GPO fails to process

[Guest]

We have a 2000 Native domain. All computers, both workstations and servers, have event log errors relating to failed group policy processing. Specifically, 1053 userenv errors on the xp workstations and 1000 userenv on the servers. Error indicates that the user cannot be found...specifically, the computer configuration section fails and the computer name can't be found. I have been through all articles relating to dns, network connectivity, etc...our domain runs as smooth as it ever has on a day-to-day operating basis. I can provide userenv logs as well as gpresult data for anyone who would be willing to assist me. Thank you in advance for your help.

 

[Matjaz Ladava [MVP]]

Please do post your detailed events errors and we'll be glad to look into
your problem.

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Guest]

Event viewer errors are as follows

xp workstations

source: useren
event id: 105

Windows cannot determine the user or computer name. (The specified user does not exist. ). Group Policy processing aborted.

servers

source: useren
event id: 100

Windows cannot determine the user or computer name. Return value (1317)

One additional point of note...I have a lab environment that is a scaled down replica of our production domain. All group policy objects seem to work fine in the lab. Have also migrated lab to 2K3 and gpo's still seem to work. Please advise on sending userenv logs and gpresult logs, as I don't want to cut and paste into a post for size reasons. Thank you for taking time to reply

 

[Matjaz Ladava [MVP]]

Hmm. Error 1317 means The specified user does not exist
I would start examining my DNS configuration as this could be a DNS issue.
Are all your servers/clients pointing to the internal DNS server ? Can you
verify nameresolution using nslookup ?


--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Guest]

Have checked this and all looks fine. As far as our domain operation on a daily basis, we have no issues with user auth, dns resolution, resource access, etc..

I did run across a very short eventid.net post regarding 1317...it said that it can be caused by running dcpromo on a server that the local admin does not have full control ntfs permissions...but provides no explanation for the statement. Unless I have a dns issue that the normal troubleshooting techniques don't uncover, dns looks to be fine.

 

[Matjaz Ladava [MVP]]

Hmmm. Failed to impersonate user with 5 means Access Denied. This could be
due to some issues with permissions on your objects in AD.
Please enable User enviroment logging on your workstation
(http://support.microsoft.com/default.aspx?scid=kb;EN-US;221833) to get some
more results

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Matjaz Ladava [MVP]]

Normaly there is a part in userenv with (xxx,yyyy) where xxx is procesid and
yyyy is thread id. This could lead somewhere.....

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Guest]

Not exactly sure what you mean by that...here is the entire computer gpo processing section from my userenv log (since that section is the one that fails)..

