OS & Network
Windows, macOS, Linux, and network faults: update codes, permissions, DNS, and connectivity.
systemd: Start request repeated too quickly
systemd refuses to start a unit that was started more than StartLimitBurst times (default 5) within StartLimitIntervalSec (default 10s), and Restart= counts against that limit. With the 100 ms default RestartSec a crashing service burns all five attempts in under a second. Find the real crash in the journal, fix it, run reset-failed, and give restarts room with RestartSec.
SSH: Received disconnect ... Too many authentication failures
Your agent is offering more keys than the server will let you try. Every public key sshd looks at burns one of the MaxAuthTries attempts — six by default, often three on a hardened host — so the right key never gets its turn and the server hangs up before you type anything. IdentitiesOnly=yes with an explicit IdentityFile pins the connection to one key and the attempt count drops to one.
Active Directory: replication fails with error 1722, The RPC server is unavailable
RPC reports 1722 (0x6ba, RPC_S_SERVER_UNAVAILABLE) when a lower layer fails to connect, so the real fault is almost never RPC itself — it is DNS, a blocked port, or a host-side setting on one of the two domain controllers. repadmin tells you which partner is failing, dcdiag /test:dns rules out name resolution, and Test-NetConnection plus the dynamic port range settle the firewall question. The most common miss is a rule that allows TCP 135 but not 49152–65535.
Windows Server RDS: The remote session was disconnected because there are no Remote Desktop License Servers available to provide a license
The 120-day RD Licensing grace period ended and the session host has no usable license server, so it refuses sessions. GetGracePeriodDays returning DaysLeft 0 and an empty SpecifiedLSList confirm it in seconds. The fix is a real, activated license server with CALs that are new enough for the host — a 2019 CAL cannot serve a 2022 session host — configured through the deployment or the Licensing policies, plus RPC ports open between the two.
Windows 11: "Your organization's security policies block unauthenticated guest access" when opening a NAS share (0x80070035)
The SMB client on Windows 10 Enterprise/Education/Pro for Workstations, Windows 11 Pro and Windows Server 2019+ refuses guest logons by default, and Windows 11 24H2 Enterprise/Pro/Education also requires SMB signing, which guest sessions can't do. A NAS share that only offers guest access therefore fails with the 'block unauthenticated guest access' dialog, Error code 0x80070035, or System error 3227320323, and Event ID 31017 'Rejected an insecure guest logon' lands in the SmbClient/Security log. The fix Microsoft recommends is a real account on the NAS and signing support in its firmware; Set-SmbClientConfiguration -EnableInsecureGuestLogons $true (plus -RequireSecuritySignature $false on 24H2) is the escape hatch, and it costs you signing and encryption on that client.
Ubuntu/Debian: E: Could not get lock /var/lib/dpkg/lock-frontend — who holds it and how to wait for it
Another package manager, usually Ubuntu's unattended-upgrades fired by a persistent systemd timer at boot, holds the dpkg frontend lock while your apt-get runs. apt-get gives up at once while apt waits because Ubuntu ships binary::apt::DPkg::Lock::Timeout "120" for the apt binary only. Read the PID from the message, let the run finish or pass -o DPkg::Lock::Timeout=<seconds> to apt-get, run dpkg --configure -a only after a genuinely interrupted run, and never delete the lock file: it is an fcntl lock the kernel releases when the holder exits.
macOS: xcrun: error: invalid active developer path (/Library/Developer/CommandLineTools)
git, make, clang and other /usr/bin developer commands on macOS are shims that hand off to the active developer directory, and xcrun is reporting that the directory xcode-select points at has no tools in it — most often because a major macOS upgrade left /Library/Developer/CommandLineTools empty, or Xcode was moved or deleted. Check xcode-select -p and the package receipt, then reinstall the Command Line Tools with xcode-select --install, or point xcode-select at the Xcode you actually have.
Windows: The trust relationship between this workstation and the primary domain failed (1789)
Windows shows this at the sign-in screen when the computer account password the machine holds no longer matches the one Active Directory holds — usually because a VM was reverted to a snapshot, a clone joined with the same name, or someone reset or deleted the account. Sign in with a local administrator, confirm the break with Test-ComputerSecureChannel, then repair the channel in place with -Repair or Reset-ComputerMachinePassword. A rejoin is only needed when the account is gone (error 1787).
