This particular event had me scratching my head for several weeks. The Primary Domain Controller is a Windows 2003 server running in a virtualized environment. We have a second DC on a physical machine for redundancy, and secondary DCs at two other sites. One of the secondary DCs corrupted after a network failure, resulting in our having to forcibly remove the DC from the domain and reformat the hard drive. Once we thought everything was stable and back to normal, we kept getting this error in the Applications folder of Event Viewer on the Domain Controller. Often, this error is a result of a misconfigured DNS, but if everything was working correctly prior to the failed DC, looking at DNS may be a red herring.
What we found, after very few references, was a problem in the Windows clocking routines when a server is running on more than one processor. Updating the CPU driver is recommended if the server is on a physical machine, but since ours was virtual, there was no driver update available. We could have configured the server to only use one core, but we wanted the extra power available if it was needed. The solution was a change to the boot.ini file.
Go to System Properties (right-click My Computer and choose properties), go to the Advanced tab, and click the settings button under Startup and Recovery. Click the "Edit" button to change the file manually, and add /usepmtimer to the end of the line following [Operating System]. In our enviroment, boot.ini looks like this:
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003, Standard" /noexecute=optout /fastdetect /usepmtimer
Hopefully, this little tip will save someone from pulling their hair out. The bug only shows up after a dcpromo has been run anywhere in the domain, so the virtualized DC may be running perfectly fine with no errors until a change is made somewhere else. The key to finding this bug is running a ping. If your ping to any other server returns negative values, this bug is affecting you. Here is another blog post on this same situation: http://www.solo-technology.com/blog/2009/01/30/windows-error-event-id-1…