Windows 2000 server Event ID 1000 and 1202

[CardinalEngineer]

OK, the first mistake I made was trying to fix something that wasn't broken. I am running 3 Windows 2000 servers with Active Directory in Native Mode. I noticed 1 server had IIS installed and I wanted all of the servers to be the same. So, I uninstalled IIS on the server. After that I was receiving Error
Event ID 1000
"The Group Policy client-side extension Security was passed flags (17) and returned a failure status code of (1332)."
Event ID 1202
"Security policies are propagated with warning. 0x534 : No mapping between account names and security IDs was done.
Please look for more details in TroubleShooting section in Security Help."
Every 5 minutes this error happens. When I accessed Active Directory Users and Computers it installed IIS back.
I have tried to fix this error by Microsoft--

Q247482
Q284461
Q279432
Q278316

I am lost please help.

 

[ACraib]

Did you ever find a solution to this problem? I'm now in the same situation ..... no help from the Q atricles either.

 

[brontosaurus]

check the local group policy user rights settings on the afflicted machine. These errors are typically the result of an attempt to process permissions on an ID that either no longer exists, or only exists on a local level, so the domain doesn't recognize it (like power users). Did you try the ExtensionDebugLevel registry entry and check the Netlogon.log file?

 

[ACraib]

I did the ExtensionDebugLevel but could see anything obvious in the log file ..... though there were some acounts listed by their SID number ... no name though.

The errors are also appearing on all my DC's. How do I tell which machine is afflicted or is it a case of checking all (10) DCs?

Thanks

Andrew

 

[brontosaurus]

check the Default Domain Controllers Policy. The netlogon.log file didn't show any errors processing specific ID's?

 

[ACraib]

I've checked the Default Domain Controllers Policy in the User Rights Assignment branch and can't see any 'strange' or deleted account ..... below is the only 'error' that came out of the log file.

----Configure Group Membership...
Configure *s-1-5-32-547.
Error 1332: No mapping between account names and security IDs was done.
No system mapping is found for *s-1-5-32-547.

Group Membership configuration completed with error.

 

[brontosaurus]

thats the Power Users SID. Did you see Power Users or that SID in any of the policies on the DC?

 

[ACraib]

no

now I'm stumped ...... I might end up having to pay MS for their support .... and that really gets my goat

 

[brontosaurus]

Egad! I can't let you do that.... Try one more thing to humor me. Go to the sysvol shares on your afflicted DC's and open up the Domain Controllers Group Policy Template file in Notepad (it's usually the one under the folder that begins with 6AC), path should be \\DC\sysvol\domain_name\policies\6AC....all the way down to the machine's GptTmpl.inf file. Do a search for that power user SID...if it's in any of them, remove it. Then run your secedit /refresh thing...

 

[ACraib]

there are lots of SIDs in there. thought none of them match the s-1-5-32-547 one. I've checked two of the DC's that are reporting the erros and neither have that sit in the GptTmpl.inf file.

 

[PerseusMi]

Hello,

Give Q256000 & Q260715 a shot for kicks, I'm having the same issue, except I cant locate the default domain controller policy.....any ideas how I could find that to fix my problem ( Q25600 )? I have backups, just need a file name to retrieve it.

TIAV

 

[solarys]

CE, did you get your event 1000/1202 issue resolved? If so, could you share the resolution with me. I too am suffering from the same event IDs. Any/all suggestions are welcomed.