Product

All Kodak^® workflow systems

Operating system

• Microsoft^® Windows Server^® 2003
• Microsoft Windows^® 2000

Error

In Event Viewer on the server having the problem:
Event ID: 2025
Source: SRV
Description: The server has detected an attempted Denial-Of-Service attack from client \\SERVERNAME, and has disconnected the connection.. Note that this log entry may not appear in all cases.

In Event Viewer on client computers or other servers trying to access the server having the problem:
Event ID: 50
Source: MRxSmb
Description: {Lost Delayed-Write Data} The system was attempting to transfer file data from buffers to \Device\LanmanRedirector. The write operation failed, and only some of the data may have been written to the file.

Symptoms

The error message appears, with a balloon over SERVERNAME containing the message: Windows - Delayed Write Failed. Client computers are disconnected from the system.

On Kodak Prinergy^® systems, Prinergy Administrator lists the Prinergy servers as stopped, or as ARAXI service is running but cannot connect to server, even though Prinergy is running.

Event ID 2025 may appear in the System Event log.

Cause

A Windows 2003 SP2 and a Windows 2000 SP4 hotfix introduced a denial-of-service attack detection feature. This feature may sometimes incorrectly detect heavy network use, such as on a Prinergy primary server or a job home server, as a denial-of-service attack.

A denial-of-service attack is an attempt to make a computer resource unavailable to its intended users, often by saturating the target computer with external communications requests so that it cannot respond to legitimate traffic, or responds so slowly as to be effectively unavailable.

Solution

For Prinergy, Evo, Print Console, and other non-portal products, disable the denial-of-service attack detection by adding the registry value DisableDos=1.

For InSite and other Portal products, add the registry value MaxMpxCt=256 (dec) and remove the registry value DisableDos. If the problem recurs, increase the value of MaxMpxCt. (MaxMpxCt can have a value up to 65535.)

For detailed procedures, see Microsoft KB article 898468.

Warning: Portal products which are normally placed in front of a firewall may be vulnerable to denial-of-service attacks. It is not advisable to disable this feature for any server that is not secured behind a firewall.

See also

Microsoft KB article 898468: Event ID 2025 is logged in the System log on a Windows Server 2003-based computer.

Keywords

Administrator, networking, virus, Windows 2000, Windows 2003, Workshop

Technical contact

Robyn Lundstrom

Submitted by

Robyn Lundstrom

Date submitted

17 Jan 2007