Event ID 1202 - W2K Server

[Claude]

Hi,

Ever since I changed the Security Option to display a "Message text for
users attempting to log on" (a Legal Notice), the event viewer keeps on
logging the error below at 5 min intervals:
*** Start
Security policies are propagated with warning. 0xb : An attempt was made to
load a program with an incorrect format.

For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "Troubleshooting Event
1202s".
*** End

As suggested in the message, I looked into Microsoft's support but could not
find anything related to the exact message I get (0xb : An attempt was made
to load a program with an incorrect format.).

I tried to delete the content of the "Legal Notice" but it is not able to
apply the change and keeps on logging the same error...looks like it is
caught in a loop.

Any help would be much appreciated as I have no clue as to what is happening
or where to look for a solution.

Thanks,
Claude

 

[Claude]

Additional Info that may help resolving this problem:

I got the following from the Winlogon.log

Copy local policy.
Error 11: An attempt was made to load a program with an incorrect format.
Error convertting section Registry Values.
----Configuration engine is initialized with error.----

Claude

 

[Claude]

More info (as I keep on digging)...

The files gpt00002.inf located under %windir%\security\template\policies
contains the [Registry Values] of the Legal Notice text I am trying to
initialize. I can see it contains some characters (0D000A00 hex) meant to
insert carriage returns into the text, however I believe that is what it
doesn't like.

So I went back to the Local Security settings of the PDC and re-initialized
the "Legal Notice" text to "".
This had no effect on the gpt00002.inf file as the [Registry Values] for the
"Legal Notice" are still there. After making a backup of the gpt00002.inf
file I edit it to remove the [Registry Values] section.... no luck; at every
5 min, that file gets re-created and contains the [Registry Values] along
with the complete "Legal Notice" text.

Where does it read it from? I'd like to find & clena the source so I can
get out of this loop?

Any help would be very much appreciated!!

Claude