Event ID 1202 and 1085
Scoop
constantly generate these events in the application log. I have
searched around and reviewed a number of logs including userenv,
winlogon, etc.
I think I have ruled out most of the causes found in other posts and KB
articles. I vaguely recall seeing something a while back indicating
that this may occur with the SP2 version of sysprep but I can't seem to
find that information anymore.
It is a pristine 2k3 domain with all XP clients and I don't see any
problems with replication, DNS, or anything else along those lines.
Additionally, I'll have two identical workstations in the same OU,
getting the same GPO's and one will have this problem while the other
will not. The only difference I can pinpoint is that it is much less
likely to show up on a workstation that was not built with a sysprep
image.
After a great deal of troubleshooting, I've realized that running
ESENTUTL /P on an affected workstation resolves the problem. I'm fine
with doing this but I'm not sure if there are any side affects/reasons
for not doing this. I found the following information concerning 2003
but I don't fully understand what this means and if it also applies to
XP?
"If you perform a repair with esentutl /p on a computer running Windows
Server 2003, persistent security settings (also referred to as tattoo
table) are lost so when Group Policy settings are undefined, the
server's settings do not revert to their original values."
I have not configured any Local GPO settings, if that means anything.
Can someone tell me if there are any potential pitfalls to just using
ESENTUTL /P to solve my problem?