Event 1202 every 5 minutes after removing IIS from a DC

[Corbin O'Reilly]

Hi. A predecessor of mine had IIS setup on a Windows 2000 Domain Controller.
I know that is not recommended. We uninstalled IIS and now we get an Event
1202 every 5 minutes in the Application Log on the domain controller. Here
is the error message:

Security policies are propagated with warning. 0x4b8 : An extended error has
occurred.

For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "Troubleshooting Event
1202s".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Could someone please help me correct this problem? My theory is that a
domain account that no longer exists is being referenced in Group Policy.
Thanks for the help.

 

[Glenn L]

You should first turn up winlogon logging and reproduce the failure.
Location of the log file - %windir%\security\logs

Registry Location -
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\WinLogon\GPExtensions\
{827D319E-6EAC-11D2-A4EA-00C04F79F83A

Registry Setting - Add the REG_DWORD value "ExtensionDebugLevel"
and set it to 0x2

This log contains additional info that may shed more light on the useless
1202s.

 

[Hank Arnold]

http://eventid.net/display.asp?eventid=1202&eventno=348&source=SceCli&phase=1

 

[Corbin O'Reilly]

Thanks guys. It looks like the problem is fixed. An IWAM account that no
longer exists was referenced in the Domain Controller Policy. I removed the
reference and the Event 1202 alerts stopped.