Systems Administrators for Windows Servers know they can encounter strange errors within their event viewers.

On Windows 2000 Server-based Domain Controllers especially you might encounter 3034 errors with MrxSmb as their source. Referring to KnowledgeBase Article 263142 you have to query the last byte in the data section to ntstatus.h and winerror.h. The KnowledgeBase Article advices to to do this manually by downloading the Windows SDK.

Windows SDK

I think this is a poor advice. the Windows SDK, which stands for Software Development Kit, is particularly put together to satisfy the needs of software programmers. It is a collection of programming tools, utilities, documentation, and libraries of functions and classes. Don't get me wrong: I think this tool rocks if you're a Software Developer, but as an Admin I prefer another tool.

Err.exe

A couple of years ago Microsoft introduced the Exchange Server Error Code Look-up Tool, which basically is a self-extracting executable containing:

• err.exe
• eula.txt
• Error Code Lookup Tool.doc

Don't get fooled by the name Microsoft gave to this tool. You can use it to lookup errorcodes for specific Microsoft Exchange errors, but with two simple command line switches you can change this behavior to only match errorcodes to errorstrings for winerror.h and ntstatus.h

How it works

Err.exe is really a simple tool to use. Extracting the tool and getting the information you need from your event viewer is the real hard part.

Extracting the tool

To download and extract err.exe follow these steps:

1. Download err.exe from this page
2. Safe it (for later use) or execute it
3. Extract the files to a suitable location
4. Remember where you extracted it to

Getting the error code

In the case of error 3034 with source MrxSmb on your Domain Controller the path to get the information to match with ntstatus.h and winerror.h is simple:

1. Open Event Viewer (eventvwr.exe)
2. Scroll to the error
3. Double click the error to open it
4. Select "Words" instead of "Bytes"
5. Copy the last DWORD value

Using the tool

You have the tool and you have the information. It's time to put the two together:

1. Open up a command line box in the folder where you extracted err.exe to. (You did remember it, right?)
2. Type:err.exe /winerror.h /ntstatus.h <PasteYourErrorCodeHere>

   Where you use the right mouse button to paste the copied DWORD value from your Event Viewer in the place of <PasteYourErrorCodeHere>.

Using the error code status

If you performed the steps right the err.exe tool would have given back a long error code status, which should give you enough leads to troubleshoot the problem behind the rather vague 3034 error.

Further Reading

Download details: Microsoft Exchange Server Error Code Look-up Tool
Determining the Cause of an "MRxSmb 3034" Warning
Description of NTDS replication warning IDs 1083 and 1061, and SAM error ID 12294 because of an Active Directory collision
To err is Admin….