Windows Server

Armin Rettl · Guest

Hello NG,

after a Desaster Recovery I have the following messages in the eventlog
(avery 2 minutes).

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 08.11.2005
Time: 08:22:07
User: SYSTEM
Computer: SERVER01
Description:
Windows cannot query for the list of Group Policy objects. Check the event
log for possible messages previously logged by the policy engine that
describes the reason for this.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Data:

---------------------------------------------------------------

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date: 08.11.2005
Time: 08:22:07
User: SYSTEM
Computer: SERVER01
Description:
Windows cannot access the file gpt.ini for GPO
CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=grz,DC=server01,DC=com.
The file must be present at the location
<\\grz.icomedias.com\sysvol\grz.icomedias.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>.
(Configuration information could not be read from the domain controller,
either because the machine is unavailable, or access has been denied. ).
Group Policy processing aborted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Data:

I have searched for that id and found some info, but nothing worked

I must do a recovery of my fine running SBS 2k3 after a HW crash using
backup & 'Directory
Services Restore Mode'. System on new HW works fine, but I get these
messsages.

Tried out the following MS KB888943, KB314494, KB839499, KB887303, KB842804
but won't help or the settings described in these documents were correct
available in my server. SP1 for SBS 2k3 is not installed on my server. Will
do that in some days, but not yet, because I want to see if the server runs
fine on the new HW.

Does anyone know where to search or any idea how I can fix that problem ?

Best regards,

Armin Rettl

Nick · Guest

Armin, do you get many of these or do you only get these occasionally? We
also get these but only very occasionally.

Have you looked through the GPOs to see which one the
CN={31B2F340-016D-11D2-945F-00C04FB984F9} relates to. In our case it is our
'Rename administrator account' GPO that causes this but no idea what to do
to stop it.

NickC

Armin Rettl · Guest

Hello NickC

thx for response. I got these messages very 2-5 minutes.
Also I tried the hints of Crina Li again. Will see if it helps.

Armin

Crina Li · Guest

Hi Nick,

Thank you for posting in SBS newsgroup.

From the description, I understand you received the event 1030 and 1058 in
event log. If I have misunderstood your concerns, please do not hesitate to
let me know.

If the 1030 and 1058 events occur, the corresponding group policy may not
be applied properly. The {31B2F340-016D-11D2-945F-00C04FB984F9} is the
default domain policy.

As I know, besides the articles you included here, this issue can be caused
by many other reasons such as following:

1. Distributed File System (DFS) service is stopped on the domain
controller.
2. TCP/IP NetBIOS Helper service is not started on SBS.
3. Make sure that the antivirus is not scanning the sysvol folder.

So I suggest you do the following:

1. On DC, click "Start", point to "Programs", point to "Administrative
Tools", and then click "Services".
2. In "Services", double-click "Distributed File System".
3. On the "General" tab, click "Automatic" next to "Startup type".
4. Under "Service Status", click "Start" if the service is not started.
5. Select TCP/IP NetBIOS Helper service, click start if the service is not
started.
6. Click "OK", and then close the "Services" window.

The following article may be helpful:

834649 Client computers record Event ID 1030 and Event ID 1058 when DFS is
not
http://support.microsoft.com/?id=834649

If the problem still persists, please perform the following troubleshooting
steps:

1. Check the contents and the permissions of the Sysvol folder

Firstly, please check if the following folder exists:

%SystemRoot%\sysvol\grz.icomedias.com\Policies\{31B2F340-016D-11D2-945F-00C0
4FB984F9}

Is there a file named GPT.ini?

By default, the Sysvol folder is located in the %systemroot% folder. Syvol
contains the domain's group policy objects, the Sysvol and Netlogon shares,
and the file replication service (FRS) staging folder. If the permissions
on the Sysvol folder or the Sysvol share are too restrictive, this can
cause group policies to fail with Userenv errors. Additionally, Userenv
errors can occur if the Sysvol share or group policy objects are missing.

