Win2k Server Application Event Log keeps filling up with.....

Win2k Server Application Event Log keeps filling up with.....

Post by MEANI » Sun, 23 Apr 2000 04:00:00



I am running win2k server as a PDC with MS Proxy2. I upgraded from WinNT
4.0/SP5.
My win2k PDC's Application Event log is filling up with errors about SceCli
and Userenv.

Here is what the actual Event Log Errors are:

Event Type:                Error

Event Source:                SceCli

Event Category:                None

Event ID:                1001

Date:                       4/20/2000

Time:                      9:09:10 PM

User:                       N/A

Computer:                CN676461-A

Description:

Security policy cannot be propagated. Cannot access the template. Error code
= 3.

\\BUDDYMAX.COM\sysvol\BUDDYMAX.COM\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf

AND

Event Type:                Error

Event Source:                Userenv

Event Category:                None

Event ID:                1000

Date:                       4/20/2000

Time:                      9:09:10 PM

User:                       NT AUTHORITY\SYSTEM

Computer:                CN676461-A

Description:

The Group Policy client-side extension Security was passed flags (17) and
returned a failure status code of (3).

These show up in pairs at the exactly same time.  I have done what TechNet
said do and I still have this problem.

Any help appreciated

MEANIE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by Thomas Le » Sun, 23 Apr 2000 04:00:00




Quote:>I am running win2k server as a PDC with MS Proxy2.

Probably not a good idea, in general.

Quote:> I upgraded from WinNT
>4.0/SP5.
>My win2k PDC's Application Event log is filling up with errors about SceCli
>and Userenv.

>Here is what the actual Event Log Errors are:

>Event Type:                Error

>Event Source:                SceCli

>Event Category:                None

>Event ID:                1001

>Date:                       4/20/2000

>Time:                      9:09:10 PM

>User:                       N/A

>Computer:                CN676461-A

>Description:

>Security policy cannot be propagated. Cannot access the template. Error code
>= 3.

>\\BUDDYMAX.COM\sysvol\BUDDYMAX.COM\Policies\{31B2F340-016D-11D2-945F-00C04FB
>984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf

The machine that this error event is reported on cannot get to the
sysvol share on the DC.

- Show quoted text -

Quote:>Event Type:                Error

>Event Source:                Userenv

>Event Category:                None

>Event ID:                1000

>Date:                       4/20/2000

>Time:                      9:09:10 PM

>User:                       NT AUTHORITY\SYSTEM

>Computer:                CN676461-A

>Description:

>The Group Policy client-side extension Security was passed flags (17) and
>returned a failure status code of (3).

Related to the first one.

Quote:>These show up in pairs at the exactly same time.  I have done what TechNet
>said do and I still have this problem.

Try turning proxy off and see of the problem goes away.  

Thomas

--

Microsoft Backoffice MVP

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by Brad Morg » Sun, 23 Apr 2000 04:00:00


Did you look at Q247482? If not, try that and look at the log file
(winlogon.log). It isn't exactly the same error, but the log file may
give a clue.





>>I am running win2k server as a PDC with MS Proxy2.

>Probably not a good idea, in general.

>> I upgraded from WinNT
>>4.0/SP5.

>>My win2k PDC's Application Event log is filling up with errors about SceCli
>>and Userenv.

>>Here is what the actual Event Log Errors are:

>>Event Type:                Error

>>Event Source:                SceCli

>>Event Category:                None

>>Event ID:                1001

>>Date:                       4/20/2000

>>Time:                      9:09:10 PM

>>User:                       N/A

>>Computer:                CN676461-A

>>Description:

>>Security policy cannot be propagated. Cannot access the template. Error code
>>= 3.

>>\\BUDDYMAX.COM\sysvol\BUDDYMAX.COM\Policies\{31B2F340-016D-11D2-945F-00C04FB
>>984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf

>The machine that this error event is reported on cannot get to the
>sysvol share on the DC.

>>Event Type:                Error

>>Event Source:                Userenv

>>Event Category:                None

>>Event ID:                1000

>>Date:                       4/20/2000

>>Time:                      9:09:10 PM

>>User:                       NT AUTHORITY\SYSTEM

>>Computer:                CN676461-A

>>Description:

>>The Group Policy client-side extension Security was passed flags (17) and
>>returned a failure status code of (3).

>Related to the first one.

>>These show up in pairs at the exactly same time.  I have done what TechNet
>>said do and I still have this problem.

>Try turning proxy off and see of the problem goes away.  

