Rasman service init error

Microsoft.Windows.RemoteAccess.MultiTenant.2012.R2.Monitoring.RRASServer.RasmanServiceInitErrorEvent (Rule)

Knowledge Base article:

Summary

The Remote Access Connection Manager service failed to start due to initialization failure.

Causes

The most common reasons for initialization failure are:

The Remote Access Connection Manager service failed to start the WAN Mini Port (IP) device driver (NDISWAN). The most common reasons for this error are:

The Remote Access Connection Manager service failed to retrieve information for this media device. The most common reasons for this error are:

The Remote Access Connection Manager service could not start because it failed to register with the Local Security Authority (LSA). The most common reasons for this error are:

The Remote Access Connection Manager service failed because it encountered an error during RPC initialization. The most common reasons for this error are:

Sample Events:

Resolutions

Check whether the System account has read/execute permissions for the file %systemroot%\system32\drivers\ndiswan.sys. To check the permissions:

Verify whether the following registry key exists: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters\Medias

If the registry key does not exist, you can create it with the following values:

Verify whether the file rastapi.dll exists in the %systemroot%\system32 folder.

Verify whether the System account has read/execute permissions for rastapi.dll. To check whether the System account has these permissions:

Verify that the following DLLs exist in the %systemroot%\System32 folder:

If any of these DLLs are not present, you must repair or reinstall the operating system. For more information about repairing and reinstalling the operating system, see Help and Support Center.

Verify whether the SYSTEM account has read/write permissions for the DLLs. To check the permissions:

© 2013 Microsoft Corporation, all rights reserved

Element properties:

TargetMicrosoft.Windows.RemoteAccess.Multitenant.2012.R2.Class.RemoteAccessServer
CategoryEventCollection
EnabledTrue
Event SourceRasman
Alert GenerateFalse
RemotableTrue
Event LogSystem

Member Modules:

ID Module Type TypeId RunAs 
EventCollection DataSource Microsoft.Windows.EventProvider Default
CollectToDB WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="Microsoft.Windows.RemoteAccess.MultiTenant.2012.R2.Monitoring.RRASServer.RasmanServiceInitErrorEvent" Target="MWRM2RD!Microsoft.Windows.RemoteAccess.Multitenant.2012.R2.Class.RemoteAccessServer" Enabled="true" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="EventCollection" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesRegularExpression</Operator>
<Pattern>^(20027|20028|20030|20031|20033|20132)$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Rasman</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="CollectToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="CollectToDW" TypeID="MSDL!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>