DHCP Warnings Event ID 1003

Discussion in 'Wireless Networking' started by Mike Testovich, Jul 2, 2007.

  1. Since we implemented dot1x and all great security features that come with it
    on our WIRED network, I started seeing DHCP Warnings Event ID 1003 on all of
    my workstations configured for DHCP address assignment.

    Below is the text of the warning.

    Your computer was not able to renew its address from the network (from the
    DHCP Server) for the Network Card with network address 001143AD2813. The
    following error occurred:

    The operation was canceled by the user. . Your computer will continue to try
    and obtain an address on its own from the network address (DHCP) server.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    I tried disabling dhcp snooping on one of the ports, but the warnings didn't
    go away from the pc plugged in to that port. What's interesting is that XP
    machines log Event ID 1003 only at the start up, windows 2000 systems log
    this warning all day long (every 5 - 7 min) Looking at the DHCP log file
    located on my DHCP server under C:\WINDOWS\system32\dhcp\DhcpSrvLog-Wed.log
    confirms with my findings about XP machines accessing DHCP once a day at
    the start up and 2000 systems accessing DHCP all day long. (200 - 250
    records per PC)

    Below is the list of actions my 2000 and XP systems do. (XP systems do this
    once a day, 2000 systems show up in the log 200 times a day )

    32 DNS update successful
    30 DNS update request to the named DNS server
    11 A lease was renewed by a client.

    All of my ports are configured the same. Below is the config from one of the
    ports.


    interface GigabitEthernet0
    switchport access vlan 21
    switchport mode access
    switchport voice vlan 24
    switchport port-security maximum 2
    switchport port-security
    switchport port-security aging time 1
    switchport port-security violation restrict
    switchport port-security aging type inactivity
    ip arp inspection limit rate 50
    srr-queue bandwidth share 10 10 60 20
    srr-queue bandwidth shape 10 0 0 0
    queue-set 2
    mls qos trust device cisco-phone
    mls qos trust cos
    auto qos voip cisco-phone
    dot1x pae authenticator
    dot1x port-control auto
    dot1x host-mode multi-host
    dot1x reauthentication
    dot1x guest-vlan 666
    spanning-tree portfast
    spanning-tree bpduguard enable
    ip dhcp snooping limit rate 20

    Does anybody know what may trigger this warning on the workstation with
    DOT1x

    Implementation?



    Thank you.
     
    Mike Testovich, Jul 2, 2007
    #1
    1. Advertising

  2. If you do ipconfig /flushdns and then ipconfig /registerdns, does that fix the problem? This link may have more troubleshooting tips.

    Event ID 1003 - Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address <MAC address>.
    http://www.chicagotech.net/wineventid.htm

    Bob Lin, MS-MVP, MCSE & CNE
    Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
    How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
    "Mike Testovich" <> wrote in message news:%...
    Since we implemented dot1x and all great security features that come with it
    on our WIRED network, I started seeing DHCP Warnings Event ID 1003 on all of
    my workstations configured for DHCP address assignment.

    Below is the text of the warning.

    Your computer was not able to renew its address from the network (from the
    DHCP Server) for the Network Card with network address 001143AD2813. The
    following error occurred:

    The operation was canceled by the user. . Your computer will continue to try
    and obtain an address on its own from the network address (DHCP) server.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    I tried disabling dhcp snooping on one of the ports, but the warnings didn't
    go away from the pc plugged in to that port. What's interesting is that XP
    machines log Event ID 1003 only at the start up, windows 2000 systems log
    this warning all day long (every 5 - 7 min) Looking at the DHCP log file
    located on my DHCP server under C:\WINDOWS\system32\dhcp\DhcpSrvLog-Wed.log
    confirms with my findings about XP machines accessing DHCP once a day at
    the start up and 2000 systems accessing DHCP all day long. (200 - 250
    records per PC)

    Below is the list of actions my 2000 and XP systems do. (XP systems do this
    once a day, 2000 systems show up in the log 200 times a day )

    32 DNS update successful
    30 DNS update request to the named DNS server
    11 A lease was renewed by a client.

    All of my ports are configured the same. Below is the config from one of the
    ports.


    interface GigabitEthernet0
    switchport access vlan 21
    switchport mode access
    switchport voice vlan 24
    switchport port-security maximum 2
    switchport port-security
    switchport port-security aging time 1
    switchport port-security violation restrict
    switchport port-security aging type inactivity
    ip arp inspection limit rate 50
    srr-queue bandwidth share 10 10 60 20
    srr-queue bandwidth shape 10 0 0 0
    queue-set 2
    mls qos trust device cisco-phone
    mls qos trust cos
    auto qos voip cisco-phone
    dot1x pae authenticator
    dot1x port-control auto
    dot1x host-mode multi-host
    dot1x reauthentication
    dot1x guest-vlan 666
    spanning-tree portfast
    spanning-tree bpduguard enable
    ip dhcp snooping limit rate 20

    Does anybody know what may trigger this warning on the workstation with
    DOT1x

    Implementation?



