Scripts ProcessGroupPolicy
CB
I HAD TO REBUILD THE SYSVOL BY MAKING FOLDERS BASED ON SOME GUIDS, BUT IT
DID NOT COMPLETELY RESOLVE THE ISSUE.
RECEIVE THESE EVERY 5 MINUTES IN THE DC EVENT LOG WIN 2000 SP4 .
THANKS IN ADVANCE.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 2/20/2010
Time: 10:49:54 PM
User: NT AUTHORITY\SYSTEM
Computer: LUXSRV2
Description:
Windows cannot process extension Scripts ProcessGroupPolicy. Return value
(0x2).
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 2/20/2010
Time: 10:49:54 PM
User: NT AUTHORITY\SYSTEM
Computer: LUXSRV2
Description:
The Group Policy client-side extension Scripts was passed flags (17) and
returned a failure status code of (2).
Meinolf Weber [MVP-DS]
Please describe what exactly happened before you start recovering your sysvol,
also give some more info about the complete domain setup, amount of DCs,
how they are located and if all are running Windows server 2000 with the
latest patches installed also.
Small remark: Using capitals is like crying around. :-)
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
CB
3 DC's.
Two on site...one remote.
Windows 2000 SP4
Came into this setup and found the sysvol folders empty.
Tried this:
http://support.microsoft.com/kb/253268
Restored some of the content now I get that error.
I read somewhere it might be the user profiles on the DC.
This is showing up on the other DC:
Event Type: Warning
Event Source: SceCli
Event Category: None
Event ID: 1202
Date: 2/21/2010
Time: 1:09:34 PM
User: N/A
Computer: LUXLA1
Description:
Security policies are propagated with warning. 0x534 : No mapping between
account names and security IDs was done.
For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "troubleshooting 1202
events".
A user account in one or more Group policy objects (GPOs) could not be
resolved to a SID. This error is possibly caused by a mistyped nor deleted
user account referenced in either the User Rights or Restricted Groups branch
of a GPO. To resolve this event, contact an administrator in the domain to
perform the following actions:
1.Identify accounts that could not be resolved to a SID: From the command
prompt, type: FIND /I "Cannot find" %SYSTEMROOT%\Security\Logs\winlogon.log
The string following "Cannot find" in the FIND output identifies the problem
account names.
Example: Cannot find JohnDough.
In this case, the SID for username "JohnDough" could not be determined. This
most likely occurs because the account was deleted, renamed, or is spelled
differently (e.g. "JohnDoe").
2.Identify the GPOs that contain the unresolvable account name:
From the command prompt type FIND /I "JohnDough"
%SYSTEMROOT%\Security\templates\policies\gpt*.*
The output of the FIND command will resemble the following:
---------- GPT00000.DOM
---------- GPT00001.DOM
SeRemoteShutdownPrivilege=JohnDough
This indicates that of all the GPO’s being applied to this machine, the
unresolvable account exists only in one GPO. Specifically, the cached GPO
named GPT00001.DOM.
Now we need to determine the friendly name of this GPO in the next step.
3. Locate the friendly names of each of the GPOs that contain an
unresolvable account name. These GPOs were identified in the previous step.
From the command prompt, type: FIND /I "[Mapping]"
%SYSTEMROOT%\Security\Logs\winlogon.log
The string following "[Mapping] gpt0000?.dom =" in the FIND output
identifies the friendly names for all GPO’s being applied to this machine.
Example: [Mapping] gpt00001.dom = User Rights Policy
In this case, the GPO that contains the unresolvable account (gpt00001.dom)
has a friendly name of "User Rights Policy".
4. Remove unresolved accounts from each GPO that contains an unresolvable
account.
a. Start -> Run -> MMC.EXE
b. From the File menu select "Add/Remove Snap-in…"
c. From the "Add/Remove Snap-in" dialog box select "Add…"
d. In the "Add Standalone Snap-in" dialog box select "Group Policy" and
click "Add"
e. In the "Select Group Policy Object" dialog box click the "Browse" button.
f. On the "Browse for a Group Policy Object" dialog box choose the "All" tab
g. Right click on the first policy identified in step 3 and choose edit
h. Review each setting under Computer Configuration/ Windows Settings/
Security Settings/ Local Policies/ User Rights
Assignment or Computer Configuration/ Windows Settings/ SecuritySettings/
Restricted Groups for accounts identified in step 1.
i. Repeat steps 3g and 3h for all subsequent GPOs identified in step 3.
Meinolf Weber [MVP-DS]
So on all 3 DCs the sysvol fodlers are complete empty or is this only on
one of them? If the latter please post an unedited repadmin /showreps from
each DC and also dcdiag /v from each one.
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
> b. From the File menu select "Add/Remove Snap-in."
> c. From the "Add/Remove Snap-in" dialog box select "Add."
CB
----Configure User Rights...
Configure S-1-5-32-544.
Configure S-1-5-32-551.
Configure S-1-5-21-842925246-1060284298-682003330-1002.
Configure S-1-5-21-842925246-1060284298-682003330-1001.
Configure S-1-5-21-4106432604-1693722237-1843359646-512.
Configure S-1-5-21-4106432604-1693722237-1843359646-500.
Configure S-1-5-21-4106432604-1693722237-1843359646-2260.
Configure S-1-5-21-4106432604-1693722237-1843359646-2315.
Configure S-1-5-21-4106432604-1693722237-1843359646-5125.
Configure Power Users.
Error 1332: No mapping between account names and security IDs was done.
Cannot find Power Users.
Configure S-1-5-32-545.
Configure S-1-1-0.
Configure S-1-5-6.
Configure S-1-5-21-842925246-1060284298-682003330-501.
Configure S-1-5-21-842925246-1060284298-682003330-1000.
>