Q235999: Savedump Does Not Write Event Log Message with Event ID 1000

Article: Q235999
Product(s): Microsoft Windows NT
Version(s): winnt:4.0 SP5
Operating System(s): 
Keyword(s): kbWinNT4sp6fix
Last Modified: 20-MAY-2002

-------------------------------------------------------------------------------
The information in this article applies to:

- Microsoft Windows NT Server version 4.0, Terminal Server Edition 
- Microsoft Windows NT Server version 4.0 SP5 
- Microsoft Windows NT Workstation version 4.0 SP5 
-------------------------------------------------------------------------------

SYMPTOMS
========

When there is not enough free disk space to write a dump file, Savedump.exe does
not write the following entry to the event log:

  Event ID: 1000
  Source: Save Dump
  Description:
  The computer has rebooted from a bugcheck.
  The bugcheck was: 0xdeaddead (0x00000000, 0x00000000, 0x00000000,
  0x00000000).
  Microsoft Windows NT [v15.1381].
  A full dump was not saved.

CAUSE
=====

This behavior occurs because remote procedure call (RPC) returns an
unanticipated error message when Savedump.exe attempts to get a handle to the
registry (RegisterEventSource).

RPC returns RPC_S_UNKNOWN_IF (The interface is unknown. Error code 1717), but
Savedump.exe checks only for a return code of RPC_S_SERVER_UNAVAILABLE (The RPC
server is unavailable. Error code 1722). The return error code 1717 is ignored.

RESOLUTION
==========

Windows NT Server or Workstation 4.0
------------------------------------

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the
individual software update. For information on obtaining the latest service
pack, please go to:

- http://www.microsoft.com/Windows/ServicePacks/

-or-

- Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

For information on obtaining the individual software update, contact Microsoft
Product Support Services. For a complete list of Microsoft Product Support
Services phone numbers and information on support costs, please go to the
following address on the World Wide Web:

  http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS

Windows NT Server or Workstation 4.0
------------------------------------

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the
individual software update. For information on obtaining the latest service
pack, please go to:

- http://www.microsoft.com/Windows/ServicePacks/

-or-

- Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

For information on obtaining the individual software update, contact Microsoft
Product Support Services. For a complete list of Microsoft Product Support
Services phone numbers and information on support costs, please go to the
following address on the World Wide Web:

  http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS


Windows NT Server 4.0, Terminal Server Edition
----------------------------------------------

To resolve this problem, obtain the latest service pack for Windows NT Server
4.0, Terminal Server Edition. For additional information, please see the
following article in the Microsoft Knowledge Base:

  Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack


Microsoft has confirmed this to be a problem in Windows NT 4.0 and Windows NT
Server 4.0, Terminal Server Edition.

This problem was first corrected in Windows NT Server 4.0 Service Pack 6 and
Windows NT Server 4.0, Terminal Server Edition Service Pack 6.

Windows NT Server 4.0, Terminal Server Edition
----------------------------------------------

To resolve this problem, obtain the latest service pack for Windows NT Server
4.0, Terminal Server Edition. For additional information, please see the
following article in the Microsoft Knowledge Base:

  Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack


STATUS
======

Microsoft has confirmed this to be a problem in Windows NT 4.0 and Windows NT
Server 4.0, Terminal Server Edition.

This problem was first corrected in Windows NT Server 4.0 Service Pack 6 and
Windows NT Server 4.0, Terminal Server Edition Service Pack 6.

Additional query words: Bluescreen

======================================================================
Keywords          : kbWinNT4sp6fix 
Technology        : kbWinNTsearch kbWinNTWsearch kbWinNTW400search kbWinNT400search kbWinNTW400sp5 kbWinNTSsearch kbWinNTS400sp5 kbWinNTS400search kbNTTermServ400 kbNTTermServSearch
Version           : winnt:4.0 SP5
Hardware          : ALPHA x86
Issue type        : kbbug
Solution Type     : kbfix

=============================================================================