    Thank you.
     
    Robert L [MVP - Networking], Jul 2, 2007
    #2
    1. Advertising

  3. Robert L [MVP - Networking] schreef:
    > If you do ipconfig /flushdns and then ipconfig /registerdns, does that
    > fix the problem? This link may have more troubleshooting tips.
    >
    > *Event ID 1003*
    > <http://www.chicagotech.net/troubleshooting/eventid1003.htm> - Your
    > computer was not able to renew its address from the network (from the
    > DHCP Server) for the Network Card with network address <MAC address>.
    > <http://www.chicagotech.net/troubleshooting/eventid1003.htm>
    > http://www.chicagotech.net/wineventid.htm
    >
    > Bob Lin, MS-MVP, MCSE & CNE
    > Networking, Internet, Routing, VPN Troubleshooting on
    > http://www.ChicagoTech.net
    > How to Setup Windows, Network, VPN & Remote Access on
    > http://www.HowToNetworking.com
    >
    > "Mike Testovich" < <mailto:>>
    > wrote in message news:%...
    > Since we implemented dot1x and all great security features that come
    > with it
    > on our WIRED network, I started seeing DHCP Warnings Event ID 1003
    > on all of
    > my workstations configured for DHCP address assignment.
    >
    > Below is the text of the warning.
    >
    > Your computer was not able to renew its address from the network
    > (from the
    > DHCP Server) for the Network Card with network address
    > 001143AD2813. The
    > following error occurred:
    >
    > The operation was canceled by the user. . Your computer will
    > continue to try
    > and obtain an address on its own from the network address (DHCP) server.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > I tried disabling dhcp snooping on one of the ports, but the
    > warnings didn't
    > go away from the pc plugged in to that port. What's interesting is
    > that XP
    > machines log Event ID 1003 only at the start up, windows 2000
    > systems log
    > this warning all day long (every 5 - 7 min) Looking at the DHCP log file
    > located on my DHCP server under
    > C:\WINDOWS\system32\dhcp\DhcpSrvLog-Wed.log
    > confirms with my findings about XP machines accessing DHCP once a
    > day at
    > the start up and 2000 systems accessing DHCP all day long. (200 - 250
    > records per PC)
    >
    > Below is the list of actions my 2000 and XP systems do. (XP systems
    > do this
    > once a day, 2000 systems show up in the log 200 times a day )
    >
    > 32 DNS update successful
    > 30 DNS update request to the named DNS server
    > 11 A lease was renewed by a client.
    >
    > All of my ports are configured the same. Below is the config from
    > one of the
    > ports.
    >
    >
    > interface GigabitEthernet0
    > switchport access vlan 21
    > switchport mode access
    > switchport voice vlan 24
    > switchport port-security maximum 2
    > switchport port-security
    > switchport port-security aging time 1
    > switchport port-security violation restrict
    > switchport port-security aging type inactivity
    > ip arp inspection limit rate 50
    > srr-queue bandwidth share 10 10 60 20
    > srr-queue bandwidth shape 10 0 0 0
    > queue-set 2
    > mls qos trust device cisco-phone
    > mls qos trust cos
    > auto qos voip cisco-phone
    > dot1x pae authenticator
    > dot1x port-control auto
    > dot1x host-mode multi-host
    > dot1x reauthentication
    > dot1x guest-vlan 666
    > spanning-tree portfast
    > spanning-tree bpduguard enable
    > ip dhcp snooping limit rate 20
    >
    > Does anybody know what may trigger this warning on the workstation with
    > DOT1x
    >
    > Implementation?
    >
    >
    >
    > Thank you.
    >
    >
    >


    You take a look in these articles.

    http://www.eventid.net/display.asp?eventid=1003&eventno=1478&source=DHCP&phase=1

    On Wireless XP Clients check this:
    http://support.microsoft.com/kb/313896/en-us

    On Wired-Client check this:
    http://support.microsoft.com/kb/325919 (hotfix avalaible)
    http://support.microsoft.com/support/kb/articles/q168/4/55.asp

    This seems intresting:
    According to the article, if the switch uses the spanning tree algorithm
    (STA), the system can lose your DHCP request packet. Although STA
    provides useful functionality (e.g., it blocks loop conditions on ports,
    enables backup loops between switches in case of cable or port failure,
    provides some fault tolerance for incorrect wiring, helps switches
    discover the best path), in my case this algorithm was the culprit.