To make sure the Sysvol share is available, run the "net share" command on
the SBS server. SYSVOL should appear in the list of shares. Also, make sure
that the Netlogon share is listed. If the Sysvol or Netlogon share is
missing, see the following articles for information about troubleshooting
this problem:

257338 Troubleshooting Missing SYSVOL and NETLOGON Shares on Windows 2000
Domain Controllers
http://support.microsoft.com/?id=257338

After you make sure the Sysvol share is available, make sure that the
Sysvol folder, the Sysvol share, and the root of the volume that contains
the Sysvol folder are configured with the correct permissions.

On Windows Server 2003, the Everyone group should have the Read & Execute
special permission applied to "This folder only", and the domain\Users
group should have the following standard permissions:

Read & Execute
List Folder Contents
Read

Additionally, on Windows Server 2003, the domain\Users group should have
the following special permissions:

Read & Execute applied to "This folder, subfolders and files"
Create Folder / Append Data applied to "This folder and subfolders"
Create Files / Write Data applied to "Subfolders only"

For the permissions required for the Sysvol folder and the Sysvol share,
see the following KB article:

290647 ent ID 1000, 1001 Is Logged Every Five Minutes in the Application
Event Log
http://support.microsoft.com/?id=290647

2. Make sure that the "Bypass traverse checking" right is granted to the
required groups. To do so:

1) On the SBS server, click Start, point to Programs or All Programs, point
to Administrative Tools, and then click Domain Controller Security Policy.
2) Expand Security Settings, expand Local Policies, and then click User
Rights Assignment.
3) Double-click the "Bypass traverse checking" policy setting.
4) Click to check the "Define these policy settings" box, if the option is
not enabled already.
5) The following groups should be listed for this policy setting:

Administrators
Authenticated Users
Everyone
Pre-Windows 2000 Compatible Access

If any of these groups are missing, click Add, type the name of the
missing group, and then click OK.

6) Click OK to close the policy setting.
7) Run the "gpupdate /force" command on SBS.

3. Make sure you have configured SBS as following:

1) Leave the Default Gateway of the internal NIC blank.
2) Configure both the internal NIC and the external NIC to use the internal
DNS Service as the DNS Server.
3) On the DNS Server, create the DNS Forwarder to forward the external DNS
resolution requests to the ISP's DNS server. See:

323380 How to configure DNS for Internet access in Windows Server 2003
http://support.microsoft.com/?id=323380

4) Strictly followed the instructions in the KB article below to run CEICW:

825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763

4. You can also refer to the following "Step-by-Step Guide to Implementing
Domain Rename", available at
http://www.microsoft.com/windowsserver2003/downloads/domainrename.mspx,
which says:

STEP 12: Fix Group Policy Objects and Links

If the problem still persists, please help me collect the Userenv.log and
send it to me at v-crinal@microsoft.com.

If you have any questions or concerns related to this issue, please let me
know.

I appreciate your time and look forward to hearing from you.

Best regards,

Crina Li (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Armin Rettl · Guest

Hi Crina Li,

tried all your hints in 1. & 2. but the 1030 and 1058 events are still
available.
Any other idea what I can do to solve that problem?

Best regards,

Armin Rettl

Crina Li · Guest

Hi Nick,

Thanks for your reply.

Would you please help me confirm if you have followed every suggestion I
have provided?

Currently, to narrow down the problem, may you send the Userenv.log which
is located in the %Systemroot%\Debug\UserMode\Userenv.log and the event log:

1. Open Event Viewer.
2. Right click the Application, Security and System and then select Save
Log File As.
3. Send these files to my mailbox: v-crinal@microsoft.com

Thanks for your time and I look forward to hearing from you.

Best regards,

Crina Li (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

NickC · Guest

Hi Crina,

Thx for your suggestions. The first thing that hits me is:

	Windows Server Forum Index -> Small Business Server 2003	All times are GMT
Page 1 of 1