Windows Media Centre Extenders, NIS 2009, Event ID 107 program McrMgr

Andrewh · 15 November 2008 12:55

Windows Media Centre Extenders such as Xbox 360 allow TV shows, music and other media to be streamed from a Windows Vista PC (Ultimate in my case). I experienced Event ID 107 from program the extender connection program McrMgr:-

"An unauthorized window was detected while running the Windows Media Centre Experience, 'SymNotifyWnd', with file name ''."

This has happened half hourly since upgrading to NIS 2009 on 5th November 2008. Microsoft TechNet says: -

"This error can occur when a user interface (UI), such as a dialog box or notification, is trying to appear when Windows Media Centre is started on the Extender. This is referred to as an unauthorized window because UI other than the Windows Media Centre UI is not allowed to be displayed on the Extender."

NIS 2009 is attempting to send dialog boxes or notifications to connected Windows Media Centre Extenders resulting in the Event ID 107 messages. The Xbox connection is terminated and has to be re-established and the media reselected before the show can continue.

Symantec One Click Support spent 5 hours connected remotely to my PC yesterday monitoring for the problem but it did not occur. Perhaps this fault cannot be reproduced over remote monitoring if Symantec redirect dialog box display to the remote session? They recommended the reinstallation of NIS 2009 which has changed the problem manifestation (it is not happening half hourly at the moment) but did not eliminate it as Event ID 107s still occurred. They happened every 1 to 2 minutes for several hours, for example, but this stopped once I acknowledged a dialog box on the Windows PC(sorry, can't remember what it said).

I suspect that the reinstall may have caused the NIS firewall to relearn the ports used to connect the extender and the traffic from the extender therefore no longer triggers NIS to attempt to send the same dialog box to the Xbox at half hourly intervals. However, as Version 16.0.0.125 (no update here yet) has the capability to send dialog boxes to the Xbox and cause disconnections I believe the disconnections will continue to be possible.

I do not know if this is the same issue but there is an acknowledged NIS 2009 problem where Silent Mode (which suppresses most of alerts?) does not detect full screen applications that are launched on a secondary display monitor. There is no present solution for that.

I therefore believe that NIS 2009 is capable of causing seemingly random disconnections of Windows Media Centre Extenders. I accept that the trigger for these disconnections could be the misconfiguration of the firewall, the presence of a security risk somewhere on the host PC or similar. My issue is NIS 2009 behaviour is not compatible with “UI other than the Windows Media Centre UI is not allowed to be displayed on the Extender”.

Tech0utsider · 15 November 2008 16:05

Turn on Advanced Event Monitoring.

Andrewh · 11 December 2008 10:10

Thanks. I tried this. It seems to cause a notification window to be displayed whenever a component attempts to perform an operation the requires a new rule. The problem with this is that it is these attempts by NIS 2009 to display notifications that crash the media extender connection. Advanced Event Monitoring caused more crashes.

I need to stop NIS 2009 from attempting to display any notification windows to media extenders, whatever the cause of that notification. How can I

- stop all notification window displays to extenders, or

- stop same to Vista users Mcx1, Mcx2 and Mcx3, or

- redirect all lnotification windows to the console, file, event log, in fact anywhere except to the extenders so I can at least see what is triggering some them.

I suspect that NIS 2009 could just be incompatible with Windows Media Centre Extender operation and that I will need to move to a different product. 2009 does seem faster so I prefer it to the old version but it has broken one of my major applications.

conomega · 12 December 2008 04:28

I am experiencing the same problem with 2008 and also running Vista Ultimate 32-bit. I even tried disabling Norton until reboot but that did not resolve the issue. I’m in a chat now hopefully adding some more visability to the issue.

Andrewh · 12 December 2008 09:45

I am pleased that I'm not the only one. I have spent days trying to crack this. Please let me know how you get on.

I had a 5 hour remote monitoring chat with Symantec 3 weeks ago during which the problem failed to occur, although it had been constantly failing prior.

The biggest problem with getting this solved will be that it involves where and when Norton chooses to display message windows. Remote monitoring might divert all messages to the remote operator to assist them in diagnosis but then the problem will not be triggered.

I have also experienced an extender crash, reconnect and then crash again repeatedly in a cycle lasting 3 - 5 minutes. If I then go to the PC and move the mouse to deactivate the screen save/ montor power saver the cycling stops. I have even tried using my other machine to Remote Desktop into the media centre PC to avoid disturbing the console but this also seems to change the state of NIS 2009 and the cycling crashes stop.

In other words, attempts to monitor this problem prevent it happening, which makes demonstrating it to Symantec difficult. We need an analyst to look at the problem as described by the users rather than as a logged remote assistance session but I suspect it is more difficult to escalate such bugs within the organisation.

