SCECLI 1202 Events with an error code 0x5

[Guest]

I am getting a 1202 error with an 0x5: Access denied. error code. When I look
in the "%SYSTEMROOT%\security\templates\policies" directory, it's empty. In
addtion I don't have the gpotool program.

My server hangs after getting this error.

Thanks,
Norm

 

[Jorge_de_Almeida_Pinto]

I am getting a 1202 error with an 0x5: Access denied. error
code. When I look
in the "%SYSTEMROOT%securitytemplatespolicies" directory,
it's empty. In
addtion I don't have the gpotool program.

My server hangs after getting this error.

Thanks,
Norm

Please provide more specific info about the event id

Is this on a member server or a DC?

Cheers,

 

[Guest]

The error has not ocurred in a few days. Should I post the whole event
message when it happenes?

The server is a standalone that is on the WEB. It is running IIS, SQL Server
and Coldfusion. What other information can I provide?

Thanks,

 

[Jorge_de_Almeida_Pinto]

The error has not ocurred in a few days. Should I post the
whole event
message when it happenes?

The server is a standalone that is on the WEB. It is running
IIS, SQL Server
and Coldfusion. What other information can I provide?

Thanks,



 > > I am getting a 1202 error with an 0x5: Access
denied. error
 > > code. When I look
 > > in the "%SYSTEMROOT%securitytemplatespolicies"
directory,
 > > it's empty. In
 > > addtion I don't have the gpotool program.
 > >
 > > My server hangs after getting this error.
 > >
 > > Thanks,
 > > Norm

Read the following to see if it provides a solution when it happens
again
"Troubleshooting SCECLI 1202 Events"
http://support.microsoft.com/?id=324383

Cheers,

 

[Guest]

Jorge,

Thanks for the sugesstion about reading "Troubleshooting SCECLI 1202 Events"
http://support.microsoft.com/?id=324383. As stated at in my first message., I
did follow this until step #$ which says to do the following: find /i
"service" %SYSTEMROOT%\security\templates\policies\gpt*.*". The problem is
that the policy directory was EMPTY. So I'm stuck and don't know what I
should do next.

Thanks,
Norm

 

[Jorge_de_Almeida_Pinto]

Jorge,

Thanks for the sugesstion about reading "Troubleshooting
SCECLI 1202 Events"
http://support.microsoft.com/?id=324383. As stated at in my
first message., I
did follow this until step #$ which says to do the following:
find /i
"service" %SYSTEMROOT%securitytemplatespoliciesgpt*.*".
The problem is
that the policy directory was EMPTY. So I'm stuck and don't
know what I
should do next.

Thanks,
Norm



 > > The error has not ocurred in a few days. Should I
post the
 > > whole event
 > > message when it happenes?
 > >
 > > The server is a standalone that is on the WEB. It
is running
 > > IIS, SQL Server
 > > and Coldfusion. What other information can I
provide?
 > >
 > > Thanks,
 > >
 > >
 > > "Jorge_de_Almeida_Pinto" wrote:
 > >
  > > > "norm34" wrote:
  > > > > I am getting a 1202 error with an 0x5:
Access
 > > denied. error
  > > > > code. When I look
  > > > > in the
"%SYSTEMROOT%securitytemplatespolicies"
 > > directory,
  > > > > it's empty. In
  > > > > addtion I don't have the gpotool
program.
  > > > >
  > > > > My server hangs after getting this
error.
  > > > >
  > > > > Thanks,
  > > > > Norm
  > > >
  > > > Please provide more specific info about the
event id
  > > >
  > > > Is this on a member server or a DC?
  > > >
  > > > Cheers,
  > > >
  > > > --
  > > > Posted using the
http://www.windowsforumz.com interface, at author's request
  > > > Articles individually checked for
conformance to usenet
 > > standards
  > > > Topic URL:
http://www.windowsforumz.com/Security-SCECLI-1202-Events-error-code-0x5-ftopict548262.html
  > > > Visit Topic URL to contact author (reg.
req'd). Report abuse:
http://www.windowsforumz.com/eform.php?p=1736756
  > > >

Hi,

If I’m correct that’s the location for the GPOs configured in the
domain

Try the following to see if the POLICIES folder returns with its
contens:

you did not tell me if it was W2K or W2K3, so choose the correct one
below

FOR W2K:
SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE
SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE

FOR W2K3:
GPUPDATE /FORCE

Cheers,

 

[Guest]

Jorge,

It's on win2000 machine.

Here is the message I get when I reun these
D:\>SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE
Group policy propagation from the domain has been initiated for this
computer. It may take a few minutes for the propagation to complete and the
new policy to take effect. Please check Application Log for errors, if any.

D:\>SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE
Group policy propagation from the domain has been initiated for this
computer. It may take a few minutes for the propagation to complete and the
new policy to take effect. Please check Application Log for errors, if any.

In the appliction log it said "Security policy in the Group policy objects
are applied successfully."

Anything I should do next?

Thanks for your help,
Norm

 

[Guest]

Jorge,

My server locked up again. I think it was the same problem. I have saved the
application and system logs. Would you take look at them? If so, what format
evt, txt or csv?

Thanks,
Norm

 

[Jorge_de_Almeida_Pinto]

Jorge,

It's on win2000 machine.

Here is the message I get when I reun these
D:>SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE
Group policy propagation from the domain has been initiated
for this
computer. It may take a few minutes for the propagation to
complete and the
new policy to take effect. Please check Application Log for
errors, if any.

D:>SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE
Group policy propagation from the domain has been initiated
for this
computer. It may take a few minutes for the propagation to
complete and the
new policy to take effect. Please check Application Log for
errors, if any.

In the appliction log it said "Security policy in the Group
policy objects
are applied successfully."

Anything I should do next?

Thanks for your help,
Norm





 > > Jorge,
 > >
 > > Thanks for the sugesstion about reading
"Troubleshooting
 > > SCECLI 1202 Events"
 > > http://support.microsoft.com/?id=324383. As stated
at in my
 > > first message., I
 > > did follow this until step #$ which says to do the
following:
 > > find /i
 > > "service"
%SYSTEMROOT%securitytemplatespoliciesgpt*.*".
 > > The problem is
 > > that the policy directory was EMPTY. So I'm stuck
and don't
 > > know what I
 > > should do next.
 > >
 > > Thanks,
 > > Norm
 > >
 > >
 > > "Jorge_de_Almeida_Pinto" wrote:
 > >
  > > > "norm34" wrote:
  > > > > The error has not ocurred in a few
days. Should I
 > > post the
  > > > > whole event
  > > > > message when it happenes?
  > > > >
  > > > > The server is a standalone that is on
the WEB. It
 > > is running
  > > > > IIS, SQL Server
  > > > > and Coldfusion. What other information
can I
 > > provide?
  > > > >
  > > > > Thanks,
  > > > >
  > > > >
  > > > > "Jorge_de_Almeida_Pinto" wrote:
  > > > >
  > > > > > "norm34" wrote:
  > > > > > > I am getting a 1202 error with
an 0x5:
 > > Access
  > > > > denied. error
  > > > > > > code. When I look
  > > > > > > in the
 > > "%SYSTEMROOT%securitytemplatespolicies"
  > > > > directory,
  > > > > > > it's empty. In
  > > > > > > addtion I don't have the gpotool
 > > program.
  > > > > > >
  > > > > > > My server hangs after getting
this
 > > error.
  > > > > > >
  > > > > > > Thanks,
  > > > > > > Norm
  > > > > >
  > > > > > Please provide more specific info
about the
 > > event id
  > > > > >
  > > > > > Is this on a member server or a DC?
  > > > > >
  > > > > > Cheers,
  > > > > >
  > > > > > --
  > > > > > Posted using the
 > > http://www.windowsforumz.com interface, at author's
request
  > > > > > Articles individually checked for
 > > conformance to usenet
  > > > > standards
  > > > > > Topic URL:
 > >
http://www.windowsforumz.com/Security-SCECLI-1202-Events-error-code-0x5-ftopict548262.html
  > > > > > Visit Topic URL to contact author
(reg.
 > > req'd). Report abuse:
 > > http://www.windowsforumz.com/eform.php?p=1736756
  > > > > >
  > > >
  > > > Read the following to see if it provides a
solution when it
 > > happens
  > > > again
  > > > "Troubleshooting SCECLI 1202 Events"
  > > > http://support.microsoft.com/?id=324383
  > > >
  > > > Cheers,
  > > >

Is the policies folder still empty and/or do you still get the error?

If you still receive errors please post them exactly as shown

Cheers,

 

[Guest]

Policy directory is still empty.

This time there was not a SCECLI error, but this error which I think caused
the machine to hang:

The security package Negotiate generated an exception. The package is now
disabled. The exception information is the data.

0000: 05 00 00 c0 00 00 00 00 ...À....
0008: 00 00 00 00 63 c6 fc 77 ....cÆüw
0010: 02 00 00 00 01 00 00 00 ........
0018: 90 90 90 90 3f 00 01 00 ÂÂÂÂ?...
0020: 00 00 00 00 00 00 00 00 ........
0028: 00 00 00 00 00 00 00 00 ........
0030: 00 00 00 00 00 00 00 00 ........
0038: 7f 02 ff ff 00 00 ff ff .ÿÿ..ÿÿ
0040: ff ff ff ff 00 00 00 00 ÿÿÿÿ....
0048: 00 00 00 00 00 00 00 00 ........

 

[Jorge_de_Almeida_Pinto]

Jorge,

Thanks for the sugesstion about reading "Troubleshooting
SCECLI 1202 Events"
http://support.microsoft.com/?id=324383. As stated at in my
first message., I
did follow this until step #$ which says to do the following:
find /i
"service" %SYSTEMROOT%securitytemplatespoliciesgpt*.*".
The problem is
that the policy directory was EMPTY. So I'm stuck and don't
know what I
should do next.

Thanks,
Norm



 > > The error has not ocurred in a few days. Should I
post the
 > > whole event
 > > message when it happenes?
 > >
 > > The server is a standalone that is on the WEB. It
is running
 > > IIS, SQL Server
 > > and Coldfusion. What other information can I
provide?
 > >
 > > Thanks,
 > >
 > >
 > > "Jorge_de_Almeida_Pinto" wrote:
 > >
  > > > "norm34" wrote:
  > > > > I am getting a 1202 error with an 0x5:
Access
 > > denied. error
  > > > > code. When I look
  > > > > in the
"%SYSTEMROOT%securitytemplatespolicies"
 > > directory,
  > > > > it's empty. In
  > > > > addtion I don't have the gpotool
program.
  > > > >
  > > > > My server hangs after getting this
error.
  > > > >
  > > > > Thanks,
  > > > > Norm
  > > >
  > > > Please provide more specific info about the
event id
  > > >
  > > > Is this on a member server or a DC?
  > > >
  > > > Cheers,
  > > >
  > > > --
  > > > Posted using the
http://www.windowsforumz.com interface, at author's request
  > > > Articles individually checked for
conformance to usenet
 > > standards
  > > > Topic URL:
http://www.windowsforumz.com/Security-SCECLI-1202-Events-error-code-0x5-ftopict548262.html
  > > > Visit Topic URL to contact author (reg.
req'd). Report abuse:
http://www.windowsforumz.com/eform.php?p=1736756
  > > >

OK... it’s time to turn on "Diagnostic Logging" for GPO
processing...

