Windows Forum

Ask something
Discussion Locked

SceCli 1202, Userenv 1000 on all DCs

0 helpful
13 replies

by desktop jinx

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I receive these two items every 5 minutes in all three DC Application logs:

Event ID: 1202, Source: SceCli
Security policies are propagated with warning. 0x4b8: An extended error has occurred.

Event ID: 1000, Source: Userenv
The Group Policyclient-side extension Security was passed flags (17) and returned a failure status code of (1208).

I have NOT renamed the Administrator account in Group Policy.

The Default Domain Controllers policy is linked to the Domain Controllers OU (applied to Authenticated Users), verified on all DCs.

I have tried to delete and recreate the secedit.sdb on all DCs; I can't move edb.log before doing so, but secedit.sdb does get recreated without an error message.

Has anyone seen and beaten thisdirty pair of errors?

13 replies

by cg it

Try looking up the error codes on technet. Error code 1000 and 1202 has a couple of different senarios and workarounds. [see Q290647 & Q279432 Event ID 1000 and 1202 appear every 5 minutes on DC]

by kinetechs

I take it you already tried these steps fro Q278316:

1) Open the %SystemRoot%\Security folder, create a new folder, and then name it "OldSecurity".
2) Move all of the files ending in .log from the %SystemRoot%\Security folder to the OldSecurityfolder.
3) Find the Secedit.sdb file in the %SystemRoot%\Security\Database folder, and then rename this file to "Secedit.old".
4) Click Start, click Run, type mmc, and then click OK.
5) Click Console, click Add/Remove Snap-in, and then add the Security and Configuration snap-in.
6) Right-click Security and Configuration and Analysis, and then click Open Database.
7) Browse to the %SystemRoot%\Security\Database folder, type Secedit.sdb in the File name box, and then click Open.
8) When youare prompted to import a template, click Setup Security.inf, and then click Open.

If that still didn't do you then it also may be an issue with IIS. If you have removed IIS & SMTP server then check that the DC has removed the IWAM & IUSR users from the security policy. Go into Domain Controller Security Policy, Security Settings, Local Policies, User rights Assignment & make sure that these users are taken out of any policies they are still in. Then run "secedit /refreshpolicy machine_policy/enforce" from the command prompt and your errors may disappear.

Cheers!
~Sean

by desktop jinx

I've rebuilt secedit.sdb on all DCs; no error msg, but I couldn't move edb.log (used by another process).

IIS accounts looked right in User Rights Assignment; as a test, I removed all of them, to no avail.

by kinetechs

***Commenting on my previous post***

You say that edb.log is in use. Try to boot the DC into Directory Service Restore Mode. I'm thinking this should free up the file.

~Sean

by joseph moore

You didn't mention if you tried the fix listed in the missing Technet article, 256000? That one sounds like a winner for your problem.
I found a couple other discussion threads with people having the same Event ID errors as you do, and this articlewas the one listed as their fix.
Now, like you probably saw at eventid.net, this Technet article does not exist....

But, article 259395 is a type of replacement. Here is the URL for it:
http://support.microsoft.com/default.aspx?scid=KB;en-us;q259395
(please remove any spaces)

This article lists a short VBS script file that you can create (the entire text of the VBS is in the article, so just copy/paste it) and run it on your domain controller.

by joseph moore

The article is short, so here is the article:

How to Set and Maintain %DSDIT%, %DSLOG%, and %SYSVOL% Environment Variables
The information in this article applies to:
Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server

This article was previously published under Q259395

SUMMARY
During the promotion process (Dcpromo.exe) on a domain controller, the %DSDIT%, %DSLOG%, and %SYSVOL% environment variables are set. These variables exist only during the promotion process; they are referenced in the Basicdc.inf security template. These variables may also prove to be useful for administrators. This article describes how to write a script that sets these environment variables during startup.

MORE INFORMATION
To set these environment variables on your domain controllers, copy the following text to a file named Dcenvvars.vbs:

Set WshShell = CreateObject("WScript.Shell")
strDSLog = WshShell.RegRead("HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Database log files path")
strDSDit = WshShell.RegRead("HKLM\System\CurrentControlSet\Services\NTDS\Parameters\DSA Working Directory")
strSysvol = WshShell.RegRead("HKLM\System\CurrentControlSet\Services\Netlogon\Parameters\Sysvol")
strSysvol = Left(strSysvol, Len(strSysvol)-7)
Set WshEnv = WshShell.Environment("SYSTEM")
WshEnv("DSLOG") = strDSLog
WshEnv("DSDIT") = strDSDit
WshEnv("SYSVOL") = strSysvol

Then, in the Default Domain Controllers policy, specify the Dcenvvars.vbs script under the following section:

Computer Configuration\Windows Settings\Scripts (Startup/Shutdown)\Startup

by desktop jinx

SOMEBODY KICK ME.

I'd added Domain Admins as a Restricted Group to Default Domain Controllers policy. (Don't want anybody promoting accounts to use as a back door.)

Someone created a new account, put it in Domain Admins, removed it from all other groups (making Domain Admins its primary group).

When the DCs attempted to process Group Policy and remove this account from the Domain Admins group, they couldn't (can't remove an account from its primary group). So they balked.

The error messages are gone, replaced by happy SceCli 1704s - "Security policy in the Group policy objects are applied successfully."

by desktop jinx

(In case it wasn't clear, I changed the offending account's primary group to Domain Users, and since it was a legit addition, added it to the Restricted Groups entry for Domain Admins.)

This discussion is closed to new replies.