Security Policy Error

[Ben]

Hi,

I'm receiving 2 reoccuring errors (below) in my application event log. They
seem to be something to do with the security policies, however I've checked
through all our GPOs and can't find anything wrong. I looked on eventid.net
and also microsoft.com for some possible solutions, and I found the
following http://support.microsoft.com/default.aspx?scid=kb;en-us;324383 in
the section covering "0x5: Access denied:" there is a procedure to enable
debugging, in step 3 you run a find query on the winlogon.log file to find
any service with misconfigured permissions, however my search did not return
any errors so I was unable to proceed to the next step. Can anyone provide
any assistance? We're running a Win2000 domain, with 2 win2000 SP4 DCs.

Cheers

Ben

Event Type: Error
Event Source: ESENT
Event Category: General
Event ID: 427
Date: 02/12/2004
Time: 14:52:10
User: N/A
Computer: GBSERV2-2K
Description:
services (256) The database engine could not access the file called
C:\WINNT\Security\edb.log.


Event Type: Warning
Event Source: SceCli
Event Category: None
Event ID: 1202
Date: 02/12/2004
Time: 14:52:10
User: N/A
Computer: GBSERV2-2K
Description:
Security policies are propagated with warning. 0x5 : Access is denied.

For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "Troubleshooting Event
1202s".

 

[Diana Smith [MSFT]]

Hello Ben,

Here is an article that should help you:

Troubleshooting SCECLI 1202 Events ---->
http://support.microsoft.com/default.aspx?scid=KB;EN-US;324383

Thank You.

Diana.


This posting is provided "AS IS" with no warranties, and confers no rights.


(e-mail address removed)



--------------------
| From: "Ben" <[email protected]>
| Subject: Security Policy Error
| Date: Thu, 2 Dec 2004 16:07:01 -0000
| Lines: 46
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2800.1437
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
| Message-ID: <[email protected]>
| Newsgroups: microsoft.public.win2000.security
| NNTP-Posting-Host: 81-86-68-63.dsl.pipex.com 81.86.68.63
| Path:
cpmsftngxa10.phx.gbl!TK2MSFTFEED01.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13
..phx.gbl
| Xref: cpmsftngxa10.phx.gbl microsoft.public.win2000.security:34272
| X-Tomcat-NG: microsoft.public.win2000.security
|
| Hi,
|
| I'm receiving 2 reoccuring errors (below) in my application event log.
They
| seem to be something to do with the security policies, however I've
checked
| through all our GPOs and can't find anything wrong. I looked on
eventid.net
| and also microsoft.com for some possible solutions, and I found the
| following http://support.microsoft.com/default.aspx?scid=kb;en-us;324383
in
| the section covering "0x5: Access denied:" there is a procedure to enable
| debugging, in step 3 you run a find query on the winlogon.log file to find
| any service with misconfigured permissions, however my search did not
return
| any errors so I was unable to proceed to the next step. Can anyone provide
| any assistance? We're running a Win2000 domain, with 2 win2000 SP4 DCs.
|
| Cheers
|
| Ben
|
| Event Type: Error
| Event Source: ESENT
| Event Category: General
| Event ID: 427
| Date: 02/12/2004
| Time: 14:52:10
| User: N/A
| Computer: GBSERV2-2K
| Description:
| services (256) The database engine could not access the file called
| C:\WINNT\Security\edb.log.
|
|
| Event Type: Warning
| Event Source: SceCli
| Event Category: None
| Event ID: 1202
| Date: 02/12/2004
| Time: 14:52:10
| User: N/A
| Computer: GBSERV2-2K
| Description:
| Security policies are propagated with warning. 0x5 : Access is denied.
|
| For best results in resolving this event, log on with a non-administrative
| account and search http://support.microsoft.com for "Troubleshooting Event
| 1202s".
|
|
|


This posting is provided "AS IS" with no warranties, and confers no rights.


(e-mail address removed)

 

[Steven L Umbach]

Http://www.eventid.net is a great place to track down info on event ID's as
results are shown in the link below for your error.

http://www.eventid.net/display.asp?eventid=1202&eventno=348&source=SceCli&phase=1
-- event 1202
http://www.eventid.net/display.asp?eventid=427&eventno=1693&source=ESENT&phase=1
-- event 427

Error code 0x5 (decimal 5) - Access is denied. This issue occurs because of
the locked-down security that was originally set on the FRS through Group
Policy. When you attempt to configure the FRS through Group Policy, the
policy engine no longer has the permission to set security on the FRS and
does not attempt to take ownership of the FRS. See Q284461 for resolution

http://support.microsoft.com/Default.aspx?id=284461 -- possible fix??

Also check your security permissions to the \winnt and winnt\security
folders to make sure that administrators and system have full control or
another possibility is that the local secedit.sdb is corrupt and the link
below may help with that. --- Steve

http://www.jsiinc.com/SUBH/TIP3500/rh3561.htm