Beware that when you switch on verbose logging modes with these
values, your Event Viewer logs will fill up quickly. You’ll need to
review the settings for the Event Viewer logs to ensure that
everything you need is being logged and that you don’t lose or
overwrite any part of the logs you may need to keep for reference,
security, and/or legal reasons.

Before turning on "Diagnostic Logging" make a copy of all event logs
for that machine

He is the configuration you need to make (you might need to reboot the
server):

RunDiagnosticLoggingGroupPolicy will turn GPO event logging to
verbose.

Hive: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
Name: RunDiagnosticLoggingGroupPolicy
Type: REG_DWORD
Value: 1
Note: After you make that change and restart the system, you will see
a lot more information reported, especially during errors. In many
cases, this will be enough to get the information you need.

Cheers,

 

[Jorge_de_Almeida_Pinto]

Policy directory is still empty.

This time there was not a SCECLI error, but this error which I
think caused
the machine to hang:

The security package Negotiate generated an exception. The
package is now
disabled. The exception information is the data.

0000: 05 00 00 c0 00 00 00 00 ...À....
0008: 00 00 00 00 63 c6 fc 77 ....cÆüw
0010: 02 00 00 00 01 00 00 00 ........
0018: 90 90 90 90 3f 00 01 00 ÂÂÂÂ?...
0020: 00 00 00 00 00 00 00 00 ........
0028: 00 00 00 00 00 00 00 00 ........
0030: 00 00 00 00 00 00 00 00 ........
0038: 7f 02 ff ff 00 00 ff ff .ÿÿ..ÿÿ
0040: ff ff ff ff 00 00 00 00 ÿÿÿÿ....
0048: 00 00 00 00 00 00 00 00 ........





