Event 1339 Messages Are Logged When You Use Host Security (273668)

SYMPTOMS

A system that is running the SNA Host Account Cache (User Credential Database) service that is included with Host Integration Server (HIS) 2000 may log the following event in the Application Event Log:

Event ID: 1339
Source: SNA Host Security
Description: The request database access is denied for the client account: NTAUTHORITY\\SYSTEM

NOTE: The event description may only contain two backslashes (\\) for the client account.

In this case, the Event 1339 is benign and does not cause any problems with host security functionality.

CAUSE

The Windows Management Instrumentation (WinMgmt.exe) service causes the SNA Manage Agent (MngAgent.exe) service to send a UDI_GET_VALID_DOMS_NT request to the SNA Host Account Cache database under some circumstances.

WinMgmt.exe runs under the local system account and this account cannot be authenticated by the Host Account Cache database. The failure to authenticate this account results in the Event 1339 being logged in the Application Event Log.

RESOLUTION

To resolve this problem, obtain the latest service pack for Host Integration Server 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

328152 How to Obtain the Latest Host Integration Server 2000 Service Pack

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Host Integration Server 2000 Service Pack 1.

MORE INFORMATION

If HIS 2000 and the HIS 2000 clients are configured to use Active Directory, HIS 2000 clients will use WMI calls to retrieve specific configuration information from HIS 2000 servers. For example, a client that is running a 3270 emulator will make a WMI call to determine what 3270 LUs are assigned to the user who is making the request.

If host security is being used, these WMI calls may result in a UDI_GET_VALID_DOMS_NT call being sent to the Host Account Cache database by MngAgent.exe on the behalf of WinMgmt.exe.

The following are two scenarios that appear to generate the Event 1339 messages:

Running the 3270 client.
Running the 5250 client and then on the Session menu, clicking Session Configuration to select a remote APPC LU alias.