1202 Errors, Article 278316, "ESENT event IDs 1000, 1202, 412

[Guest]

The single DC on the domain (W2K, SP4) is reporting repeated 1202 Event IDs
as well as repeated 454 and 427 Event IDs. See below:

Source: SceCli
Category: None
Event ID: 1202
Description:
Security policies are propagated with warning. 0x4b8 : An extended error has
occurred.
For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "Troubleshooting Event
1202s".

Source: ESENT
Category: Logging/Recovery
Event ID: 454
Description:
services (260) Database recovery/restore failed with unexpected error -1019.

Source: ESENT
Category: General
Event ID: 427
Description:
services (260) The database engine could not access the file called
C:\WINNT\Security\Database\secedit.sdb.

Also, attempting to open the local security policy results in the error
"Windows cannot open the local policy database.
An unknown error occured when attempting to open the database.â€

Researching, it appears that Article 278316 seems to be the approach to take.

It is the only DC for the domain. I need to be cautious. I have a copy of
the System State located on another system. What other precautions should I
be taking? If I follow the procedures is there a risk of the system not
booting?

 

[Vincent Xu [MSFT]]

Hi,

Yes, I agree with you that we can never be too cautious since it is the
only DC in domain.

Check following articles:

Backing Up Active Directory
<http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/Default
..asp?url=/technet/prodtechnol/windows2000serv/reskit/distrib/dsbj_brr_AXAL.a
sp>

Restoring Active Directory
<http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/Default
..asp?url=/technet/prodtechnol/windows2000serv/reskit/distrib/dsbj_brr_VCGI.a
sp>

263532 How to perform a disaster recovery restoration of Active Directory
on a computer with a different hardware configuration
http://support.microsoft.com/default.aspx?scid=kb;EN-US;263532

Hope this helps.

Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================



--------------------

 

[Guest]

Thanks for the information. I will take a full backup of the system. Is
there any way you could review the log? This posting was deleted
prematurely, and John Chen had requested that I do the following:

If the errors are still logged in the system log, please collect and send
me an MPS report for further analysis:
1. Access the following URL:
<http://www.microsoft.com/downloads/details.aspx?familyid=cebf3c7c-7ca5-408f
-88b7-f9c79b7306c0&displaylang=en>
2. Download MPSRPT_DirSvc_X86.EXE and execute the exe file.
3. Please send the result file (CAB file) to me at (e-mail address removed)

Should I send the log file? Thanks.

 

[Vincent Xu [MSFT]]

Hi,

Yes, please send me the log via (e-mail address removed)

Please also let me know , in which post John asked to collect the MPS
report in case you rememberred the subject.

Thanks.

Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================



--------------------

 

[Dave Britt]

Nick,

Once you have followed Vincent's great advice and are sure you have a
complete backup of the environment, I have come accross these problems
before on a machine and this is how I resolved them:

"Security policies are propagated with warning. 0x4b8 : An extended error
has occurred. Please look for more details in Troubleshooting section in
Security Help."

Using esentutl /g c:\Windows\Security\database\secedit.sdb displayed that
the database was corrupt.

Using esentutl /p c:\Windows\Security\database\secedit.sdb solved the
problem and the security element was re-applied to the machine.


--
Dave Britt

Dave's Weblog
http://davebritt.blogspot.com

 

[Guest]

I'll send the log file over this Tuesday (I will be on-site at that time).
Thanks for your help.

The original posting of this error was around 3/3/06 when John asked for the
log file. I had to put the issue on hold because the client was in critical
operations at that time. When I re-visited the problem when we were ready to
proceed, the entire post was gone. Had to re-post it over again.

 

[Vincent Xu [MSFT]]

Hi,

I'll be looking forward to your reply.


Best regards,

Vincent Xu
Microsoft Online Partner Support

======================================================
Get Secure! - www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================



--------------------