USERENV(244.3ec) 10:03:04:677 ProcessGPOs: Starting computer Group Policy (Async forground) processing..
USERENV(244.3ec) 10:03:04:677 ProcessGPOs
USERENV(244.3ec) 10:03:04:677 ProcessGPOs
USERENV(244.3ec) 10:03:04:677 EnterCriticalPolicySection: Machine critical section has been claimed. Handle = 0x71
USERENV(244.3ec) 10:03:04:677 ProcessGPOs: Machine role is 2
USERENV(598.5a4) 10:03:04:738 LibMain: Process Name: C:\WINDOWS\System32\inetsrv\inetinfo.ex
USERENV(244.248) 10:03:04:848 Profile Ref Count is
USERENV(244.248) 10:03:04:848 LoadUserProfile: Leaving critical Section
USERENV(244.248) 10:03:04:848 CSyncManager::LeaveLock <S-1-5-21-1757981266-343818398-682003330-1129
USERENV(244.248) 10:03:04:848 CSyncManager::LeaveLock: Lock release
USERENV(244.248) 10:03:04:848 CHashTable::HashDelete: S-1-5-21-1757981266-343818398-682003330-1129 delete
USERENV(244.248) 10:03:04:848 CSyncManager::LeaveLock: Lock delete
USERENV(244.248) 10:03:04:848 LoadUserProfile: Impersonated user: 00000738, 0000000
USERENV(244.3ec) 10:03:04:838 PingComputer: Adapter speed 100000000 bp
USERENV(244.3ec) 10:03:04:848 PingComputer: First time:
USERENV(244.3ec) 10:03:04:848 PingComputer: Fast link. Exiting
USERENV(27c.2d4) 10:03:04:848 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.2d4) 10:03:04:848 GetUserNameAndDomain Failed to impersonate use
USERENV(27c.2d4) 10:03:04:858 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.2d4) 10:03:04:858 GetUserDNSDomainName: Failed to impersonate use
USERENV(27c.2d4) 10:03:04:858 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.2d4) 10:03:04:858 GetUserNameAndDomain Failed to impersonate use
USERENV(27c.2d4) 10:03:04:858 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.2d4) 10:03:04:858 GetUserDNSDomainName: Failed to impersonate use
USERENV(27c.2d4) 10:03:04:898 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.2d4) 10:03:04:898 GetUserNameAndDomain Failed to impersonate use
USERENV(27c.2d4) 10:03:04:898 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.2d4) 10:03:04:898 GetUserDNSDomainName: Failed to impersonate use
USERENV(244.248) 10:03:04:908 LoadUserProfile: Reverted to user: 0000000
USERENV(244.248) 10:03:04:908 LoadUserProfile: Leaving with a value of 1
USERENV(244.248) 10:03:04:908 ========================================================
USERENV(244.248) 10:03:04:908 LoadUserProfile: LoadUserProfileP succeede
USERENV(244.248) 10:03:04:908 LoadUserProfile: Returning success. Final Information follows
USERENV(244.248) 10:03:04:908 lpProfileInfo->UserName = <jeff
USERENV(244.248) 10:03:04:908 lpProfileInfo->lpProfilePath = <
USERENV(244.248) 10:03:04:908 lpProfileInfo->dwFlags = 0x
USERENV(244.248) 10:03:04:908 LoadUserProfile: Returning TRUE. hProfile = <0x77c
USERENV(244.248) 10:03:05:008 IsSyncForegroundPolicyRefresh: Asynchronous, Reason: NoNeedForSyn
USERENV(244.60c) 10:03:05:018 IsSyncForegroundPolicyRefresh: Asynchronous, Reason: NoNeedForSyn
USERENV(244.248) 10:03:05:719 IsSyncForegroundPolicyRefresh: Asynchronous, Reason: NoNeedForSyn
USERENV(4d4.678) 10:03:05:899 LibMain: Process Name: C:\WINDOWS\system32\spoolsv.ex
USERENV(69c.6cc) 10:03:06:270 LibMain: Process Name: C:\WINDOWS\Explorer.EX
USERENV(27c.290) 10:03:06:921 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.290) 10:03:06:921 GetUserNameAndDomain Failed to impersonate use
USERENV(27c.290) 10:03:06:931 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.290) 10:03:06:931 GetUserDNSDomainName: Failed to impersonate use
USERENV(27c.290) 10:03:06:931 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.290) 10:03:06:931 GetUserNameAndDomain Failed to impersonate use
USERENV(27c.290) 10:03:06:931 ImpersonateUser: Failed to impersonate user with 5
USERENV(27c.290) 10:03:06:931 GetUserDNSDomainName: Failed to impersonate use
USERENV(27c.290) 10:03:06:971 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:06:971 GetUserNameAndDomain Failed to impersonate user
USERENV(27c.290) 10:03:06:971 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:06:971 GetUserDNSDomainName: Failed to impersonate user
USERENV(27c.290) 10:03:07:011 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:011 GetUserNameAndDomain Failed to impersonate user
USERENV(27c.290) 10:03:07:011 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:011 GetUserDNSDomainName: Failed to impersonate user
USERENV(27c.290) 10:03:07:051 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:051 GetUserNameAndDomain Failed to impersonate user