>Thomas

Brad J. Morgan, MCSE
 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by MEANI » Sun, 23 Apr 2000 04:00:00


My winlogon.log has only this entry:

Cannot access the template. Error code = 3.

\\BUDDYMAX.COM\sysvol\BUDDYMAX.COM\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.

What exactly does this mean?
MEANIE


> Did you look at Q247482? If not, try that and look at the log file
> (winlogon.log). It isn't exactly the same error, but the log file may
> give a clue.





> >>I am running win2k server as a PDC with MS Proxy2.

> >Probably not a good idea, in general.

> >> I upgraded from WinNT
> >>4.0/SP5.

> >>My win2k PDC's Application Event log is filling up with errors about
SceCli
> >>and Userenv.

> >>Here is what the actual Event Log Errors are:

> >>Event Type:                Error

> >>Event Source:                SceCli

> >>Event Category:                None

> >>Event ID:                1001

> >>Date:                       4/20/2000

> >>Time:                      9:09:10 PM

> >>User:                       N/A

> >>Computer:                CN676461-A

> >>Description:

> >>Security policy cannot be propagated. Cannot access the template. Error
code
> >>= 3.

>>\\BUDDYMAX.COM\sysvol\BUDDYMAX.COM\Policies\{31B2F340-016D-11D2-945F-00C04
FB
> >>984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf

> >The machine that this error event is reported on cannot get to the
> >sysvol share on the DC.

> >>Event Type:                Error

> >>Event Source:                Userenv

> >>Event Category:                None

> >>Event ID:                1000

> >>Date:                       4/20/2000

> >>Time:                      9:09:10 PM

> >>User:                       NT AUTHORITY\SYSTEM

> >>Computer:                CN676461-A

> >>Description:

> >>The Group Policy client-side extension Security was passed flags (17)
and
> >>returned a failure status code of (3).

> >Related to the first one.

> >>These show up in pairs at the exactly same time.  I have done what
TechNet
> >>said do and I still have this problem.

> >Try turning proxy off and see of the problem goes away.

> >Thomas

> Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by MEANI » Sun, 23 Apr 2000 04:00:00


Doesn't make a difference.
any other ideas?
MEANIE




> >I am running win2k server as a PDC with MS Proxy2.

> Probably not a good idea, in general.

> > I upgraded from WinNT
> >4.0/SP5.

> >My win2k PDC's Application Event log is filling up with errors about
SceCli
> >and Userenv.

> >Here is what the actual Event Log Errors are:

> >Event Type:                Error

> >Event Source:                SceCli

> >Event Category:                None

> >Event ID:                1001

> >Date:                       4/20/2000

> >Time:                      9:09:10 PM

> >User:                       N/A

> >Computer:                CN676461-A

> >Description:

> >Security policy cannot be propagated. Cannot access the template. Error
code
> >= 3.

>\\BUDDYMAX.COM\sysvol\BUDDYMAX.COM\Policies\{31B2F340-016D-11D2-945F-00C04F
B
> >984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf

> The machine that this error event is reported on cannot get to the
> sysvol share on the DC.

> >Event Type:                Error

> >Event Source:                Userenv

> >Event Category:                None

> >Event ID:                1000

> >Date:                       4/20/2000

> >Time:                      9:09:10 PM

> >User:                       NT AUTHORITY\SYSTEM

> >Computer:                CN676461-A

> >Description:

> >The Group Policy client-side extension Security was passed flags (17) and
> >returned a failure status code of (3).

> Related to the first one.

> >These show up in pairs at the exactly same time.  I have done what
TechNet
> >said do and I still have this problem.

> Try turning proxy off and see of the problem goes away.

> Thomas

> --

> Microsoft Backoffice MVP

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by Brad Morg » Sun, 23 Apr 2000 04:00:00



>Doesn't make a difference.
>any other ideas?
>MEANIE

Just curious....can you access the file GptTmpl.inf? Was proxy
installed before or after the machine became a PDC?

Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by Brad Morg » Sun, 23 Apr 2000 04:00:00


Check KB article Q257338



>>Doesn't make a difference.
>>any other ideas?
>>MEANIE

>Just curious....can you access the file GptTmpl.inf? Was proxy
>installed before or after the machine became a PDC?

>Brad J. Morgan, MCSE

Brad J. Morgan, MCSE
 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by MEANI » Sun, 23 Apr 2000 04:00:00


Well its interesting you asked...
    I am able to browse out to that file and even open it in notepad. This
box has always been my PDC even when it was NT 4.0 before the upgrade and
ran Proxy2 on it as well.  Before I upgraded I backed up my proxy2 config
and uninstalled. I proceeded to upgrade, once completed I reinstalled Proxy2
and restored my config. Worked like a champ and the Proxy aspect still does.
    Another odd thing from my win2k pro workstation I cannot browse entire
network under My Network Places, I would get an error, but now all of a
sudden since I opened the file GptTmpl.inf I can browse it.Coincidence?
Or 2 separate issues.

MEANIE



> >Doesn't make a difference.
> >any other ideas?
> >MEANIE

> Just curious....can you access the file GptTmpl.inf? Was proxy
> installed before or after the machine became a PDC?

> Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by Brad Morg » Sun, 23 Apr 2000 04:00:00



>Well its interesting you asked...
>    I am able to browse out to that file and even open it in notepad. This
>box has always been my PDC even when it was NT 4.0 before the upgrade and
>ran Proxy2 on it as well.  Before I upgraded I backed up my proxy2 config
>and uninstalled. I proceeded to upgrade, once completed I reinstalled Proxy2
>and restored my config. Worked like a champ and the Proxy aspect still does.
>    Another odd thing from my win2k pro workstation I cannot browse entire
>network under My Network Places, I would get an error, but now all of a
>sudden since I opened the file GptTmpl.inf I can browse it.Coincidence?
>Or 2 separate issues.

>MEANIE

What was the error on the Pro machine? Did you look at that second
knowledge base article I mentioned?

Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by MEANI » Sun, 23 Apr 2000 04:00:00


    Well I rebooted my pro workstation since my last post and now I can't
browse my DOMAIN through My Network Places again the error I get when I
click my domain is : "BUDDYMAX is not accessible.  An invalid operation was
attempted on an active network connection" and theres an OK button.
    Yes I read the article and studied it. I can't really make heads or
tails of it.
If your implying my sysvol or netlogon shares are missing, I looked and they
are there.

MEANIE



> >Well its interesting you asked...
> >    I am able to browse out to that file and even open it in notepad.
This
> >box has always been my PDC even when it was NT 4.0 before the upgrade and
> >ran Proxy2 on it as well.  Before I upgraded I backed up my proxy2 config
> >and uninstalled. I proceeded to upgrade, once completed I reinstalled
Proxy2
> >and restored my config. Worked like a champ and the Proxy aspect still
does.
> >    Another odd thing from my win2k pro workstation I cannot browse
entire
> >network under My Network Places, I would get an error, but now all of a
> >sudden since I opened the file GptTmpl.inf I can browse it.Coincidence?
> >Or 2 separate issues.

> >MEANIE

> What was the error on the Pro machine? Did you look at that second
> knowledge base article I mentioned?

> Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by Brad Morg » Sun, 23 Apr 2000 04:00:00



>    Well I rebooted my pro workstation since my last post and now I can't
>browse my DOMAIN through My Network Places again the error I get when I
>click my domain is : "BUDDYMAX is not accessible.  An invalid operation was
>attempted on an active network connection" and theres an OK button.
>    Yes I read the article and studied it. I can't really make heads or
>tails of it.
>If your implying my sysvol or netlogon shares are missing, I looked and they
>are there.

>MEANIE

All that I can find is the following;

User Action:
This Windows 2000 Executive STATUS message is for your information.
Choose OK to continue. No other action is required.

Makes no sense to me!

Does the workstation have a valid account? Are there issues on the DC
or just the workstation? Workstation has a functioning proxy client?
Check permissions on the sysvol (guessing wildly<g>). Do you have any
GPOs defined that might be causing problems? Also, go into security
settings and enable auditing ( logon events, account management,
privileged use and directory service access) Let's see what turns up
with that.

Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by Brad Morg » Sun, 23 Apr 2000 04:00:00


MEANIE, this was passed along from James at Microsoft,

"The cause for your situation is that the share \\<AD Domain
Name>\sysvol is
a special share that requires the DFS client to make the connection.
If
the DFS client is disabled you will receive the errors.

You need to check the following registry value,  
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup REG_DWORD
<BR/>
 Range: 0 or 1 Default: 0 (Enabled) 1 (Disabled)  
 Make sure that the value is set to 0 enabling the DFS client."

Try this and let me know what happens!

Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by Edgington, Adam L » Sun, 23 Apr 2000 04:00:00


1. I CAN pull up \\SERVER\SYSVOL but NOT \\ADNAMESPACE\SYSVOL ...
2. Also, GPO's cannot be accessed thru AD Users because of no propagation
(that's what the two error messages are, a failure of the GPO's to
propagate). I don't believe the Proxy installation has anything to do with
it - this is the second instance I have had of this problem, both on CLEAN
(file/print/dc ONLY) boxes (1 NT40 upgrade, 1 fresh install).

I've looked at this Registry value, and i have:

HKLM\SYSTEM\CCS\SERVICE\MUP :
        DEFAULT
        DISPLAY NAME
        ERROR CONTROL
        GROUP
        IMAGE PATH
        START
        TAG
        TYPE
    MUP\ENUM
        DEFAULT
        0
        COUNT
        NEXTINSTANCE
    MUP\PARAMATERS
        DEFAULT

... i don't see this <BR/> value you refer to...


Quote:> MEANIE, this was passed along from James at Microsoft,

> "The cause for your situation is that the share \\<AD Domain
> Name>\sysvol is
> a special share that requires the DFS client to make the connection.
> If
> the DFS client is disabled you will receive the errors.

> You need to check the following registry value,
>  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup REG_DWORD
> <BR/>
>  Range: 0 or 1 Default: 0 (Enabled) 1 (Disabled)
>  Make sure that the value is set to 0 enabling the DFS client."

> Try this and let me know what happens!

> Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by MEANI » Sun, 23 Apr 2000 04:00:00


Try this on my Server or on my Pro workstation?
MEANIE


Quote:> MEANIE, this was passed along from James at Microsoft,

> "The cause for your situation is that the share \\<AD Domain
> Name>\sysvol is
> a special share that requires the DFS client to make the connection.
> If
> the DFS client is disabled you will receive the errors.

> You need to check the following registry value,
>  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup REG_DWORD
> <BR/>
>  Range: 0 or 1 Default: 0 (Enabled) 1 (Disabled)
>  Make sure that the value is set to 0 enabling the DFS client."

> Try this and let me know what happens!

> Brad J. Morgan, MCSE

 
 
 

Win2k Server Application Event Log keeps filling up with.....

Post by MEANI » Sun, 23 Apr 2000 04:00:00


All the things you mentioned below are working except I haven't enabled the
auditing yet but will in a few minutes.
MEANIE



> >    Well I rebooted my pro workstation since my last post and now I can't
> >browse my DOMAIN through My Network Places again the error I get when I
> >click my domain is : "BUDDYMAX is not accessible.  An invalid operation
was
> >attempted on an active network connection" and theres an OK button.
> >    Yes I read the article and studied it. I can't really make heads or
> >tails of it.
> >If your implying my sysvol or netlogon shares are missing, I looked and
they
> >are there.

> >MEANIE

> All that I can find is the following;

> User Action:
> This Windows 2000 Executive STATUS message is for your information.
> Choose OK to continue. No other action is required.

> Makes no sense to me!

> Does the workstation have a valid account? Are there issues on the DC
> or just the workstation? Workstation has a functioning proxy client?
> Check permissions on the sysvol (guessing wildly<g>). Do you have any
> GPOs defined that might be causing problems? Also, go into security
> settings and enable auditing ( logon events, account management,
> privileged use and directory service access) Let's see what turns up
> with that.

> Brad J. Morgan, MCSE

 
 
 

1. Event viewer system log keeps filling up from print logs

Does anybody know of a quick solution to stop the event viewer keep logging
all the printing that happens through the server. The reason I ask is
because it keeps filling up the system log every 2-3 days and it can be a
pain to have to go through all the logs before I can clear it!

Thanks in advance !

--
Any opinions expressed in the email are those of the individual and not
necessarily the Society. This email and any files transmitted with it are
solely for the intended recipient or entity whom they are addressed.
Please note that the contents of this email are confidential and may be
legally privileged. If you are not the intended recipient, be advised that
you have received this email in error and that any use is strictly
prohibited.

This footnote also confirms that although this email has been swept for the
presence of computer viruses, the recipient is responsible for ensuring that
the email and contents have been swept and accepted by their own virus
protection systems.

2. cad 4 sale

3. System Log keeps filling w/ system event 64002

4. Now to change an installed machine name?

5. Application Log Is Filling With Error Events - Help!?

6. Best of Breed

7. BINLSVC filling application log with 1003 events

8. LAST_INSERT_ID() and Stored Procs

9. DNS Events 5501 Fill Up the Event Log (Q198757)

10. Event log fills up with PERFLIB failure, Event 1008

11. RIS Event 1003 from BINLSVC filling event log

12. event log properties keep reverting on win2k sp2 server

13. Event Viewer keeps filling up.