Linux – Forward Windows Events Logs to Rsyslog

I've had success with Sysinternals Process Explorer. With this, you can search to find what process(es) have a file open, and you can use it to close the handle(s) if you want. Of course, it is safer to close the whole process. Exercise caution and judgement.

To find a specific file, use the menu option Find->Find Handle or DLL... Type in part of the path to the file. The list of processes will appear below.

If you prefer command line, Sysinternals suite includes command line tool Handle, that lists open handles.

Examples

• c:\Program Files\SysinternalsSuite>handle.exe |findstr /i "e:\" (finds all files opened from drive e:\"
• c:\Program Files\SysinternalsSuite>handle.exe |findstr /i "file-or-path-in-question"

For the other part of your question: The 0x43 in windows networking world means "The network name cannot be found" 0x43 = Decimal 67. So if you look up windows error code 67, you'll get this up.

I must say that this is one of those times when we'll have to sit and analyze the issue for a good time. I'd probably do the following in this case:

1. Examine the errors and establish a pattern(like are they occuring after a specific event, like during start up, shutdown, start up of an application, etc.) and then try to narrow down the list of possible culprits.
2. I will also try to isolate it further by checking if its specific to this user(have another user login to the same box), or specific to this machine(have this user login to another box).
3. Then use the tools to capture the invisible details: procmon, procexp, tcpview, windbg etc., until the event occurs again, and then look at the info. I usually find something here(success rate > 75%)
4. possibly something else based on the above three steps.

Of course, I'll keep using Google; hey it's an extension of our brains, no?

The ideal approach in the troubleshooting world has to be isolate-and-conquer. Hope I made some sense.