USERENV(27c.290) 10:03:07:051 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:051 GetUserDNSDomainName: Failed to impersonate user
USERENV(27c.290) 10:03:07:091 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:091 GetUserNameAndDomain Failed to impersonate user
USERENV(27c.290) 10:03:07:091 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:091 GetUserDNSDomainName: Failed to impersonate user
USERENV(27c.290) 10:03:07:131 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:131 GetUserNameAndDomain Failed to impersonate user
USERENV(27c.290) 10:03:07:131 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:131 GetUserDNSDomainName: Failed to impersonate user
USERENV(27c.290) 10:03:07:171 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:171 GetUserNameAndDomain Failed to impersonate user
USERENV(27c.290) 10:03:07:171 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:171 GetUserDNSDomainName: Failed to impersonate user
USERENV(27c.290) 10:03:07:211 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:211 GetUserNameAndDomain Failed to impersonate user
USERENV(27c.290) 10:03:07:211 ImpersonateUser: Failed to impersonate user with 5.
USERENV(27c.290) 10:03:07:211 GetUserDNSDomainName: Failed to impersonate user
USERENV(69c.6cc) 10:03:08:112 GetProfileType: Profile already loaded.
USERENV(69c.6cc) 10:03:08:112 GetProfileType: ProfileFlags is 0
USERENV(69c.6cc) 10:03:08:213 GetProfileType: Profile already loaded.
USERENV(69c.6cc) 10:03:08:223 GetProfileType: ProfileFlags is 0
USERENV(7fc.10c) 10:03:14:692 LibMain: Process Name: C:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe
USERENV(670.6e8) 10:03:17:145 LibMain: Process Name: C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
USERENV(410.374) 10:03:17:416 LibMain: Process Name: C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
USERENV(82c.830) 10:03:19:509 LibMain: Process Name: C:\PROGRA~1\MI6841~1\MSSQL\binn\sqlagent.exe
USERENV(244.3ec) 10:03:23:454 ProcessGPOs: network name is 10.10.10.0
USERENV(244.3ec) 10:03:23:485 MyGetUserName: GetUserNameEx failed with 1317.
USERENV(244.3ec) 10:03:23:495 MyGetUserName: Retrying call to GetUserNameEx in 1/2 second.
USERENV(244.3ec) 10:03:24:005 MyGetUserName: GetUserNameEx failed with 1317.
USERENV(244.3ec) 10:03:24:005 MyGetUserName: Retrying call to GetUserNameEx in 1/2 second.
USERENV(244.3ec) 10:03:24:516 MyGetUserName: GetUserNameEx failed with 1317.
USERENV(244.3ec) 10:03:24:516 MyGetUserName: Retrying call to GetUserNameEx in 1/2 second.
USERENV(244.3ec) 10:03:25:037 MyGetUserName: GetUserNameEx failed with 1317.
USERENV(244.3ec) 10:03:25:037 ProcessGPOs: MyGetUserName failed with 1317.
USERENV(244.3ec) 10:03:25:047 ProcessGPOs: No WMI logging done in this policy cycle.
USERENV(244.3ec) 10:03:25:047 ProcessGPOs: Processing failed with error 1317.
USERENV(244.3ec) 10:03:25:057 LeaveCriticalPolicySection: Critical section 0x718 has been released.
USERENV(244.3ec) 10:03:25:057 ProcessGPOs: Computer Group Policy has been applied.
USERENV(244.3ec) 10:03:25:067 ProcessGPOs: Leaving with 0.
USERENV(244.3ec) 10:03:25:077 ApplyGroupPolicy: Leaving successfully.
USERENV(244.60c) 10:03:25:087 ApplyGroupPolicy: Entering. Flags = e
USERENV(244.60c) 10:03:25:097 ProcessGPOs:

 

[Matjaz Ladava [MVP]]

Jeff,

Can you turn on full usereventlogging
(http://support.microsoft.com/default.aspx?scid=kb;EN-US;221833) to 10002
and send me a full userenv.log

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Matjaz Ladava [MVP]]

please send it via email

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Guest]

Jeff and Matjaz

I was reading your posts because I am also having the same kind of problems. Have you found a solution? If you have, please advise. Thanks in advance.

Sean

 

[Matjaz Ladava [MVP]]

Not yet Sean. I'll try to get an update on this one as soon as possible.

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Guest]

Hey Sean. Sorry for the extremely late reply to your post. Matjaz and I worked on this out of the group for awhile. The latest is no solution yet. I am working with a contact of Matjaz's from MSFT, but he is very busy so I will be on his time table. If nothing comes up, I am probably headed to PSS. I would like to stay in touch with you to see if you make any headway on your end, maybe even compare some configs, etc...and obviously keep you posted if I do find anything out. Feel free to email me with anything you have. Thx...