Event ID 1000 Userenv

[J]

Hello all,

First off I want to say thank you to anyone who responds.

I've recently upgraded my domain to windows 2003. I have a w2k3 DC which
holds all FSMO roles, DNS1, and DHCP; There's 2 w2k sp4 DC's. One of the
w2ksp4 dc's is dns2 and WINs1, this machine is having the issue. The issue
is I'm receiving the following error message in the app event log every 5
minutes.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 6/17/2004
Time: 1:57:47 PM
User: NT AUTHORITY\SYSTEM
Computer: MIL-APPS01
Description:
Windows cannot access the registry information at
\\domain.com\sysvol\domain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F
9}\Machine\registry.pol with (5).

I've used the following MS KB's to try and resolve the issue.
258296
290647 - After applying this fix and i open the GPMC on the W2k3 box i get
an error message when going to the default domain policy saying it's out of
sync and i need to resync the permissions on the sysvol and AD. This removes
the inheritable permission from parent on the policies.
828760

I've also looked at the binding order of the file and print sharing. This is
a compaq DL380 G2 with nic teaming. I put the teamed connection at the top
of the binding since file and print sharing is set on the team connection.

I've also looked at time syncing as being an issue and resynced the time
with the "PDC" and resynced the "PDC" with external navy time source. This
fixed the issue for maybe 3 hours and then it returned.

I'm only seeing this issue on one of my 3 domain controllers.

Any help will be appreciated.

J

 

[Mark Renoden [MSFT]]

Hi J

A few suggestions:

1. Disable NIC teaming and use just one interface for the time being. Leave
it this way until you manage to resolve the issue. I often see issues where
NIC teaming causes strange behaviour.

2. Point all DC's to the same DNS server as the Preferred DNS. This ensures
that all of them have a consistent view of DNS.

3. Compare the permissions on SYSVOL and all subfolders from the problematic
Windows 2000 DC with those on the functional Windows 2000 DC. You can use a
tool like cacls.exe or xcacls.exe to output to a text file.

4. Observe whether you're able to UNC (Start -> Run) to the following path
on the problematic DC:

\\domain.com\sysvol\domain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\

5. Are there any other events in the other logs which occur around the same
time that might assist in troubleshooting the issue?

In the end, this may not be straightforward to troubleshoot and you might
want to consider logging a case with Microsoft for assistance.

Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no rights.