Microsoft-Windows-NlaSvc Error ID 4205
In my Window Server 2008 R2 OS in the Event Viewer there is an error pertains as Microsoft-Windows-Nlasvc Error ID 4205 states-(Gateway resolution failed on interface {d9470891-785a-4f67-82c7-53dc6646ad1ad} for o.o.o.o-[default gateway address] with error:0x57). What is this error? And What is the remedy for this error?MumthazMuhsin
October 21st, 2011 10:34am

I also see this event occuring repeatedly at a very high rate, polluting the event viewer so much that it makes it almost unusable, and that it generates too much disk activity. In fact this error has started since the time where my ISP has provided an IPv6 connectivity on its router (in addition to the existing IPv4 connectivity; in fact my ISP uses internally a proprietary Cisco tunnel to encapsulate the IPv6 traffic over the IPv4 connection over ADSL; the tunnel is established automatically by the router). Windows correctly gets an IPv6 address autoallocated in the IPv6 address block advertized by the router. Windows also attempts to use DHCPv6, but there's no DHCPv6 server implemented for now in the router (only the zero-config autoconfiguration is used). But the problem is that this IPv6 connectivity does not have any DNS server configured to be accessible by IPv6 (Windows also attempts to use DHCPv6 to get the DNSv6 address, but fails, and we are left without any DNS server on IPv6; it is not very important because the router implements a DNS proxy locally accessible on its IPv4 address, here 192.168.1.1, and name resolution is performed on this DNS server. Apparently, the NLA service of Windows does not detect that, on the PC, the hardware Ethernet interface is correctly configured with an IPv4 address (192.168.1.xx), a correct IPv4 address mask (255.255.0.0) to reach the default gateway (192.168.1.1) which is the router that also advertized the DNS server (192.16.8.1.1, i.e. the router itself as it is acting as a DNS proxy); but Windows has configured *both* a local-link IPv6 address (fe80:...) and correctly configured the Internet compatible (routable) IPv6 address (2001:...) within the correct IPv6 address block. But note that the router itself has *NO* IPv6 address for itself, so its DNS proxy is not reachable via IPv6. The network interface then has no DNS server for IPv6. Windows should continue to use the IPv4 DNS server, which can correctly resolve *both* IPv4 and IPV6 addresses for domain names, as well as performing the reverse resolution. The NLA Service however insists is trying to connect to an inexistant DNSv6 server, and constantly replies that it cannot identify the domain name of the IPv6 address, only because the NLA service still does not query the correct DNSv4 server which is configured on the same physical Ethernet network interface. I think this is a bug of the NLA service: it is perfectly valid for a network interface usable for Internet to have *no* DNSv6 server but only a DNSv4 server. Unfortunately, the NLA Service is spamming the Event viewer with lots of events (I get them by batches of 16 messages at the same time, with this Error ID 4205, every 10 seconds). This is really too much! The NLA service is unable to pace itself after the first failures. In fact it should not even log so many "Errors" in the Event viewer if it was doing things correctly. This is also a major performance problem (disk activity, slow responsiveness when listing the available networks, or when enumerating UPNP devices over the local network). Please Microsoft, correct the NLA service so that it will use the correct information and NOT require a DNSv6 server on an IPv6-enabled network interface, if it already has at least an IPv4 DNS server on the same network interface instance. It's true that nothing indicates that IPv4 and IPv6 will have the same routings, so the identification (by domain name) of the network may be different, but at least, in terms of security, the routable IPv6 address assigned to an interface should be treated like the routable IPv4 address on the same interface. So if you don't have a configured DNSv6 to get the name of the assigned IPv6 address, you should use the configured DNSv4 to query the name of the assigned routable IPv6 address (2001:...). Note: the local-link IPv6 address (fe80:...) is never routable, it will have no name except for local-link applications, and if there's a DNS server running and serving the local network. You may want to detect if this local link address has a name, but in fact this is superfluous: on the local ink, we are in the world of the "Residential Homegroup", and hosts are identified via the Microsoft networking protocol (SMB/CIFS) even if there's no DNS configured on the LAN. For all these reasons, I had to disable the logging of "Microsoft/Windows/NlaSvc" in the Event viewer. It is completely useless, uninformative (because it also indicates the network interfaces concerned only by their internal device driver instance UUID, without any indication of its informative name, and the message provides absolutely no hint about which query exactly failed, if this was an attempt to connect to a DNSv6 server, and which DNS server was attempted). Nobody will be able to use the event message data found in this Error ID:4205.
Free Windows Admin Tool Kit Click here and download it now
November 30th, 2011 11:18am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics