Help: can't logon as domain user to workstation till reboot

[cheer8923]

I've had this problem for a while and the only fix I have is to reboot the workstation. Sometimes it's good for a few weeks, sometimes only a couple of days. And sometimes I have to reboot several times. Here is what I can see in the event viewer for the latest incidence.

ON WORKSTATION, the following error occurred over 100 times (Application Events), one for every 4-5 min for almost all users, with no user logon attempt.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 2/27/2008
Time: 8:39:09 PM
User: NT AUTHORITY\SYSTEM
Computer: WORKSTATION
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

Then later on, when user attempts to log in, the following starts to show in Application Events

Event Source: Winlogon
Event Category: None
Event ID: 1219
Date: 2/28/2008
Time: 1:26:59 PM
User: N/A
Computer: WORKSTATION
Description:
Logon rejected for DOMAIN\user. Unable to obtain Terminal Server User Configuration. Error: Not enough resources are available to complete this operation.

The domain server event log showing Netlogin error, though the time does not match the workstation:

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5723
Date: 2/27/2008
Time: 9:16:32 PM
User: N/A
Computer: DomainServer
Description:
The session setup from computer 'XXXX-YYYYYYYYY' failed because the security database does not contain a trust account 'XXXX-YYYYYYYYY$' referenced by the specified computer.

How can I tell which computer the above log is referring to? XXXX appears to be the domain name and Y appears to be hexdecimal.

What's exhausting resources on the workstation? Event 1030?

I can see hundreds of audit events in security event viewer. Is that exhausting resource?

Anyway for me to troubleshoot the problem?

Thanks!

 

[TweakMYbox]

Interesting...

How much capacity is on the system volume?

I would remove this machine from the domain, patch it - maybe re-apply SP2, and then re-join it to the domain.

Mike Fegan

http://www.tweakmybox.com

Learn how to tweak YOUR box, and talk shop with other techies!

 

[cheer8923]

How can I tell which resource is exhausted?

"Error: Not enough resources are available to complete this operation.

 

[itsp1965]

Actually I have seen this issue before. If the problem revolves around one particular user, it is a problem with the profile. If it's for any user logging on to the workstation it is most likey caused by a failed GPo setting that has been applied. Find out what GPOs are being applied to this particular host, it's failing to apply.

 

[cheer8923]

It happens to all user once the error is reported. No one will be able to log on.

1. If it's GPO, why does it happen after a few days and why does it go away after reboot?

2. How do I check GPO?

Thanks!

 

[porkchopexpress]

Is this happening on one station only?

It might be worth taking a look at this doc, rejoining the domain might also work.

http://www.microsoft.com/technet/pr...rv/reskit/distrib/dsbi_add_qqne.mspx?mfr=true

 

[cheer8923]

I've posted another topic which might be the cause of my problem.

"Disconnected and active user appear at the same time in task manager"

http://www.tek-tips.com/viewthread.cfm?qid=1455514&page=1

Would you think that might be the cause? If so, how would I be able to test/fix it?

Thanks!