Protection log error 1245

[Andy Spragg]

I have suddenly (3 times in the last 5 days ) started getting the following error message in my protection logs:

ERROR Database update failed: WTSQueryUserToken failed with error code 1245

The timestamp of the error is just after 21:00, the time when MBAM is scheduled to update itself. It has been doing this without problems until the last few days. Anyone know what the problem is?

Andy

[noknojon]

Hi Andy -

Is it a chance that your ISP dropped out for a few mins at this time ??- The M/soft error base seems to show there was a chance you could not log on at that time ?? -

Error code 1245: ERROR_NOT_LOGGED_ON - The operation being requested was not performed because the user has not logged on to the network. The specified service does not exist.

You may need to ensure your modem is on and connected properley at that time - All results seem to give the same answer to your question -

Thanks -

[Andy Spragg]

Hi Andy -

Is it a chance that your ISP dropped out for a few mins at this time ??- The M/soft error base seems to show there was a chance you could not log on at that time ??

Hi Jon (?),

Sorry, I have a bad habit of thinking that MBAM error messages are originated by MBAM. I would have searched the MS knowledge base myself if I had known it was a MS error. I'd still have been asking the question why I was getting it though. I could accept the explanation of ISP dropout at a specific time once in a (fairly long) while, but 3 times in 5 days stretches credulity a bit far, I think.

I had a look in Event Viewer but MBAM updating doesn't seem to register any events in there, either successful or unsuccessful. Not in the application log, anyway. Although I do have a high proportion of ANONYMOUS LOGON/LOGOFFs in the security log!? If they had only been at or just after 21:00 I might have identified them with MBAM's scheduled 21:00 task, but they're sprinkled liberally throughout the day. So I don't know what they're all about, but they don't (seem to) have anything to do with MBAM's scheduled activity.

I did wonder if it was because the PC was not on at 21:00 on the days in question (sometimes it isn't), but that can't be right, because then I wouldn't get a timestamped error at 21:00 or so, would I?

Back in the protection logs again, I looked a bit closer and I do think it seems to be some error condition with MBAM rather than inability to logon. I say this because if I give you a bit more log file context, the failures always look like this:

21:01:25 MESSAGE IP Protection stopped

21:01:25 ERROR Database update failed: WTSQueryUserToken failed with error code 1245

21:01:27 MESSAGE IP Protection started successfully

or this:

21:01:41 Andy MESSAGE IP Protection stopped

21:01:41 Andy ERROR Database update failed: WTSQueryUserToken failed with error code 1245

21:01:45 Andy MESSAGE IP Protection started successfully

(I presume the first one is a case where the machine was on but no user was logged on), whereas successes look like this:

21:01:25 Andy MESSAGE IP Protection stopped

21:01:34 Andy MESSAGE Database updated successfully

21:01:35 Andy MESSAGE IP Protection started successfully

Incidentally, I had to wrestle quite hard with the MBAM UI this morning to open a selection of recent log files. The scroll bar was mad keen to return to the top of the list and it typically took me several gos to get it to stick at the bottom so I could open a recent log file and copy an excerpt. Is this perhaps a symptom of an excess of log files? Mine go back to last September.

Andy

[noknojon]

Sorry Mate -

MBAM error codes are usually 700 numbers (703 / 732/etc.) - 1 or 2 or 4 or 5 numbers will relate to Windows errors - This (below) is from their site -

Windows Error Code 1245: 'ERROR_NOT_LOGGED_ON'

Not added or changed - Just cut and pasted - (Type error code 1245 into your search box) -

Re logs -"Mine go back to last September." Not required but will not harm anything -

Is your modem usually/always on at this time (9.00PM)

There is about 1000 results for WTSQueryUserToken on Google - I normally use the one that will match your problem but my eyes are doing circles -

Cut and paste - WTSQueryUserToken - Into your search engine and see what I mean -

Apart from the top answer , the second part is a bit confusing (another M/soft scuffle) -

Sorry But see if exile360 or another has this one down -

EDIT - (but 3 times in 5 days stretches credulity a bit far, I think.) Not with my ISP - I was Forced to change (and even paid their penalty) to get half decent DSL coverage - Mine would drop out 10 times a day - (Now only ~ twice)

[exile360]

Currently if you are not logged on to your user account then MBAM's scheduled tasks will fail and it's protection will not start. This should be corrected I believe in the upcoming version 1.45.

[Andy Spragg]

EDIT - (but 3 times in 5 days stretches credulity a bit far, I think.) Not with my ISP - I was Forced to change (and even paid their penalty) to get half decent DSL coverage - Mine would drop out 10 times a day - (Now only ~ twice)

Yebbut, it was at a specific time 3 times in 5 days, wasn't it? Your ISP would need to be dropping out hundreds or thousands of times a day to achieve that

@exile360: that's a bit curious because Ron took me through the process a while ago of setting up a scheduled task that would log on and update even if the user account was not logged on, as long as the machine was on. I quizzed him about to make sure I was understanding right. This (in part) is what he said (October last year):

Has it since been discovered that the process was still not as robust as had been thought?

Andy

[noknojon]

It is almost into BETA now -

This should be corrected I believe in the upcoming version 1.45.

Also ensure All your M/soft updates have been fully installed - Even if you need to go to their site and check for any updates -

[AdvancedSetup]

Hi Andy,

That information was provided to you as a paying customer, not for posting on a public forum. I've removed your comment, and no it has not changed.

More than likely there was a brief issue connecting to one of the update servers. It could be the update server itself or a DNS issue. I would not expect it to happen too often though.

If you continue to have issues then please contact the Help Desk and they will assist you with determining the underlying issue.

Thank you.