How do I find the cause of Event ID: 1202?

[JBruyet]

Hey all, my domain controllers recently started getting lots of the following error in their event logs:

Event Type: Warning
Event Source: SceCli
Event Category: None
Event ID: 1202
Date: 4/11/2012
Time: 1:01:50 PM
User: N/A
Computer: SRV-DCx
Description:
Security policies were propagated with warning. 0x534 : No mapping between account names and security IDs was done.

I checked the Microsoft site and found this page:

http://support.microsoft.com/kb/927061

Yeah, that's my problem but the two problem accounts are from a long time ago:

Cannot find IUSR_2000SERVER-OS
Cannot find IWAM_2000SERVER-OS

When I try to find them using the directions on the Microsoft site no problem accounts can be found.

FWIW that computer has been gone for years and I'm not sure why these two accounts just reappeared. I've looked at some of Microsoft's Active Directory cleanup utilities but these accounts were on a computer, not in AD. Anyone have any ideas on how to find these accounts and get rid of them?

Thanks,

Joe B

 

[JBruyet]

Ok, I think I found it. rsop.msc > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. The problem policies were "Access this computer from the network," "Allow log on locally" and "Log on as a batch job." These were greyed out so I went to Security Settings > Local Policies > User Rights Assignment on the Domain Controllers and removed the offending accounts from there. Now I need to wait and see if things propagate like I'm hoping they do...

Thanks,

Joe B