event ID: 1202, 412, and 454

[twospoons]

i am having a problem with event ID: 1202, 412, and 454 being logged repeatedly in the application event log as described in this link:

http://support.microsoft.com/default.aspx?scid=kb;[LN];278316

except that i am not getting event ID: 1000.

when i try to go through the steps for resolving the issue i get an error importing the setup security.inf file. it is not the "access denied" message that i can safely ignore; i just get a message saying the import failed. any suggestions?

 

[ecunupe]

You can go to sysinternals.com and download a program called process explorer and kill the winlogon process. This is what is causing the access is denied error message. You also may want to try and perform this operation using the secedit command.

 

[mlichstein]

The OP is getting an import error, not access denied.

Twospoons, is this problem happening on a 2000 machine, or a XP/2003 machine?

 

[twospoons]

the problem is with a 2000 server, hence the posting in the 2000 server forum. thanks all.

 

[minxca]

http://support.microsoft.com/default.aspx?scid=kb;en-us;266361

 

[twospoons]

winoto: ummm... i'm not sure what the connection is between that article and the problem i'm having.

 

[minxca]

have you checked eventid.net?

 

[twospoons]

winoto: yes i have checked eventid.net... one of the first places to go when a message like this shows up in the eventlog. did you happen to see some information there that i overlooked and that would be beneficial to the problem at hand?

 

[twospoons]

ok... still having this problem.

ecunupe: just for kicks i tried what you suggested with process explorer... killing the winlogon process forces windows 2000 server to reboot. not what i want to do in the middle of the day with users logged in and files open.

i tried following the steps in microsoft kb article 250454:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;250454

which talks about the import faied message i'm getting. the exact message i'm getting says "an extended error has occurred. import failed". but i'm trying to import setup security.inf and not basicdc.inf or defltdc.inf like that article talks about.

i'm running out of options here. any ideas???

 

[mlichstein]

(Chuckle)

Sorry to laugh, but stopping the winlogon service is very bad advice.

Anyway, it looks like your security database is corrupted. First, do an integrity check of the database. Open a command prompt and change to c:\winnt\security\database. Then run 'esentutl /g secedit.sdb'

If it comes back and says the file is corrupted, you can try a soft repair. Change to the c:\winnt\security folder and run 'esentutl /r edb'

If that fails, change back to c:\winnt\security\database and run 'esentutl /p secedit.sdb' Then delete the .log files in c:\winnt\security.

 

[twospoons]

mlichstein: thanks for the info... the database was definately corrupt. i went through your steps and the integrity check now comes back ok!

however i'm still getting event id 1202, 454, and 412 every five minutes. any suggestions on what to do next?

 

[mlichstein]

Have you tried doing the steps in the initial KB article that you used (278316)?

 

[twospoons]

yes, that puts me right back to the import failed message that i've been getting this whole time.

 

[twospoons]

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_scetroubletn.mspx

also found this link... this is the message that keeps getting logged repeatedly in the winlogon.log file

Error 0 to send control flag 1 over to server.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )
GPLinkOrganizationUnit GPO_INFO_FLAG_BACKGROUND )

[Mapping] gpt00000.dom = Default Domain Policy

 

[twospoons]

WOW!!!

ok i guess i just can't follow directions. the steps in the kb article are correct. but i found the information on

http://www.jsiinc.com/SUBH/TIP3500/rh3561.htm

first and assumed that the information was the same. it is not!!! step #2 on the jsiinc site is incorrect and does not match the information in ms kb article 278316

http://support.microsoft.com/default.aspx?scid=kb;en-us;278316.

the correct step should be: to move the files ending in .log from the %SystemRoot%\Security folder to the oldsecurity folder, not from the %SystemRoot%\Security\logs folder.

sorry for the confusion and thanks to everyone for your help.