Event IDs 1000 and 1202

[Michael]

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 1/12/2004
Time: 03:47:10 PM
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
The Group Policy client-side extension Security was
passed flags (17) and returned a failure status code of
(1208).

Event Type: Warning
Event Source: SceCli
Event Category: None
Event ID: 1202
Date: 1/12/2004
Time: 03:47:10 PM
User: N/A
Computer: SERVER
Description:
Security policies are propagated with warning. 0x4b8 : An
extended error has occurred.
Please look for more details in TroubleShooting section
in Security Help.


Started getting these events after client was
hacked....found and removed hack which was boot.exe and
boot.rar files in root of C: on exchange server...did
directory server restore and used veritas to restore AD
and C:\winnt folder ....all is well except getting these
2 errors now.....no other remnants of any hacks on
servers. Any help is greatly appreciated...

 

[David Brandt [MSFT]]

Normally this is due to an account still belonging to a "right" that no
longer exists, and is usually not a problem but more of a nusience since it
fills the logs up with those events every 5 minutes when policies are
refreshed.
Use 324383 to create the winlogon file, and then search in it for "1208".
That should get you to a section where it indicates that it was unable to
resolve xyz account/group.
You then need to go into your Domain Controller policy under computer
configuration/windows settings/security settings/local policies/user rights
assignments and delete whatever account/s were listed in the winlogon log as
being the problem.
You can then run secedit again to refresh, and if all is well, you should
see blue 1704 events about policies being successfully applied instead of
the 1000/1202's.

324383 Troubleshooting SCECLI 1202 Events
http://support.microsoft.com/?id=324383

This is also a possible cause, but not very common;
260715 Event ID 1000 and 1202 After Configuring Policies
http://support.microsoft.com/?id=260715

--
David Brandt
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.
Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only.