    I checked the Cisco documentation, which revealed that the company's
    switches use STA. I used HyperTerminal to assign the switches an IP
    address, then I connected to each switch over the Internet and used
    Cisco's Visual Switch Manager to disable STA. The method to disable STA
    varies, so check your switch documentation for the specifics. You need
    to disable STA only for the ports connecting the switches and not for
    the ports that clients use, but the Cisco models I have only let you
    enable or disable STA for the entire switch.


    Your Sincerly,


    --
    Guido van Brakel

    --
    Systeembeheerder
    http://guido-van-brakel.nl/blog/
    Studerend aan HBO Systeembeheer,Hogeschool Utrecht
    CCNA,CCNP1
    --

    Life is like a box of chocolates, you never know what you're gonna get
     
    Guido van Brakel, Jul 2, 2007
    #3
  4. I guess the warning logged on the workstations is deceiving. I am not aware
    of any problems with clients obtaining DHCP leases.



    ipconfig /flushdns and then ipconfig /registerdns does not fix the problem.
    I don't think this is an OS configuration issue. Most likely this is
    something to look for in my Switch configuration.





    "Robert L [MVP - Networking]" <> wrote in message
    news:...
    If you do ipconfig /flushdns and then ipconfig /registerdns, does that fix
    the problem? This link may have more troubleshooting tips.

    Event ID 1003 - Your computer was not able to renew its address from the
    network (from the DHCP Server) for the Network Card with network address
    <MAC address>.
    http://www.chicagotech.net/wineventid.htm

    Bob Lin, MS-MVP, MCSE & CNE
    Networking, Internet, Routing, VPN Troubleshooting on
    http://www.ChicagoTech.net
    How to Setup Windows, Network, VPN & Remote Access on
    http://www.HowToNetworking.com
    "Mike Testovich" <> wrote in message
    news:%...
    Since we implemented dot1x and all great security features that come with
    it
    on our WIRED network, I started seeing DHCP Warnings Event ID 1003 on all
    of
    my workstations configured for DHCP address assignment.

    Below is the text of the warning.

    Your computer was not able to renew its address from the network (from the
    DHCP Server) for the Network Card with network address 001143AD2813. The
    following error occurred:

    The operation was canceled by the user. . Your computer will continue to
    try
    and obtain an address on its own from the network address (DHCP) server.

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    I tried disabling dhcp snooping on one of the ports, but the warnings
    didn't
    go away from the pc plugged in to that port. What's interesting is that XP
    machines log Event ID 1003 only at the start up, windows 2000 systems log
    this warning all day long (every 5 - 7 min) Looking at the DHCP log file
    located on my DHCP server under
    C:\WINDOWS\system32\dhcp\DhcpSrvLog-Wed.log
    confirms with my findings about XP machines accessing DHCP once a day at
    the start up and 2000 systems accessing DHCP all day long. (200 - 250
    records per PC)

    Below is the list of actions my 2000 and XP systems do. (XP systems do
    this
    once a day, 2000 systems show up in the log 200 times a day )

    32 DNS update successful
    30 DNS update request to the named DNS server
    11 A lease was renewed by a client.

    All of my ports are configured the same. Below is the config from one of
    the
    ports.


    interface GigabitEthernet0
    switchport access vlan 21
    switchport mode access
    switchport voice vlan 24
    switchport port-security maximum 2
    switchport port-security
    switchport port-security aging time 1
    switchport port-security violation restrict
    switchport port-security aging type inactivity
    ip arp inspection limit rate 50
    srr-queue bandwidth share 10 10 60 20
    srr-queue bandwidth shape 10 0 0 0
    queue-set 2
    mls qos trust device cisco-phone
    mls qos trust cos
    auto qos voip cisco-phone
    dot1x pae authenticator
    dot1x port-control auto
    dot1x host-mode multi-host
    dot1x reauthentication
    dot1x guest-vlan 666
    spanning-tree portfast
    spanning-tree bpduguard enable
    ip dhcp snooping limit rate 20

    Does anybody know what may trigger this warning on the workstation with
    DOT1x

    Implementation?



