Dealing with Event ID: 8003 MRxSmb
You may find this message in your event log listed as an Error that says something along the lines of:
“Event Type: Error
Event Source: MRxSmb
Event ID: 8003
Event Category: None
The master browser has received a server announcement from the computer XXX that believes that it is the master browser for the domain on transport NetBT_Tcpip_XXX-. The master browser is stopping or an election is being forced.“
Firstly, don’t panic. This is typically a network configuration issue and is not really an error in the traditional sense (the allocation of what is a warnings and what is an errors in the event log are sometimes frustrating!). Essentially, it is just Windows networking services trying to do it’s job. When two or more Windows computers are connected together they form a network and Windows computers try to maintain a list of connected machines to make them easier, and quicker, to find. The difficulty is deciding which computer should maintain this list.
If you have a dedicated server on the network then you can often stop the Computer Browser service on the client machines by going into control panel->administrative tools->services then double-clicking on the “Computer Browser” option then clicking on the “Stop” button (or disable it altogether – you can always re-enable it if you run into trouble!). Another option would be to switch it to Manual.
You can also set the Browser Master status via the registry by setting IsDomainMaster to False at Registry Key:
If, however, you do not have a dedicated machine for handling these messages then it might be best to do nothing and simply allow Windows to do its job.
Another scenario this may occur is if you are running a Domain Controller, or some other dedicated service, which you want to be the Master Browser (sounds very grand), in which case you can disable the Computer Browser service on Workstations to tell them not take part in the election process for Master Browser duties. When the service is disabled the Workstation will look around for the network and get its list from the Master Browser. When doing this you need to consider if any of your workstations are likely to participate in other Networks (home, customer premises, etc) where a dedicated Master Browser does not exist. Also, ensure you have at least two machines which can act as the Master Browser just in case something happens on one of them.
Another way this can happen is if you are connected to a remote network and the device that connects the two networks together (typically a router) is forwarding UDP broadcast packets – in which case machines on the remote network may get confused when they see your machine (and vice versa). On a number of routers you may be able to stop this traffic passing between the networks – but do this with caution as software or services you are connecting to may need to send that sort of traffic over the network.
When dealing with Domain Controllers a useful utility to run from the command line is BrowStat, especially the BROWSTAT STATUS command which tells you whether browsing is active on the domain, what the master browser name is, what the backup browser servers are, how many servers exist in the domain and how many domains are available on the transport.
If you have multiple active networks cards in your computer but only one is connected this error can be caused. If your extra network cards are not connected it may be worth disabling them.
Microsoft have a useful outline of this problem: 8003 browsing errors with UDP forwarding where they describe the resolution as
“To stop the 8003 error messages, make sure the routers on the network are not forwarding UDP broadcasts, keeping browser elections on NetBT local to each subnet and enable WINS or lmhosts on the network for netbios name resolution. Note Switches that are configured for VLAN’s (virtual segmentation) have to be configured on a per VLAN basis to prevent UDP broadcast propagation. “