Software

Ask something
Question Locked

Domain Password

0 helpful
15 replies

by cameron.smith

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Dear anyone,

We have a slight problem that is confusing us. We used to have a non-complex domain password of 6 letters on our Windows 2003 AD domain, and we have changed this in the default domain policy to 8 characters complex.

This doesn't seem to apply, it still allows us to put in 6 character non-complex passwords and the error if you type a wrong password stipulates 6 characters.

I have checked all other group policy objects and none of them have any password settings.

I have ran Resulatant Set of Policy and this shows 8 characters complex. I have also ran group policy modeling which says that the default domain policy is the only policy being applied.

Whats going wrong, is there a way to force the policy to refresh or a way to find what is confliting?

Any help would be appreciated.

Cheers

Cam

15 replies

by cameron.smith

Yes I have tried gpupdate /force and /logoff, this seems to refresh the policy but still the new settings are not applied.

by scott_heath

Where are you runnign RSoP? If it's on the PC it's talking about accounts LOCAL to the PC. Go run RSoP on your DCs and see if they are getting the policy as they are the ones with the domain user accounts.

by cameron.smith

Thanks for that that has helped a bit...

On the DC the policy shows a red warning cross and in the properties it says:

"Policy engine did not configure group policy object......etc"

I have had a look in the winlogon.log as it suggests but this doesnt really explain why it isn't applying.

Last few days of that log follow:

23 November 2007 04:49:40
----Configuration engine was initialized successfully.----

----Reading Configuration Template info...

----Configure General Service Settings...
Configure Messenger.

General Service configuration was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Configure Security Policy...
Configure password information.

System Access configuration was completed successfully.

Audit/Log configuration was completed successfully.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature.

Configuration of Registry Values was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Un-initialize configuration engine...

this is the last GPO.
**************************

Make a local copy of \\ourdomain.org\SysVol\ourdomain.org\Policies\{58ECB686-50F7-45BC-A1DA-6CD56FE3B38A}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkOrganizationUnit GPO_INFO_FLAG_BACKGROUND )

Make a local copy of \\ourdomain.org\sysvol\ourdomain.org\Policies\{FC986906-3391-433E-811E-C52C1303133E}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )

Make a local copy of \\ourdomain.org\sysvol\ourdomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )

Process GP template gpt00000.inf.

This is not the last GPO.
-------------------------------------------
27 November 2007 08:33:43
Copy undo values to the merged policy.

----Un-initialize configuration engine...

Process GP template gpt00001.dom.

This is not the last GPO.
-------------------------------------------
27 November 2007 08:33:44

----Un-initialize configuration engine...

Process GP template gpt00002.dom.
-------------------------------------------
27 November 2007 08:33:44
----Configuration engine was initialized successfully.----

----Reading Configuration Template info...

----Configure General Service Settings...
Configure Messenger.

General Service configuration was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Configure Security Policy...
Configure password information.

System Access configuration was completed successfully.

Audit/Log configuration was completed successfully.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature.

Configuration of Registry Values was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Un-initialize configuration engine...

this is the last GPO.
**************************

Make a local copy of \\ourdomain.org\sysvol\ourdomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )

Process GP template gpt00000.dom.
-------------------------------------------
27 November 2007 12:11:50
Copy undo values to the merged policy.
----Configuration engine was initialized successfully.----

----Reading Configuration Template info...

----Configure General Service Settings...
Configure Messenger.

General Service configuration was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Configure Security Policy...
Configure password information.

System Access configuration was completed successfully.
Configure event audit settings.
Undo value for undefined group policy setting was reset successfully and removed.

Audit/Log configuration was completed successfully.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature.

Configuration of Registry Values was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Un-initialize configuration engine...

this is the last GPO.
**************************

Make a local copy of \\ourdomain.org\sysvol\ourdomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )

Process GP template gpt00000.dom.
-------------------------------------------
27 November 2007 14:07:50
Copy undo values to the merged policy.
----Configuration engine was initialized successfully.----

----Reading Configuration Template info...

----Configure General Service Settings...
Configure Messenger.

General Service configuration was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Configure Security Policy...
Configure password information.

System Access configuration was completed successfully.

Audit/Log configuration was completed successfully.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature.

Configuration of Registry Values was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Un-initialize configuration engine...

this is the last GPO.
**************************

Make a local copy of \\ourdomain.org\sysvol\ourdomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )

Process GP template gpt00000.dom.
-------------------------------------------
28 November 2007 08:51:54
Copy undo values to the merged policy.
----Configuration engine was initialized successfully.----

----Reading Configuration Template info...

----Configure General Service Settings...
Configure Messenger.

General Service configuration was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Configure Security Policy...
Configure password information.

System Access configuration was completed successfully.

Audit/Log configuration was completed successfully.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature.

Configuration of Registry Values was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Un-initialize configuration engine...

this is the last GPO.
**************************

Make a local copy of \\ourdomain.org\sysvol\ourdomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )

Process GP template gpt00000.dom.
-------------------------------------------
29 November 2007 08:28:01
Copy undo values to the merged policy.
----Configuration engine was initialized successfully.----

----Reading Configuration Template info...

----Configure General Service Settings...
Configure Messenger.

General Service configuration was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Configure Security Policy...
Configure password information.

System Access configuration was completed successfully.

Audit/Log configuration was completed successfully.
Configure machine\software\microsoft\windows nt\currentversion\winlogon\passwordexpirywarning.
Configure machine\system\currentcontrolset\services\lanmanworkstation\parameters\requiresecuritysignature.

Configuration of Registry Values was completed successfully.

----Configure available attachment engines...

Configuration of attachment engines was completed successfully.

