If you run a fully patched Windows Server Essentials 2016, you’ve probably been seeing this event in your daily Health Report since around March 2020:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Event ID: 3041
Task Category: LDAP Interface
Level: Warning
Description:
The security of this directory server can be significantly enhanced by configuring the server to enforce validation of Channel Binding Tokens received in LDAP bind requests sent over LDAPS connections. Even if no clients are issuing LDAP bind requests over LDAPS, configuring the server to validate Channel Binding Tokens will improve the security of this server. For more details and information on how to make this configuration change to the server, please see https://go.microsoft.com/fwlink/?linkid=2102405.
This is best explained in KB article 4520412. That article includes descriptions of new events.
There are two group policy changes and a registry change. I’m making the group policy changes in the existing Domain Controllers > Default Domain Controllers Policy GPO. [Edit 6/5/2023: moving this to its own GPO, still applied only to the Domain Controllers OU, to make it easier to copy to new domains that I configure.] The path for both policies is Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. I’m making the following changes for now:
- In that group policy path, change “Domain controller: LDAP server signing requirements” from None to Require Signing.
- In the same group policy path, change “Domain controller: LDAP server channel binding token requirements” from Undefined (= Never) to Defined and “When Supported”
- In the registry, change “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics\16 LDAP Interface Events” (logging level) from 0 to 2. This can also be set in the Group Policy under Computer Configuration > Preferences > Windows Settings > Registry, which nicely keeps all of these settings together in one GPO.
The last one—increasing the logging level—is important as it should allow identifying any clients that are attempting “to bind without a valid CBT” (event 3039). The binding should still be allowed since #2 is set to “When Supported”.
Once I’ve identified and remedied unsuccessful LDAP connections, I should be able to change #2 to “Always”.
Update July 31, 2020
One day later, I’m seeing several 1216 events like this:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 7/31/2020 2:15:29 AM
Event ID: 1216
Task Category: LDAP Interface
Level: Warning
Description:
Internal event: An LDAP client connection was closed because of an error.
Client IP:
[::1]:53936
Additional Data
Error value:
1236 The network connection was aborted by the local system.
Internal ID:
c060420
MSKB 246717 is not an exact match, but it sounds like those events are just showing up because I increased the logging level, not because of tighter LDAP security. To be sure, I’m going to temporarily set server signing back to “None” (option 1 above).
Update August 1, 2020
As expected, even with LDAP signing set to None, the 1216 events continue. So they are unrelated to the signing requirement and solely a byproduct of the increased logging level. Setting signing back to Require Signing.
Update August 8, 2020
The only warning/error events I’m seeing in the Directory Service log are the 1216s. However with the increased logging, that 1MB event log is only storing about one day’s worth of events. Increasing the Directory Service event log to 10MB.
Update August 17, 2020
No warnings or error in the event log other than the 1216s mentioned above. I’m changing signing to Always. If no new errors appear in the event log in a few days, I’ll reduce the logging level back to 0.
Please, Take a look here:
How to troubleshoot «Msg 3041» in SQL Server
Excerpt from page:
Message 3041 is a generic report about the backup failure. To
understand the cause of the error and resolve it, you must use the SQL
Server Error log entries that occur before the 3041 event entry.
Typically, 3041 is preceded by a detailed error message that states
the real reason for the backup failure. The detailed error messages
are written only to the SQL Server error log and to the client
application. The detailed message is not reported in the Application
log in Windows.
Update (After reading @dezso comment)
I’ve seen the «extra error» reported, but I’m not sure that they are related to the backup error. The backup error is dated at 20:31:06, but the «extra error» are dated at 17:53:27, so the extra error happened about 2 hours and 40 minutes before the actual backup error. And these extra error are related to a logon issue.
I don’t think that a logon issue happening at 17:53:27 could result in a backup failing at 20:31:06. So a think that the backup error, and that the «extra error» are unrelated.
I also don’t think that a generic error happening at 17:53:27 could result in a backup failing at 20:31:06 (unless the DB is really big).
@Arviddk report that «my SQL Server backup keeps failing on a lot of the databases» I think it’s safe to assume that «a lot» mean more than 10 DB.
So I think that if a single backup of a single DB take more than 2 hours and 40 minutes, you cant have 10 or 20 DB like that on a single server… or your server will spend it’s life doing only backup. So I assumed that the single backup take a lot less than 2 hours and 40 minutes, so I think that the backup error and the extra error are not related.
And the last «cachestore flush / ‘Bound Trees'» error reported is dated at 06-11-2012 20:30:11, so it’s something happened after the backup error. Anyway a problem related to the cache shouldn’t result in an error (event if it can slow down something).
Some questions
Some questions that could help identify the issue:
- How much time does it take a FULL backup to execute?
- How much time does it take a DIFF backup to execute?
- Does the error happen only on DIFF backup?
- Which percentage of backup does fail? (1%? 10% 50%)
- Maybe you can try to only do FULL backup to check if it’s an issue related to the DIFF backup? (I’ve never done any DIFF backup on SQL Server, I don’t have experience with them)
According to the MS website in the SQL Server log there should be some others error related to the failed backup, but I’m expecting something more near, in time, to the time at which the backup is failing.
