client to the physical network adaptor when you use a single network adaptor. When you use multiple network adaptors, disable the WINS client from the cluster adaptor.

• Cluster service (MSCS) cluster

  If the events are seen on a MSCS cluster node, bind only TCP/IP protocol to the heartbeat adaptor. Unbind WINS and other protocols from the heartbeat network adaptor. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:
  193890  (http://support.microsoft.com/kb/193890/ ) Recommended WINS configuration for Microsoft Cluster Server
  258750  (http://support.microsoft.com/kb/258750/ ) Recommended private "Heartbeat" configuration on a cluster server

• Microsoft Loopback adaptor

  On systems that have the Microsoft Loopback adaptor enabled, verify that Netbios over TCP/IP is enabled on the LAN adaptor and not enabled on the Microsoft Loopback adaptor.

• Network Infrastructure

  If computers are hooked to a Cisco switch that is running a PIX firewall, the PIX may have a known issue with responding incorrectly to ARP queries. Turn off the Proxy ARP feature on the PIX. If this step resolves the problem, contact Cisco Systems for an updated IOS version.

• Network adaptor teaming adaptors

  There are network adaptors and accompanying drivers available from some hardware manufacturers that provide fault tolerance. This technology lets you group network adaptor ports for a connection to a single physical segment. If connectivity through one port is not working, another port is automatically enabled. This operation is transparent to the operating system and other devices on the network.
  
  Note Support for the fault-tolerant technology, the hardware and the drivers, is the responsibility of the hardware manufacturer. Many hardware manufacturers have updated drivers to correct this problem. If problems that occur seem to be related to teaming, disable teaming when you troubleshoot the problem. If the problem is resolved when you disable teaming, seek assistance from the hardware manufacturer. Contact the hardware manufacturer and update the network adaptor drivers and agents to the latest available versions.

• Third-party software

  Third-party software can affect browsing issues. Some examples include the following:
  • SAMBA servers
  • Trend Micro antivirus software and antivirus software generally
  • Arc Serve backup client
  • Personal firewalls

WORKAROUND

Method 2: Use Registry Editor

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

Windows 2000

1. Click Start, click Run, type Regedt32, and then click OK.
2. Locate the following registry entry:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\
3. Change the value to of MaintainServerList to No.
4. Restart the computer.

Windows NT and Windows XP

1. Click Start, click Run, type Regedt32, and then click OK.
2. Locate the following registry entry:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\
3. Change the value to of MaintainServerList to false.
4. Restart the computer.

If the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\ MaintainServerList is No, this server is not a browser.

If the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\ MaintainServerList is Yes, this server becomes a browser.

The Computer Browser service tries to contact the master browser to obtain a current browser list. If the Computer Browser service cannot find the master browser, it forces an election and is a candidate to become the master browser. Additionally, setting MaintainServerList to Yes causes an election to be generated when the browser starts.

Method 3: Use the Service Controller (SC) utility

You can use the command-line Service Controller utilities Sc.exe and Netsvc.exe to switch the start value of a service. You can find these utilities in the Windows 2000 Resource Kit You can also use these utilities to remotely start and stop a service.

To disable the Browser service on a remote system type the following command at a command prompt:Note The option name includes an equal sign followed by a blank character.

For more information about the Sc.exe tool, see the Sc-dev.txt file. This file is located in the Windows 2000 Resource Kit.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

The Computer Browser service maintains an updated list of computers on the network. The service also supplies this list to computers. The browser maintains all its server information on a per-transport basis. A transport is the physical network card bound to a protocol. The browser service depends on the workstation service to collect a list of servers over all installed transport and adaptor combinations.

There is a common misunderstanding about when the Computer Browser service is needed. You should run this service only on Windows-based systems that perform the role of a browser:

• Domain Master
• Master
• Backup
• Potential

The Workstation service (redirector) on your computer is responsible for obtaining the list of servers and domains in the network.

The term "physically multihomed" refers to having more than one network interface. The term "logically multihomed" refers to having more than one IP address on one interface.

The browsing role can be disabled on a transport basis, as described here, or on an adaptor basis by using the following registry subkey:
Data type: REG_MULTI_SZ
String Value:
NetBT_name of network adaptor driver to be disabled (on Windows NT 4.0 systems)
NetBT_Tcpip_{adaptor GUID} (On Windows 2000 and later systems)

If you have more than two network adaptors in the multihomed Windows based server, type each driver instance that you want to disable on a separate line in the multi-string field.