Windows: The application was unable to start correctly (0xc000007b)
You launch an app and Windows answers with "The application was unable to start correctly (0xc000007b)" and nothing starts. The code is the NTSTATUS value STATUS_INVALID_IMAGE_FORMAT — almost always a 32-/64-bit DLL mismatch or a missing Visual C++ Redistributable. Install the matching redist, repair system files with SFC/DISM, or remove the wrong-bitness DLL.
Chrome: DNS_PROBE_FINISHED_BAD_CONFIG on every site
Chrome shows "This site can't be reached" with DNS_PROBE_FINISHED_BAD_CONFIG on every site, not just one. Chrome's own probe decided your machine's DNS setup — not the website — is broken: a stale resolver cache, a bad DHCP lease, a corrupt network stack, or a dead DNS server. Flush the cache, renew the lease, or point at a resolver that answers.
Linux: diagnosing "Connection refused" (ECONNREFUSED)
Connection refused is the fast failure — the host is up, but the port said no. It's one of four things: nothing listening, a service bound to 127.0.0.1, the wrong port, or a firewall REJECT. ss on the server tells you which in one line, and the fix is to start, rebind, or open the port.
Windows Update: 0x80070005 (E_ACCESSDENIED) on install
0x80070005 is E_ACCESSDENIED — the servicing stack was denied access to a file, folder, or registry key, so the update rolls back. CBS.log names the object that was denied. Reset the component-store permissions with icacls, and if that isn't enough, rebuild the update caches and unload the antivirus filter driver that's holding them.
Windows: Only one usage of each socket address (WSAEADDRINUSE 10048)
A service dies on startup with "Only one usage of each socket address ... is normally permitted" — Winsock error 10048 (WSAEADDRINUSE). Another socket already owns the port. Find the owning PID with netstat -ano or Get-NetTCPConnection, stop that process with taskkill, or move your app to a free port. TIME_WAIT and SO_EXCLUSIVEADDRUSE explain the trickier cases.
Linux: "No space left on device" but df shows free space (inodes)
The disk has gigabytes free, df -h agrees, yet every write fails with No space left on device. The filesystem is out of inodes, not blocks — df -i shows IUse% at 100%. Find the directory full of tiny files, clear them, and writes succeed. The inode count is fixed when the filesystem is made, so prevention is expiry plus watching df -i.
SSH: Host key verification failed
SSH refuses to connect with "Host key verification failed" because the key the server presented doesn't match what it recorded in known_hosts — usually a rebuilt server, a reused IP, or a rotated vendor key, not an attack. Confirm the new key is genuine by its fingerprint, remove the stale entry with ssh-keygen -R, and reconnect.
SSH: Permission denied (publickey)
The server accepted no key you offered. Usually the key is not loaded, the wrong key is being sent, or the server rejects it over file permissions. Verbose output shows exactly which, so you fix the real one.
Linux: Too many open files (EMFILE)
A process hit its open-file-descriptor limit. Raise the limit where the process actually runs — for a service, in the systemd unit, not your shell — and check for a descriptor leak so the higher limit is not just delaying the failure.
Chrome: DNS_PROBE_FINISHED_NXDOMAIN
The browser could not resolve the domain to an IP. Rule out a typo, flush the DNS cache, try a public resolver, and check the hosts file — a stale cache or a bad resolver is the usual cause, and whether one device or all fail tells you where to fix it.
macOS: "App is damaged and can't be opened"
Gatekeeper blocks an app downloaded outside the App Store by flagging its quarantine attribute. For an app you trust, remove the quarantine attribute and it opens — but confirm the source first, because this bypasses a real security check.
EADDRINUSE: address already in use — free the port
Something is already listening on the port your app wants. Find the process holding it, then stop that process or move your app to another port — and if it only fails on quick restarts, the socket is in TIME_WAIT.
macOS: zsh: command not found: brew
Homebrew installed fine, but its bin directory is not on your PATH. On Apple silicon it lives in /opt/homebrew; add its shellenv to your shell profile so brew is found in every session.