- Remove From My Forums
-
Question
-
ISSUE: Error: 3041, Severity: 16, State: 1. Check the backup application log
All was runing fine before that.
Our transaction log Native backup job suddenly started failing on SQL Server 2005 sp3 with version 9.0.4226.
ERRORLOG :
==============================================================
2009—12—01 17:05:33.150 Backup Error: 3041, Severity: 16, State: 1.
2009—12—01 17:05:33.150 Backup BACKUP failed to complete the command BACKUP LOG xTract. Check the backup application log for detailed messages.
==============================================================
-
Moved by
Wednesday, December 2, 2009 3:18 AM
(From:MSDN, TechNet, and Expression Profile Feedback) -
Changed type
Naomi N
Monday, November 28, 2016 5:23 AM
question
-
Moved by
Проблема: Иногда при ночном создании бекапа базы 1С 7.7, на MS SQL Server 2008, получаем ошибку Error: 3041, Severity: 16, State: 1. Check the backup application log, но если запускать утром вручную — выполняется нормально.
Источники:
Error: 3041, Severity: 16, State: 1. Check the backup application log
v7: Не получается создать бекап на сетевой диск
Решение: В нашем случае — начать бекап не позволяла задача CheckDB, выполняющаяся за 5 минут до старта бекапа, и блокирующая базу.
Помог перенос старта задачи на 10 минут, чтобы они не пересекались.
SQL Backup Error 3041 – Top Ways to Fix MS SQL Server Error
Summary: This blog will provide the complete and easiest way to fix SQL backup error 3041. Simply read the complete article carefully to get rid of this error immediately. The task isn’t that hectic if users clarify their technicalities in the SQL database. All you need is a tutorial like this one.
MS SQL Backup Error 3041 – Know What Exactly it is
Backup error 3041 is a generic error that is returned when a backup fails. Along with this error, there are additional errors returned and can be found in the SQL Server log, so we can also call it SQL server backup log error 3041.
After understanding about this MS SQL backup error. Now, let’s proceed further to know more about this issue with the help of user’s real-time scenario.
User’s Real-time Scenario
#Query 1: Hi, currently I am working on to resolve this error:
“Error: 3041, Severity: 16, State: 1 BACKUP failed to complete the command BACKUP DATABASE WITH DIFFERENTIAL. Check the backup application log for detailed messages.“
I had a full backup of the database, but somehow I failed earlier today in the morning. I checked the event viewer which also indicates to check the backup application log. So, how to check backup application log? Or any ideas to solve this MS SQL 3041 backup error problem. If yes? then please suggest me. Thank you very much in advance
#Query 2: Backup Error: 3041, Severity: 16, State: 1.
This SQL error 3041 backup failed message prompts after I failed from taking backup. Now, I need an efficient solution to fix this issue. Thanks.
Quick Solution: In some cases, this MS SQL backup error 3041 occurs due to the corruption issues. So, you should check that database is free from any type of corruption.
However, you should check all the configuration changes you have made. Also, be sure to reboot the system every time a new database is added to the server and a full backup is performed after rebooting the local system.
Note: The above-stated solution is not a proficient one to fix SQL server backup failed error 3041. So, in this situation, you can choose an alternative method to get satisfactory results. In the oncoming section, we will discuss the same. Get a quick look:
An Eminent Way to Fix SQL Backup Error 3041 Without Data Loss
After considering the above-mentioned queries we would like to provide you a rapid solution named SQL Backup Recovery. Using this amazing utility, you can easily get rid of this SQL backup error 3041 without data loss.
The tool has an explanatory and understandable interface. O, any user either novice or technical can operate it without taking any expertise help. However, you can download it on any Windows OS machine because it extensively supports all editions of Windows Operating System.
So, let’s proceed ahead to the oncoming section, where we will disclose the steps to fix SQL error 3041 backup failed.
Steps to Resolve SQL Server Backup Failed Error 3041 Issue
Here, in this section, we will disclose the instruction to fix SQL server backup log error 3041. You just have to follow all the steps to execute the procedure. Let’s begin:
Step 1: Download free demo version of the eminent utility by selecting the download button.
Download Now Purchase Now
Step 2: Click Browse button to add SQL Server BAK files. Then, select the version of your SQL backup file.
Step 3: Now, choose the Multiple Backup file options to backup and export multiple BAK files at once.
Step 4: Select the preferred files and click on the Recover button to backup file which is corrupted and showing error.
Step 5: After completion of the scanning and recovering data components process. Opt the desired elements and hit on the Export button.
Step 6: Choose Export to between SQL Server Database and SQL Server Compatible SQL Scripts. And opt Database Authentication option then, add all the details.
Step 7: Click on the required SQL database items and choose export option between with Schema & Data and With only Schema.
Step 8: Press the Export button to export recovered backup file to the SQL Server Database.
Step 9: At last, the application will pop-up a message after successful completion of the backup procedure.
Attention Note: The free download version allows you to export only 25 records. So, it is better to go with the purchase edition of the application.
Concluding Thoughts
How to fix SQL backup error 3041? It is a most commonly asked query by the MS SQL users. SQL server backup failed error 3041 can be occur anytime to anyone. So, by performing the above-suggested solutions, you can fix this SQL error 3041 backup failed without any data loss.