Event 1202 every 5 minutes after removing IIS from a DC

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Hi. A predecessor of mine had IIS setup on a Windows 2000 Domain Controller.
I know that is not recommended. We uninstalled IIS and now we get an Event
1202 every 5 minutes in the Application Log on the domain controller. Here
is the error message:

Security policies are propagated with warning. 0x4b8 : An extended error has
occurred.

For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "Troubleshooting Event
1202s".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Could someone please help me correct this problem? My theory is that a
domain account that no longer exists is being referenced in Group Policy.
Thanks for the help.
2 answers Last reply
More about event 1202 minutes removing
  1. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    You should first turn up winlogon logging and reproduce the failure.
    Location of the log file - %windir%\security\logs

    Registry Location -
    HKLM\Software\Microsoft\WindowsNT\CurrentVersion\WinLogon\GPExtensions\
    {827D319E-6EAC-11D2-A4EA-00C04F79F83A

    Registry Setting - Add the REG_DWORD value "ExtensionDebugLevel"
    and set it to 0x2

    This log contains additional info that may shed more light on the useless
    1202s.

    --
    Glenn L
    CCNA, MCSE 2000/2003 + Security

    "Corbin O'Reilly" <corbinoreilly@bellsouth.net> wrote in message
    news:wRW4e.38166$wo1.32145@bignews6.bellsouth.net...
    > Hi. A predecessor of mine had IIS setup on a Windows 2000 Domain
    > Controller. I know that is not recommended. We uninstalled IIS and now we
    > get an Event 1202 every 5 minutes in the Application Log on the domain
    > controller. Here is the error message:
    >
    > Security policies are propagated with warning. 0x4b8 : An extended error
    > has occurred.
    >
    > For best results in resolving this event, log on with a non-administrative
    > account and search http://support.microsoft.com for "Troubleshooting Event
    > 1202s".
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Could someone please help me correct this problem? My theory is that a
    > domain account that no longer exists is being referenced in Group Policy.
    > Thanks for the help.
    >
    >
  2. Archived from groups: microsoft.public.win2000.group_policy (More info?)

    Thanks guys. It looks like the problem is fixed. An IWAM account that no
    longer exists was referenced in the Domain Controller Policy. I removed the
    reference and the Event 1202 alerts stopped.

    "Corbin O'Reilly" <corbinoreilly@bellsouth.net> wrote in message
    news:wRW4e.38166$wo1.32145@bignews6.bellsouth.net...
    > Hi. A predecessor of mine had IIS setup on a Windows 2000 Domain
    > Controller. I know that is not recommended. We uninstalled IIS and now we
    > get an Event 1202 every 5 minutes in the Application Log on the domain
    > controller. Here is the error message:
    >
    > Security policies are propagated with warning. 0x4b8 : An extended error
    > has occurred.
    >
    > For best results in resolving this event, log on with a non-administrative
    > account and search http://support.microsoft.com for "Troubleshooting Event
    > 1202s".
    >
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Could someone please help me correct this problem? My theory is that a
    > domain account that no longer exists is being referenced in Group Policy.
    > Thanks for the help.
    >
    >
Ask a new question

Read More

Domain Controller IIS Windows