I've got 50 days left on my subscription and am pretty much resigned to looking for another AV solution in the new year solely because of this issue. We use media centre extenders everyday (got 3) so this is a big deal to me.

conomega · 12 December 2008 17:44

What extender are you using? I’m using a 360 that is hard wired via a gigabit switch to the PC which is also wired. I never had this problem until installing Norton so i’m sure they are the cause. I thought I had luck with temporarly disabling it but it started again anyways. I use my extender to play a library of MPEG movies I have on the PC via my xbox360. This setup has worked for the past 2 years and the install of Norton has only been in the past month or so. before that i was not using any antivirus but this PC only operates on my internal LAN and does not do anythign else besides serve movies to my Xbox’s so I’m not overly concerned about not having it. In short I uninstalled it and the problem thus far went away so that has been my solution. Not exactly what I was looking for but Norton wasn’t much help on the issue as they told me to talk to Microsoft. A bit of a disappointment to say the least. I hope by at least talking about this and bugging them they will eventually decide it is a real issue and consider correcting it.

Andrewh · 20 December 2008 10:06

I use 3 x XBox 360 as extenders and they all experience the problem. My setup also did not show this problem for many months except that I had NIS 2008 throughout the troublefree period. It is only NIS 2009 that introduced it.

I record TV and the TV guide comes from the internet so running the PC without antivirus and filewall is not an option.

The problem happened again this morning after a whole week without issue. I therefore turned on Advanced Event Monitoring as someone here suggested. As soon as I tried to play the same show that had just failed the extender again disconnected but with the Eventlog message:-

"An unauthorized window was detected while running the Windows Media Center Experience, 'Norton Internet Security', with file name ''."

It usually has 'SymNotifyWnd' as the program causing the attempted window to display. NIS security history shows messages that it had created three new rules:-

1. ehshell.exe "Automatically create new rules" "Local Computer 0.0.0.0:8554" "Outbound UDP, Port 8554"

2. ehshell.exe "Automatically create new rules" "Local Computer ::0,8554" "Inbound TCP, Port 8554"

3. ehshell.exe "Automatically create new rules" "Local Computer 192.168.2.14:50004" "Outbound UDP, Port 5004" (note 50004 and 5004)

Checking the rules shows that ehshell already had one for "Allow Direction:In/Out, Computer: Any, Communications: Any, Protocol: TCP and UDP" so no new rules were needed or added. I wonder if the mismatch between the local computer port 50004 and the outgoing UDP traffic on port 5004 (not the same) might be a problem?

Andrewh · 20 December 2008 10:55

I have just experienced the message "Norton Internet Security is currently performing background tasks” on my main PC screen. If this message is broadcast all connected users (including the Media Center Extenders) that would be enough to crash their connections.

Is this displayed to all connections?

Which configuration option (if any) of NIS 2009 will turn off all of these background tasks?

How can these messages be suppressed? It is information that I do not need and it may be breaking my system?

johnkl · 2 February 2009 17:11

Anybody has a solution for this, I have the same problem on a Linksys DMA2200 extender

Andrewh · 2 February 2009 18:27

Hi johnkl,

Search for "NIS 2008 pop-up messages kill media center extender session". Symantec are testing a fix. In the meantime, a workaround is to launch Internet Explorer or Firefox on your computer and push F11. This will make the browser Full Screen and should suppress all dialog boxes, even the ones sent to the Linksys.

You will need to startup your extender first and then go Full Screen because the dialog suppression turns off every time the extender logs on. There is a Symantec fix for this workaround problem being tested as well.

johnkl · 21 March 2009 22:50

Any update on this… I still has this BIG problem that make the media extender useless

reese_anschultz · 23 March 2009 16:58

johnkl, we put changes into the 16.5 releases that address this problem, but Andrewh has reported that he is still seeing the problem. We are contacting him to better understand what is going on.

Andrewh · 23 March 2009 19:02

Reese, I didn't know that you were had been trying to contact me.

Since my first report of the problem I had followed you advice and manually set Silent Mode on for x hours when using the media center extenders. I stopped doing this a week or so ago when I read that the 16.5.0.134 update had been released and I had checked that my system had received the update.

I had three Event ID 107 errors between 7:57 and 8:19 on 21st March. The PC console showed that NIS2009 had installed an update and was prompting that it needed to do a reboot. It is this message that caused the crashes, I believe. The previous errors had mostly but not solely been from 'SymNotifyWnd' but the three on 21st March were from 'Norton Internet Security'.

I intend to run without silent mode manually enabled until the next time that the problem occurs.

reese_anschultz · 23 March 2009 20:28

Andrewh, thanks for the additional information. If it’s related to the reboot message, we should obviously fix it but fortunately, we don’t roll out updates that require reboots very often anymore.

johnkl · 23 March 2009 21:46

I Have version 16.2.0.7

How do I get the update to version 16.5.0.134

Andrewh · 15 November 2008 12:55