event ID 1030 & 1058

[rokitman1]

Hi

just spoken to Microsoft ref event viewer errors:
they said this issuse was fixed in SP1! I already have SP1..

how do I find the exact area of group policy this error is pointing at???


w2003 SP1, event errors:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date: 22/08/2005
Time: 05:55:44
User: NT AUTHORITY\SYSTEM
Computer: WYESERV
Description:
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=CMSEA,DC=local. The file must be present at the location <\\CMSEA.local\sysvol\CMSEA.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied. ). Group Policy processing aborted.


any help would be great!!


Rokitman1
"The Problem Exists Between The Chair And The Keyboard"

 

[WillShakespeare]

Open that folder, and check the ini file is there. It is likely hidden, so you'll need to type the full path in Eplorer.

Will

 

[rokitman1]

the file is there, system rights all look OK ?
error in event viewer goes away after the first person logs in at 9am ?? any ideas?

Rokitman1
"The Problem Exists Between The Chair And The Keyboard"

 

[WillShakespeare]

There's a couple of things you need to supply before anyone can answer this:

[ol]
[li]If the error "goes away" after first person logs in, then what's the problem? (i.e. you need to be a bit clearer in what you mean)[/li]
[li]Is this GPO event on all machines or just the server? If on the server only, then what is happening is the GPO is not being updated on the server. You see, whenever a policy update is initiated, essentially all that happens is that ini file is copied to the policy folder on the local server from the domain controller. The server doesn't need to copy it to itself, so if it is having trouble accessing it, then this suggests, perhaps, that the file is corrupt, in which case you could try replacing with a backup version, or change the permissions to EVERYONE as a test to see if the problem goes away, and then adding restrictions until you find what works. Or, it may suggest that the server is trying to update it while it is being accessed by other servers or workstations during an update.[/li]
[li]Do you have several Policies, or just one all-inclusive one?[/li]
[li]Do you have GPO update time set appropriately? For example, if one person is accessing the file to update their GPO on the local machine, and another machine tries at that moment, then access may be denied. In fact, that may be the problem that was "fixed" in SP1.[/li]
[li]You say SP1 is applied... are you talking Windows Server 2003 SP1, or Windows XP SP1? For example, Microsoft may be explaining it was fixed in SP1 on the server, but you are referring to SP1 on XP in this post when you say "I already have SP1.." You haven't made that clear.[/li]
[/ol]

Will

 

[rokitman1]

thanks for the reply Will:

to make things clearer:

Windows 2003 Server with SP1 installed (one server only)
the error is on the Servers event viewer, all information is from the Server, the event viewer is full or errors until the first user logs on......

1. the error stops in the servers event viewer once the first user logs on to their PC & domain in the mornings

2. GPO just on server - I will change to "everyone" to test
content of file: [General]Version=65571

3. just the one policy for local users, we do have another OU for remote terminal clients with its own GPO on this one server

4. no update time set, as far as I am aware?

5. windows 2003 SP1 is installed on Server, MS said that SP1 on server fixed this exact event viewer issue.


now the only other information I can think of is that I did change the local GPO a few weeks ago, I changed all the defaults to security on domain passwords, I followed instrustions from a website on how to make it easier to change passwords, say only remembering the last 3 and making them 6 long etc, the "users" had moaned about this, so I changed it, it could be about the time the error started, I am not sure, as I did not check the Server event viewer for a while after that change..

hope this helps...

 

[WillShakespeare]

Okay,

Firstly, don't let user's tell you how to do your job!

Your lessened password settings can cost your company in time and money if a hacker out there gets it into his (or her) head to cause havoc on your system.

Best way to look at it:

"If you wouldn't put it on your CV, don't do it!"

What I mean is, if you were in an interview, and the potential employer asked "Some users are complaining that they have to change their passwords, and are finding it difficult to remember strange characters that are required by the policy... what do you do?" (I have actually been asked this at a contract interview a few years ago!)

If you simply tell them what they want to hear, then you are deceiving yourself and your future employer!

When making decisions in IT, just remember: If you do what is right, and do it well, even if some people hate you for it, you'll have respect, and you won't ever be fired. (in fact you'll improve your chances of promotion!)

Now, back to your problem:

[ol]
[li]Look back in the Event viewer until the error stops. That will give you an indication as to when it started.[/li]
[li]Look at the frequency of the error. Try to determine if it happens regularly.[/li]
[li]Looking at the error, it seems to be trying to access CMSEA. Is this another server? Or is it a workstation?[/li]
[li]You said you looked at the gpt.ini file... how did you acces sthis? When I try \\ourserver.local\sysvol, it cannot access... I have to use \\ourserver\sysvol. That may be the problem (however, we don't use SP1 yet, and we have no problem)[/li]
[li]You could try running "GPUPDATE /force" in a batch file on all XP machines, and "secedit" on any windows 2000 pro workstations.[/li]
[li]You could try GPUPDATE /force on the server.[/li]
[li]Another thing, is because you have changed the password policy, this may have had an effect of rights assignment, and why the gpt.ini file in question cannot be accessed.[/li]
[/ol]

Will

 

[rokitman1]

Hi Will, thanks for the advice....

as for the problem...

1. happens every night at approx 8.30pm and goes through to approx 8.30am !! (the backup starts at 11:00pm and lasts 2 hours) all users are logged out at night
2. happens every night
3. CMSEA.local is the domain name wyeserv is the server name
4. if I copy and paste this line in the "run" menu on server:
\\CMSEA.local\sysvol\CMSEA.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini /// it opens the ini file correctly...

5 & 6. I may try gpupdate /force at the server

7. I really think this is the issue, I will try adding the "everyone" group with full rights, to the selected target file and directories, if this does not work, I will set the policies on passwords back to the default settings and the users will just have to put up with it

thanks for the help, I will let you know how it goes..

 

[WillShakespeare]

No probs.

Listen, as to point 1, what I meant was some day in the past, the errors did not happen every night. so when I say "when it started" I mean that, not when it starts each night. Though that info may help you to determine when the GPO kicks in.


And as to point 2, what I meant was, does it happen every few seconds, or every few minutes, every 10 minutes, every hour. That's what I mean by frequency. I'm assuming the error repeats, which is why you are worried?

Let me know how you get on!

Will

 

[xmsre]

Sounds like the DFS client is truned off on XP.

http://support.microsoft.com/default.aspx?scid=kb;en-us;314494

 

[rokitman1]

Hi

I did read that post on the MS site, but the errors are on the server not the client PCs

thanks

Rokitman1
"The Problem Exists Between The Chair And The Keyboard"