Search
Sign in with
Sign up | Sign in

Event 1202 every 5 minutes after removing IIS from a DC

Last response: in Windows 2000/NT
Share
Anonymous

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Hi. A predecessor of mine had IIS setup on a Windows 2000 Domain Controller.
I know that is not recommended. We uninstalled IIS and now we get an Event
1202 every 5 minutes in the Application Log on the domain controller. Here
is the error message:

Security policies are propagated with warning. 0x4b8 : An extended error has
occurred.

For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "Troubleshooting Event
1202s".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Could someone please help me correct this problem? My theory is that a
domain account that no longer exists is being referenced in Group Policy.
Thanks for the help.

More about : event 1202 minutes removing iis

Register or log in to remove
Anonymous

Archived from groups: microsoft.public.win2000.group_policy (More info?)

You should first turn up winlogon logging and reproduce the failure.
Location of the log file - %windir%\security\logs

Registry Location -
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\WinLogon\GPExtensions\
{827D319E-6EAC-11D2-A4EA-00C04F79F83A

Registry Setting - Add the REG_DWORD value "ExtensionDebugLevel"
and set it to 0x2

This log contains additional info that may shed more light on the useless
1202s.

--
Glenn L
CCNA, MCSE 2000/2003 + Security

"Corbin O'Reilly" <corbinoreilly@bellsouth.net> wrote in message
news:wRW4e.38166$wo1.32145@bignews6.bellsouth.net...
> Hi. A predecessor of mine had IIS setup on a Windows 2000 Domain
> Controller. I know that is not recommended. We uninstalled IIS and now we
> get an Event 1202 every 5 minutes in the Application Log on the domain
> controller. Here is the error message:
>
> Security policies are propagated with warning. 0x4b8 : An extended error
> has occurred.
>
> For best results in resolving this event, log on with a non-administrative
> account and search http://support.microsoft.com for "Troubleshooting Event
> 1202s".
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Could someone please help me correct this problem? My theory is that a
> domain account that no longer exists is being referenced in Group Policy.
> Thanks for the help.
>
>
Anonymous

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Thanks guys. It looks like the problem is fixed. An IWAM account that no
longer exists was referenced in the Domain Controller Policy. I removed the
reference and the Event 1202 alerts stopped.

"Corbin O'Reilly" <corbinoreilly@bellsouth.net> wrote in message
news:wRW4e.38166$wo1.32145@bignews6.bellsouth.net...
> Hi. A predecessor of mine had IIS setup on a Windows 2000 Domain
> Controller. I know that is not recommended. We uninstalled IIS and now we
> get an Event 1202 every 5 minutes in the Application Log on the domain
> controller. Here is the error message:
>
> Security policies are propagated with warning. 0x4b8 : An extended error
> has occurred.
>
> For best results in resolving this event, log on with a non-administrative
> account and search http://support.microsoft.com for "Troubleshooting Event
> 1202s".
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Could someone please help me correct this problem? My theory is that a
> domain account that no longer exists is being referenced in Group Policy.
> Thanks for the help.
>
>
 
Ask the community
!