Caution Follow these steps to unbind a transport from the browser only if you are sure that this transport is no longer required on the browser computer because of redundancy. Make sure to back up the registry first.

To determine the transport number to be unbound, run the net config workstation command, the net config workstation command, the ipconfig/all command, and the browstat unbindtransport number command at a command prompt. To do this, use the following procedure.

Note The Browstat utility is included in the Windows 2000 Support Tools. For more information the Windows 2000 Support Tools, click the following article number to view the article in the Microsoft Knowledge Base:

1. At a command prompt, type net config workstation, and then press ENTER.
   
   The output on Windows 2000 or later operating systems will be similar to the following:

   Workstation active on
           NetbiosSmb (000000000000)
           NetBT_Tcpip_{adaptor GUID} (MAC Address)
           NetBT_Tcpip_{adaptor GUID} (MAC Address)
           NetBT_Tcpip_{adaptor GUID} (MAC Address)
           NetBT_Tcpip_{adaptor GUID} (MAC Address)

2. At a command prompt, type Ipconfig/all, and then press ENTER.
   The output will show the MAC address for each adaptor:
   

   Physical Address. . . . . . . . . : 00-02-A5-44-7C-E5

   
   
   Now you have determined an association of the MAC address for a specific adaptor together with the transport (device\protocol_GUID) for the browser service.
   
   Note A Netdiag output shows the association of the MAC address (Physical Address), and GUID for a specific adaptor. It also shows the list of transports that are currently bound to the browser.
3. At the command prompt, type browstat dumpnet, and then press ENTER.
   This command will list the transports (device/protocol_GUID) that are bound to the computer browser service.
   
   The output on Windows 2000 or later operating systems will be similar to the following:
   

   List of transports currently bound to the browser
   1 \Device\NetBT_Tcpip_{A5CC1CF0-B511-48B5-84C2-AB2FABD39EFD}
        2 \Device\NetBT_Tcpip_{4D6B03BC-1539-46C3-A10D-C5C8E5D25A4B}
        3 \Device\NetBT_Tcpip_{D995825F-F226-49D6-8221-503BE0A9BBAD}
        4 \Device\NetBT_Tcpip_{C9FAA151-E451-4B54-8C75-0EB2F77CCB5F}

   
   
   Note the number that appears in front of the transports (\Device\protocol_GUID). Select the one for the transport that you want to unbind.
4. At the command prompt, type the following at a command line and then press ENTER.
   
   Note transport_number is the number that comes before the transport of the output in step 3, and the transport has the format of device\protocol_GUID.
   
   browstat unbind transport_number
   
   This command unbinds the \Device\NetBT_Tcpip_{4AA35768-983C-4A7C-B266-357BCB4BB160} from the browser service.
5. To verify that the procedure worked correctly, type browstat dumpnet at a command prompt, and then press ENTER.
   
6. To display the status of a domain, type browstat status at the command prompt, and then press ENTER.

The Browstat utility has the following additional commands:
Usage: browstat Command [Options | /HELP] Where Command is one of the following:
ELECT ( EL) - Force election on remote domain
GETBLIST ( GB) - Get backup list for domain
GETMASTER ( GM) - Get remote Master Browser name (by using NetBIOS)
GETPDC ( GP) - Get PDC name (by using NetBIOS)
LISTWFW (WFW) - List WFW servers that are actually running browser
STATS (STS) - Dump browser statistics
STATUS (STA) - Display status about a domain
TICKLE (TIC) - Force remote master to stop
VIEW ( VW) - Remote NetServerEnum to a server or domain on transport
DUMPNET ( DN) - Display the list of transports bound to browser

There is an additional Browstat command option: Usage: browstat unbind transport [EmulatedDomain] Unbind a transport from the browser.

Technical support for x64-based versions of Microsoft Windows

Your hardware manufacturer provides technical support and assistance for x64-based versions of Windows. Your hardware manufacturer provides support because an x64-based version of Windows was included with your hardware. Your hardware manufacturer might have customized the installation of Windows with unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with your x64-based version of Windows. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware.

For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site: For product information about x64-based versions of Microsoft Windows Server 2003, visit the following Microsoft Web site:

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base: