1058 1030 event errors every 5 minutes on DC

[trent1980]

i have a windows 2003 domain with 2 dc's (dc00 and dc01). dc00 contains all the fsmo roles and dc01 is a global catalogue as well as dc00.

every 5 minutes on dc00 i get a 1030 and 1058 Userenv error as stated in microsoft's article (

http://support.microsoft.com/default.aspx?scid=kb;en-us;839499)

- windows cannot query for the list of group policy objects

I followed microsoft's fix with the default domain policy and registry, unfortunately i didn't have to make any changes as my settings already match microsoft's article. when i run gpupdate /force, it will log the 1030 and 1058 events as well as every 5 minutes ... but only on dc00, not dc01.

when i run rsop.msc and it queries, i get a red x through the user settings, but not the computer settings.

now for the questions / puzzling part --
just for kicks, i changed a setting in the default domain policy mmc on dc00 and then changed it right back ... ran the gpupdate /force and i got the success event 1704 as well as rsop.msc doesn't have any errors. 5 minutes later, it logs both 1030 and 1058 again and any gpupdate /force after that will log them again.

obviously, something is overwriting and i have issue of synchronizing, but i can't figure out where / how -- all articles i find on microsoft seem to have some good ideas for changes that i can make, services to restart, reboots ... but all the suggestions are already the default config on my dc00. dc01 looks identical to dc00 from my persepective, yet it logs no errors in the event log.

let me know what other info you want me to post -- thanks in advance




------------- update ------------------------



if i edit the default domain controller policy ... just make a change and set it right back ... then run gpupdate /force -- i get the blue 1704 success event .. followed by some random time, then 5 minute increment of failures again.

conclusion: something is overwriting those settings ("those settings" being the ones listed in KB

http://support.microsoft.com/default.aspx?scid=kb;en-us;839499).

there is nothing to change because mine matches the kb article .. so all i do is change one of them to a "wrong" setting and then right back ... gpupdate and success

they list these two as needing to be "enabled" ...
Microsoft Network Server: Digitally Sign Communications (always)
Microsoft Network Server: Digitally Sign Communications (if client agrees)

these ARE enabled on my "default domain controller policy" but ARE NOT on my "default domain policy" --

is there any reason why the default domain policy settings would overwrite my default domain controller .. if so, is there any reason to not set my default domain and default domain controller policy the same in regards to those 2 objects ENABLED above?

what's your take on that?

 

[Daveyd123]

Are you usinf DFS? Is the DSF service stopped? I have been having issues with DFS maxing out my CPU. I stop the service and get the 1030 and 1058 events every 5 minutes...I start the service and the CPU maxes out at 100%...I am sick of messing with it. A rebuild is in order

 

[trent1980]

maybe i'm getting sidetracked on the wrong stuff -- it's kind of hard to tell now.

at 9:03 i did the default domain controller policy update, which stopped the 1030 and 1058 errors
at 10:30 they started again, every 5 minutes
at 12:19 i restarted the DFS service, ran gpupdate /force, and logged a 1704 success event

what do you think?
i'm going to stop the dfs service, run some tests and see what happens

keep posting any ideas

 

[trent1980]

its not erroring now, so i can't test --

the dfs service is running

 

[trent1980]

ok ... i did all kinds of stops, starts, restarts on the DFS service and i'm getting the 1030 and 1058 error everytime i run gpupdate /force

so apparently, my issue has nothing to do with DFS like yours

can anyone tell me what the harm is in setting the default domain policy to the settings in my original post?