SceCli 1202, Userenv 1000 on all DCs

I receive these two items every 5 minutes in all three DC Application logs:

Event ID: 1202, Source: SceCli
Security policies are propagated with warning. 0x4b8: An extended error has occurred.

Event ID: 1000, Source: Userenv
The Group Policyclient-side extension Security was passed flags (17) and returned a failure status code of (1208).

I have NOT renamed the Administrator account in Group Policy.

The Default Domain Controllers policy is linked to the Domain Controllers OU (applied to Authenticated Users), verified on all DCs.

I have tried to delete and recreate the secedit.sdb on all DCs; I can’t move edb.log before doing so, but secedit.sdb does get recreated without an error message.

Has anyone seen and beaten thisdirty pair of errors?