Event ID 1202 - Lcoal Policy

[CC801340]

I recently removed IIS from a W2k server machine as it wasn't needed. Since then I have had event id 1000 and 1202 in the Application Log.

I have followed the instructions in Q247482 and searched the Winlogon.log file to find the deleted users are IWAM_SERVER and IUSR_SERVER.

There are entries for these users under:

Local Security Settings - "Local Policies", "User rights assignment", "Access this computer from the network" and "Log on as a batch job".

How can i remove the entries for these users? When i right click on the policies, the "Effective Policy Setting" box is ticked and greyed out so I cannot untick it.

 

[brontosaurus]

they're grayed out because another policy is overriding it, most likely the Default Domain Controllers Policy. Open that one and check the same locations.

 

[brontosaurus]

sorry, I assumed you were referring to a DC. If it's just a member server in a domain, then you need to check the Default Domain Policy as well.

 

[CC801340]

Thanks very much! Im sure I had already looked in all the policies but obviously I hadnt!! It was in the Domain Controller Policy.