Re: Re: Re: SCECLI 1202 Events with an error code 0x5

From: Jorge_de_Almeida_Pinto (DoNotEmail_at_WindowsForumz.com)
Date: 06/27/05 

Date: 26 Jun 2005 21:36:12 -0400

"norm34" wrote:
> Jorge,
>
> Thanks for the sugesstion about reading "Troubleshooting
> SCECLI 1202 Events"
> http://support.microsoft.com/?id=324383. As stated at in my
> first message., I
> did follow this until step #$ which says to do the following:
> find /i
> "service" %SYSTEMROOT%securitytemplatespoliciesgpt*.*".
> The problem is
> that the policy directory was EMPTY. So I'm stuck and don't
> know what I
> should do next.
>
> Thanks,
> Norm
>
>
> "Jorge_de_Almeida_Pinto" wrote:
>
> > "norm34" wrote:
>  > > The error has not ocurred in a few days. Should I
> post the
>  > > whole event
>  > > message when it happenes?
>  > >
>  > > The server is a standalone that is on the WEB. It
> is running
>  > > IIS, SQL Server
>  > > and Coldfusion. What other information can I
> provide?
>  > >
>  > > Thanks,
>  > >
>  > >
>  > > "Jorge_de_Almeida_Pinto" wrote:
>  > >
>   > > > "norm34" wrote:
>   > > > > I am getting a 1202 error with an 0x5:
> Access
>  > > denied. error
>   > > > > code. When I look
>   > > > > in the
> "%SYSTEMROOT%securitytemplatespolicies"
>  > > directory,
>   > > > > it's empty. In
>   > > > > addtion I don't have the gpotool
> program.
>   > > > >
>   > > > > My server hangs after getting this
> error.
>   > > > >
>   > > > > Thanks,
>   > > > > Norm
>   > > >
>   > > > Please provide more specific info about the
> event id
>   > > >
>   > > > Is this on a member server or a DC?
>   > > >
>   > > > Cheers,
>   > > >
>   > > > --
>   > > > Posted using the
> http://www.windowsforumz.com interface, at author's request
>   > > > Articles individually checked for
> conformance to usenet
>  > > standards
>   > > > Topic URL:
> http://www.windowsforumz.com/Security-SCECLI-1202-Events-error-code-0x5-ftopict548262.html
>   > > > Visit Topic URL to contact author (reg.
> req'd). Report abuse:
> http://www.windowsforumz.com/eform.php?p=1736756
>   > > >
> >
> > Read the following to see if it provides a solution when it
> happens
> > again
> > "Troubleshooting SCECLI 1202 Events"
> > http://support.microsoft.com/?id=324383
> >
> > Cheers,
> >

OK... it’s time to turn on "Diagnostic Logging" for GPO
processing...

Beware that when you switch on verbose logging modes with these
values, your Event Viewer logs will fill up quickly. You’ll need to
review the settings for the Event Viewer logs to ensure that
everything you need is being logged and that you don’t lose or
overwrite any part of the logs you may need to keep for reference,
security, and/or legal reasons.

Before turning on "Diagnostic Logging" make a copy of all event logs
for that machine

He is the configuration you need to make (you might need to reboot the
server):

RunDiagnosticLoggingGroupPolicy will turn GPO event logging to
verbose.

Hive: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
Name: RunDiagnosticLoggingGroupPolicy
Type: REG_DWORD
Value: 1
Note: After you make that change and restart the system, you will see
a lot more information reported, especially during errors. In many
cases, this will be enough to get the information you need.

Cheers,