 > > Jorge,
 > >
 > > It's on win2000 machine.
 > >
 > > Here is the message I get when I reun these
 > > D:>SECEDIT /REFRESHPOLICY MACHINE_POLICY
/ENFORCE
 > > Group policy propagation from the domain has been
initiated
 > > for this
 > > computer. It may take a few minutes for the
propagation to
 > > complete and the
 > > new policy to take effect. Please check Application
Log for
 > > errors, if any.
 > >
 > > D:>SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE
 > > Group policy propagation from the domain has been
initiated
 > > for this
 > > computer. It may take a few minutes for the
propagation to
 > > complete and the
 > > new policy to take effect. Please check Application
Log for
 > > errors, if any.
 > >
 > > In the appliction log it said "Security policy in
the Group
 > > policy objects
 > > are applied successfully."
 > >
 > > Anything I should do next?
 > >
 > > Thanks for your help,
 > > Norm
 > >
 > >
 > >
 > >
 > > "Jorge_de_Almeida_Pinto" wrote:
 > >
  > > > "norm34" wrote:
  > > > > Jorge,
  > > > >
  > > > > Thanks for the sugesstion about reading
 > > "Troubleshooting
  > > > > SCECLI 1202 Events"
  > > > >
http://support.microsoft.com/?id=324383. As stated
 > > at in my
  > > > > first message., I
  > > > > did follow this until step #$ which
says to do the
 > > following:
  > > > > find /i
  > > > > "service"
 > > %SYSTEMROOT%securitytemplatespoliciesgpt*.*".
  > > > > The problem is
  > > > > that the policy directory was EMPTY. So
I'm stuck
 > > and don't
  > > > > know what I
  > > > > should do next.
  > > > >
  > > > > Thanks,
  > > > > Norm
  > > > >
  > > > >
  > > > > "Jorge_de_Almeida_Pinto" wrote:
  > > > >
  > > > > > "norm34" wrote:
  > > > > > > The error has not ocurred in a
few
 > > days. Should I
  > > > > post the
  > > > > > > whole event
  > > > > > > message when it happenes?
  > > > > > >
  > > > > > > The server is a standalone that
is on
 > > the WEB. It
  > > > > is running
  > > > > > > IIS, SQL Server
  > > > > > > and Coldfusion. What other
information
 > > can I
  > > > > provide?
  > > > > > >
  > > > > > > Thanks,
  > > > > > >
  > > > > > >
  > > > > > > "Jorge_de_Almeida_Pinto" wrote:
  > > > > > >
  > > > > > > > "norm34" wrote:
  > > > > > > > > I am getting a 1202 error
with
 > > an 0x5:
  > > > > Access
  > > > > > > denied. error
  > > > > > > > > code. When I look
  > > > > > > > > in the
  > > > > "%SYSTEMROOT%securitytemplatespolicies"
  > > > > > > directory,
  > > > > > > > > it's empty. In
  > > > > > > > > addtion I don't have the
gpotool
  > > > > program.
  > > > > > > > >
  > > > > > > > > My server hangs after
getting
 > > this
  > > > > error.
  > > > > > > > >
  > > > > > > > > Thanks,
  > > > > > > > > Norm
  > > > > > > >
  > > > > > > > Please provide more specific
info
 > > about the
  > > > > event id
  > > > > > > >
  > > > > > > > Is this on a member server or
a DC?
  > > > > > > >
  > > > > > > > Cheers,
  > > > > > > >
  > > > > > > > --
  > > > > > > > Posted using the
  > > > > http://www.windowsforumz.com interface,
at author's
 > > request
  > > > > > > > Articles individually checked
for
  > > > > conformance to usenet
  > > > > > > standards
  > > > > > > > Topic URL:
  > > > >
 > >
http://www.windowsforumz.com/Security-SCECLI-1202-Events-error-code-0x5-ftopict548262.html
  > > > > > > > Visit Topic URL to contact
author
 > > (reg.
  > > > > req'd). Report abuse:
  > > > >
http://www.windowsforumz.com/eform.php?p=1736756
  > > > > > > >
  > > > > >
  > > > > > Read the following to see if it
provides a
 > > solution when it
  > > > > happens
  > > > > > again
  > > > > > "Troubleshooting SCECLI 1202 Events"
  > > > > >
http://support.microsoft.com/?id=324383
  > > > > >
  > > > > > Cheers,
  > > > > >
  > > >
  > > > Hi,
  > > >
  > > > If I’m correct that’s the
location for the GPOs
 > > configured in the
  > > > domain
  > > >
  > > > Try the following to see if the POLICIES
folder returns with
 > > its
  > > > contens:
  > > >
  > > > you did not tell me if it was W2K or W2K3,
so choose the
 > > correct one
  > > > below
  > > >
  > > > FOR W2K:
  > > > SECEDIT /REFRESHPOLICY MACHINE_POLICY
/ENFORCE
  > > > SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE
  > > >
  > > > FOR W2K3:
  > > > GPUPDATE /FORCE
  > > >
  > > > Cheers,
  > > >

what is the event id?

search for tips using the event id and source at
http://www.eventid.net

have at look at these..
http://support.microsoft.com/?kbid=328948
http://support.microsoft.com/?kbid=841037

Cheers,

 

[Guest]

Jorge,

I have turned the debugging option. I have saved the Application and System
logs. Another weird thing that happenes after I get this error, when I try to
shut down the system, it says I don't the security(I think that was the word)
to shut down the system. So, it appears that after a while something in the
security system gets out of wack.

Any ideas what I should look for in the log files?

Thanks,

 

[Jorge_de_Almeida_Pinto]

Jorge,

I have turned the debugging option. I have saved the
Application and System
logs. Another weird thing that happenes after I get this
error, when I try to
shut down the system, it says I don't the security(I think
that was the word)
to shut down the system. So, it appears that after a while
something in the
security system gets out of wack.

Any ideas what I should look for in the log files?

Thanks,

With diagnostic logging enabled you should get more information that
could show what is going on.
Compare the errors logged to event id information (of google for it)
at eventid.net to see what possible solution is available.

Cheers,