    Thank you.
     
    Mike Testovich, Jul 3, 2007
    #4
  5. Mike Testovich

    Dana Guest

    "Mike Testovich" <> wrote in message
    news:%...
    > Since we implemented dot1x and all great security features that come with
    > it
    > on our WIRED network, I started seeing DHCP Warnings Event ID 1003 on all
    > of
    > my workstations configured for DHCP address assignment.
    >
    > Below is the text of the warning.
    >
    > Your computer was not able to renew its address from the network (from the
    > DHCP Server) for the Network Card with network address 001143AD2813. The
    > following error occurred:
    >
    > The operation was canceled by the user. . Your computer will continue to
    > try
    > and obtain an address on its own from the network address (DHCP) server.
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > I tried disabling dhcp snooping on one of the ports, but the warnings
    > didn't
    > go away from the pc plugged in to that port. What's interesting is that XP
    > machines log Event ID 1003 only at the start up, windows 2000 systems log
    > this warning all day long (every 5 - 7 min) Looking at the DHCP log file
    > located on my DHCP server under
    > C:\WINDOWS\system32\dhcp\DhcpSrvLog-Wed.log
    > confirms with my findings about XP machines accessing DHCP once a day at
    > the start up and 2000 systems accessing DHCP all day long. (200 - 250
    > records per PC)
    >
    > Below is the list of actions my 2000 and XP systems do. (XP systems do
    > this
    > once a day, 2000 systems show up in the log 200 times a day )
    >
    > 32 DNS update successful
    > 30 DNS update request to the named DNS server
    > 11 A lease was renewed by a client.
    >
    > All of my ports are configured the same. Below is the config from one of
    > the
    > ports.
    >
    >
    > interface GigabitEthernet0
    > switchport access vlan 21
    > switchport mode access
    > switchport voice vlan 24
    > switchport port-security maximum 2
    > switchport port-security
    > switchport port-security aging time 1
    > switchport port-security violation restrict
    > switchport port-security aging type inactivity
    > ip arp inspection limit rate 50
    > srr-queue bandwidth share 10 10 60 20
    > srr-queue bandwidth shape 10 0 0 0
    > queue-set 2
    > mls qos trust device cisco-phone
    > mls qos trust cos
    > auto qos voip cisco-phone
    > dot1x pae authenticator
    > dot1x port-control auto
    > dot1x host-mode multi-host
    > dot1x reauthentication
    > dot1x guest-vlan 666
    > spanning-tree portfast
    > spanning-tree bpduguard enable
    > ip dhcp snooping limit rate 20
    >
    > Does anybody know what may trigger this warning on the workstation with
    > DOT1x
    >
    > Implementation?


    Are you using Radius. How is the Global config for dot1x
    >
    >
    >
    > Thank you.
    >
    >
    >
    >
     
    Dana, Jul 4, 2007
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. marow

    Event id 1003 problem

    marow, Sep 27, 2004, in forum: Computer Information
    Replies:
    9
    Views:
    4,956
    Bradley26
    Oct 1, 2004
  2. bobbyg300

    Event ID 1003 that i cant locate online

    bobbyg300, Aug 29, 2006, in forum: General Computer Support
    Replies:
    0
    Views:
    805
    bobbyg300
    Aug 29, 2006
  3. =?Utf-8?B?TWFyaW8gU2F2YXJk?=

    event id 1003

    =?Utf-8?B?TWFyaW8gU2F2YXJk?=, Feb 10, 2006, in forum: Windows 64bit
    Replies:
    0
    Views:
    623
    =?Utf-8?B?TWFyaW8gU2F2YXJk?=
    Feb 10, 2006
  4. =?Utf-8?B?S3Jpc3RpYW4gVG9sbGVmc2Vu?=

    catagory 102 and event 1003

    =?Utf-8?B?S3Jpc3RpYW4gVG9sbGVmc2Vu?=, Aug 12, 2007, in forum: Windows 64bit
    Replies:
    4
    Views:
    3,283
    =?Utf-8?B?S3Jpc3RpYW4gVG9sbGVmc2Vu?=
    Aug 14, 2007
  5. System crash - Event ID 1003

    , Apr 12, 2008, in forum: Windows 64bit
    Replies:
    3
    Views:
    1,847
    rkwilcox
    Apr 12, 2008
Loading...

Share This Page