----Un-initialize configuration engine...

this is the last GPO.

by scott_heath

It looks like everything completed successfully. Look under C:\windows\Debug\UserMode, there are some logs their like gptext.log and userenv.log that might help.

Also, how long has this box been up? Is it out of the question to reboot it?

by cameron.smith

GPtext.log =

GPTEXT(1680.147c) 17:09:43:605 CPolicyComponentData::AddTemplates: Failed to copy to <\\******\SysVol\******\Policies\{0D1813CD-26CF-43A5-AAD2-85B5E9AF7486}\Adm> with 7.
GPTEXT(c7c.146c) 19:41:17:187 CPolicyComponentData::EnumerateScopePane: ADM event has been signaled.

GPEdit.log =

GPEDIT(b0c.978) 16:03:14:699 CGroupPolicyObject::SetDisplayNameI: Failed to write display name to gpt.ini with 0x0
GPEDIT(b0c.978) 16:03:14:699 CGroupPolicyObject::OpenDSGPO: GetFileAttributes for \\hq.bcs.org.uk\SysVol\hq.bcs.org.uk\Policies\{FA1605E0-F7B5-4DF2-87D0-18598AFB4303} FAILED with 2.
GPEDIT(124c.1048) 11:57:42:958 CGroupPolicyObject::SetDisplayNameI: Failed to write display name to gpt.ini with 0x0
GPEDIT(124c.1048) 11:57:42:974 CGroupPolicyObject::OpenDSGPO: GetFileAttributes for \\hq.bcs.org.uk\SysVol\hq.bcs.org.uk\Policies\{340591A7-B0E3-49A9-9695-D43D93FD961B} FAILED with 2.

I don't have a userenv.log on the DC. We have rebooted several times since the password conditions where changed.

by scott_heath

You have a unique issue, that's for sure. Check ouy these articles. They don't all have to do with your issue, but I am thinking they may have some similar steps you could try.

http://support.microsoft.com/default.aspx?scid=kb;en-us;935918

http://support.microsoft.com/default.aspx?scid=kb;en-us;842804

http://support.microsoft.com/default.aspx?scid=kb;en-us;883271

http://support.microsoft.com/default.aspx?scid=kb;en-us;887303

by cameron.smith

Type: Warning
Source: SceCli
Event ID: 1202
Event Time: 30/11/2007 14:51:47
User: n/a
Computer: BCSDC02
Description:
Security policies were propagated with warning.
0x534 : No mapping between account names and security IDs was done.
Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".
Error 0x534 occurs when a user account in one or more Group Policy objects (GPOs) could not be resolved to a SID. This error is possibly caused by a mistyped or deleted user account referenced in either the User Rights or Restricted Groups branch of a GPO. To resolve this event, contact an administrator in the domain to perform the following actions:
1. Identify accounts that could not be resolved to a SID:
From the command prompt, type: FIND /I "Cannot find" %SYSTEMROOT%\Security\Logs\winlogon.log
The string following "Cannot find" in the FIND output identifies the problem account names.
Example: Cannot find JohnDough.
In this case, the SID for username "JohnDough" could not be determined. This most likely occurs because the account was deleted, renamed, or is spelled differently (e.g. "JohnDoe").
2. Use RSoP to identify the specific User Rights, Restricted Groups, and Source GPOs that contain the problem accounts:
a. Start -> Run -> RSoP.msc
b. Review the results for Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment and Computer Configuration\Windows Settings\Security Settings\Local Policies\Restricted Groups for any errors flagged with a red X.
c. For any User Right or Restricted Group marked with a red X, the corresponding GPO that contains the problem policy setting is listed under the column entitled "Source GPO". Note the specific User Rights, Restricted Groups and containing Source GPOs that are generating errors.
3. Remove unresolved accounts from Group Policy
a. Start -> Run -> MMC.EXE
b. From the File menu select "Add/Remove Snap-in..."
c. From the "Add/Remove Snap-in" dialog box select "Add..."
d. In the "Add Standalone Snap-in" dialog box select "Group Policy" and click "Add"
e. In the "Select Group Policy Object" dialog box click the "Browse" button.
f. On the "Browse for a Group Policy Object" dialog box choose the "All" tab
g. For each source GPO identified in step 2, correct the specific User Rights or Restricted Groups that were flagged with a red X in step 2. These User Rights or Restricted Groups can be corrected by removing or correcting any references to the problem accounts that were identified in step 1.

I have ran the command line FIND and it brings up "admins" as the account it can't find.

by cameron.smith

I think I have narrowed this problem down a bit.
The application event log: "Security policies were propagated with warning. 0x534 : No mapping between account names and security IDs was done." Is appearing on the domain controller, and most of the default doamin policy computer security config is marked with little red x's.

I have followed the instructions associated with the error, it asks me to run a find command on the winlogon.log, this brings up "cannot find admins." I have then gone into the default domain policy but I cannont find anything that refers to admins. I have doamin admins in there but that SSID seems to be fine.

Is there another way of Identifing the problem? Should I strip off all permissions and sat again? If I do what are the main system permissions that need to be there for it to work?

by scott_heath

Fall under the "Computer Configuration" section of Group Policy objects. This mean they are applied using the computer account. Check the permissions assigned to the DC computer object vs other computer objects and see what that shows us.

by cameron.smith

The policy is being applied to all authenticated users which I think includes all Computers and Users on the domain.

We have an exception to this for the domain contollers but thats about it.

by dumphrey

but I would have thought that GP would have used it already...can't hurt to check.

by scott_heath

... in the same policy but the two seperate segments of the policy affect different objects.

Um, the DCs is where you need this policy to take affect in order for it to apply to the accounts of all domain users.

This discussion is closed to new replies.