Group Policy not loading due to GetMachineToken (ApplySecurityContext) failure

[Daniel J. Reynolds]

I posted this message in the Group Policy group several days ago
and have not received a response and thought it may be more of a
security issue. Any help with either problem would be appreciated.

Thanks,
Dan Reynolds

--------------------------------------------------------------------------------------------------------
I have a situation where Group Policy is not loading on 2 member
servers.

1) W2K native network (all SP4).
2) 1 domain controller, 2 workstations, several member servers.
3) The GPO in question is the Default Domain Policy.
4) GPO is filtered by a Servers Group (4 Members).
5) GPO is also filtered by a Workstations Group (2 members).
6) GPO loads on both workstaions and 2 of the 4 servers.
7) GPO does not load on the other two servers.
8) Logon account is the same for all (a member of Domain Admins).
9) \\MyDommain.com\\Sysvol is available in MyNetwork.
10) I can navigate to and open machine\registry.pol with Notepad.

Two different errors are being reported one for each
of the servers that is not loading Group policy.

First member server
===============
Event Log
----------------
Source: Userenv
Event ID:1000

Windows cannot query for the list of Group Policy objects .
A message that describes the reason for this was previously
logged by this policy engine.

Userenv.log
-------------------

USERENV(fc.274) GetMachineToken: AcceptSecurityContext failed with
0x8009030c
USERENV(fc.274) GetGPOInfo: Failed to get the machine token with
-2146893044
USERENV(fc.274) ProcessGPOs: GetGPOInfo failed.

Second Member Server
===================
Event Log
----------------
Source: Userenv
Eventy ID: 1000

Windows cannot access the registry information at
\\MyDomain.com\sysvol\MyDomain.com\Policies\
{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\registry.pol with (53).

Userenv.log
-------------------

USERENV(100.2b8) ParseRegistryFile: CreateFile failed with 53
USERENV(100.2b8) ProcessGPORegistryPolicy: ParseRegistryFile failed.
USERENV(100.2b8) ProcessGPOList: ProcessGPORegistryPolicy failed.
USERENV(100.2b8) ProcessGPOs: Extension Registry ProcessGroupPolicy
failed, status 0x80004005.

 

[IBTerry [MSFT]]

Hello Daniel,

Do you only get the error when the machine starts up? Does GP apply w/ out
error if you manually refresh the policy w/
secedit /refreshpolicy machine_policy /enforce? Has this always been a
problem on these servers? What SP are these machines at?

I have seen some instances of this error occuring due to the following reg
key being in place.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Key: CrashOnAuditFail
Type: REG_DWORD

from "2" (enabled) to "0" disabled. It was, among other things, preventing
security and group policy processing.

Thank you,

IBTerry [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.