I'm using a Lenovo N200 Notebook with Windows 7 ULtimate RTM 09/28/2009 a fresh install. It is added to the office domane and we are using Forefront Client Security. Doing partial teleworking, 4 days each week I'm only connected via VPN with the office domain. Each day I suffer multipe events, where the only the cursor is following the mouse, but input not wven ctrl-alt-del is ignored. This lasts perhaps 60 seconds. In this time the disk led is on and I hear noise of strong disk activity. The task manager doesn't show unusual activity. Here is the event log of the last day: Error 22.10.2009 22:36:42 TFSShellExt 3 None Error 22.10.2009 22:35:21 Microsoft Operations Manager 26008 None Error 22.10.2009 22:26:59 TFSShellExt 3 None Error 22.10.2009 22:25:38 Microsoft Operations Manager 26008 None Error 22.10.2009 22:15:58 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 20:51:10 TFSShellExt 3 None Error 22.10.2009 20:49:19 Microsoft Operations Manager 26008 None Error 22.10.2009 20:40:30 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 20:27:02 Microsoft Operations Manager 26008 None Error 22.10.2009 20:11:41 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 18:51:06 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 17:30:00 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 16:36:34 TFSShellExt 3 None Error 22.10.2009 16:35:02 Microsoft Operations Manager 26008 None Error 22.10.2009 16:15:47 Microsoft Operations Manager 26008 None Error 22.10.2009 13:06:11 Microsoft Operations Manager 26008 None Error 22.10.2009 12:02:11 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 10:05:35 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 10:03:05 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 09:24:41 Application Error 1000 (100) Error 22.10.2009 09:24:41 Microsoft Operations Manager 26008 None Error 22.10.2009 09:24:38 Microsoft Operations Manager 21268 MOM Agent Error 22.10.2009 07:19:08 Microsoft Operations Manager 21268 MOM Agent Error 21.10.2009 21:57:39 Microsoft Operations Manager 26008 None Error 21.10.2009 20:52:35 Microsoft Operations Manager 21268 MOM Agent Error 21.10.2009 19:50:35 Microsoft Operations Manager 21268 MOM Agent Error 21.10.2009 19:10:05 Microsoft Operations Manager 21268 MOM Agent Error 21.10.2009 18:00:35 Microsoft Operations Manager 21268 MOM Agent Error 21.10.2009 17:17:35 Microsoft Operations Manager 21268 MOM Agent Error 21.10.2009 16:16:09 Microsoft Operations Manager 21268 MOM Agent Error 21.10.2009 13:43:53 Microsoft Operations Manager 21268 MOM Agent Before I used Windows 7 RC, but update from Vista, meber of the office domane and in the last week I was using Forefront Client Security and I didn't observe this effect. I informed my system administrator and indicated http://technet.microsoft.com/en-us/library/bb643195.aspx?ppud=4 to him, and we concluded, that the next step had to be some configuration on the server. Searching Google for ID 21268 indicates that this seems to be rather a singular problem. Its annoying, but not to the degree that it requires an imediate reinstallation. Any hints to track down and solve this problem are wellcome. This Notebook was preinstalled with Vista witout downgrade option to XP. Since first public beta I was using Windows 7 and I really like it. Escepially the quick and stable VPN connections. Nearly all is perfect, but just this issue. Bernd Kriszio twitter: bernd_k

Some hints ... http://eventid.net/display.asp?eventid=21268&eventno=5444&source=Microsoft%20Operations%20Manager&phase=1;)IM me - TWiTTer: @DFTER

Hi, Does the following link can help you?Microsoft Operations Manager (MOM) 2005 - Event 21268 Logged on MOM ServerThanks.

I conclude again, that I can do nothing myselft, but depond on the admin of the MOM server. Thanks

The solution seems to be very simple. Reboot while connected to the domain from time to time. I avoided this because there was login script which modified my home directory and I want always to have the same home directory. Now I find the following Event in my log: Event ID 21269 The Agent incoming queue now has sufficient space or is available to process new data. Management Group: ForefrontClientSecurity. Bernd

It is not yet resolved. Only the Eventlog messages changed.

I found the following trouble shooting guide http://www.cwi.it/lead/dwnwp/193 But I would like a solution where I do not depend on the cooperation of any admin. Why not just ask me whether I allow to increase the queue ? In my opinion this is a severe bug. Bernd

The problem still is not fixed, but I note that I have lots of Audit Failures with EventID 5152 and some with 5157 (about 32000 per hour). I guess the Firewall is too restrictive. 1. Could this cause the ID 21268 Error and are thee hints who to reduce the 5152 Events, Application Name: - in most cases. Thanks Bernd