Re: event error 1202 from Scecli

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 01/27/05

  • Next message: jefwea: "Re: event error 1202 from Scecli" 
    Date: Thu, 27 Jan 2005 13:35:12 -0600

    I don't know what exactly is going on here but it might be interesting to
    see what happens if you remove server operators from those user rights, use
    gpupdate or gpedit as appropriate to refresh policy, then see if errors go
    away and then add the server operators group back to see if that makes a
    difference. Verify that server operators shows up in AD Users and Computers.
    It should not be able to be deleted but I would check it out anyhow. ---
    Steve

    "jefwea" <jefwea@discussions.microsoft.com> wrote in message
    news:11986AE7-5F19-424F-993C-374E126194D0@microsoft.com...
    >I am getting error 1202 in the event logs.
    > I have followed the instructions in the properties of the event as well as
    > in Q324383.
    >
    > But can not seem to resolve.
    >
    > When I look at the at the user rights for the server operater in the
    > default
    > domain controller policy, I cannot find any indication that there are
    > missing or unknown Sid's.
    >
    >
    > Does any one have a suggestion for this error.
    > Output logs are below.
    >
    > Thanks for the help.
    > Jeff
    >
    >
    > C:\>find /I "cannot find" %systemroot%\security\logs\winlogon.log
    >
    > ---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    > Cannot find Server Operators.
    >
    > C:\>find /I "server operators"
    > %systemroot%\security\templates\policies\gpt*.*
    >
    > ---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM
    >
    > ---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF
    > SeBackupPrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
    > SeInteractiveLogonRight =
    > *S-1-5-21-1491778951-1156932096-3766891002-1551,IUSR_A
    > DAM2,*S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
    > Operators,*S-1-5-32-550
    > SeRemoteShutdownPrivilege = *S-1-5-32-544,Server Operators
    > SeRestorePrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
    > SeShutdownPrivilege = *S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
    > Operators
    > ,*S-1-5-32-550
    > SeSystemTimePrivilege = *S-1-5-32-544,Server Operators
    >
    > C:\>find /i "mapping" %systemroot%\security\logs\winlogon.log
    >
    > ---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
    > [Mapping] gpt00000.dom = Default Domain Policy
    > [Mapping] gpt00001.inf = Default Domain Controllers Policy
    > [Mapping] gpt00000.dom = Default Domain Policy
    > [Mapping] gpt00001.inf = Default Domain Controllers Policy

  • Next message: jefwea: "Re: event error 1202 from Scecli"

    Relevant Pages

    • Re: event error 1202 from Scecli
      ... If you create a group called server operators it will not be the ... those user rights, but that is bizarre that it is missing. ... --- Steve ...
      (microsoft.public.windows.server.security)
    • Re: event error 1202 from Scecli
      ... The server operators group is indeed missing. ... > see what happens if you remove server operators from those user rights, ...
      (microsoft.public.windows.server.security)