| Author |
Message |
jefwea
Guest
|
 Posted:
Thu Jan 27, 2005 8:09 pm Post subject:
event error 1202 from Scecli |
|
|
I am getting error 1202 in the event logs.
I have followed the instructions in the properties of the event as well as
in Q324383.
But can not seem to resolve.
When I look at the at the user rights for the server operater in the default
domain controller policy, I cannot find any indication that there are
missing or unknown Sid's.
Does any one have a suggestion for this error.
Output logs are below.
Thanks for the help.
Jeff
C:\>find /I "cannot find" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
C:\>find /I "server operators" %systemroot%\security\templates\policies\gpt*.*
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF
SeBackupPrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeInteractiveLogonRight =
*S-1-5-21-1491778951-1156932096-3766891002-1551,IUSR_A
DAM2,*S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server Operators,*S-1-5-32-550
SeRemoteShutdownPrivilege = *S-1-5-32-544,Server Operators
SeRestorePrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeShutdownPrivilege = *S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators
,*S-1-5-32-550
SeSystemTimePrivilege = *S-1-5-32-544,Server Operators
C:\>find /i "mapping" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy |
|
| Back to top |
|
 |
Steven L Umbach
Guest
|
| Posted:
Fri Jan 28, 2005 1:35 am Post subject:
Re: event error 1202 from Scecli |
|
|
I don't know what exactly is going on here but it might be interesting to
see what happens if you remove server operators from those user rights, use
gpupdate or gpedit as appropriate to refresh policy, then see if errors go
away and then add the server operators group back to see if that makes a
difference. Verify that server operators shows up in AD Users and Computers.
It should not be able to be deleted but I would check it out anyhow. ---
Steve
"jefwea" <jefwea@discussions.microsoft.com> wrote in message
news:11986AE7-5F19-424F-993C-374E126194D0@microsoft.com...
| Quote: | I am getting error 1202 in the event logs.
I have followed the instructions in the properties of the event as well as
in Q324383.
But can not seem to resolve.
When I look at the at the user rights for the server operater in the
default
domain controller policy, I cannot find any indication that there are
missing or unknown Sid's.
Does any one have a suggestion for this error.
Output logs are below.
Thanks for the help.
Jeff
C:\>find /I "cannot find" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
C:\>find /I "server operators"
%systemroot%\security\templates\policies\gpt*.*
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF
SeBackupPrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeInteractiveLogonRight =
*S-1-5-21-1491778951-1156932096-3766891002-1551,IUSR_A
DAM2,*S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators,*S-1-5-32-550
SeRemoteShutdownPrivilege = *S-1-5-32-544,Server Operators
SeRestorePrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeShutdownPrivilege = *S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators
,*S-1-5-32-550
SeSystemTimePrivilege = *S-1-5-32-544,Server Operators
C:\>find /i "mapping" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy |
|
|
| Back to top |
|
|
jefwea
Guest
|
| Posted:
Fri Jan 28, 2005 2:07 am Post subject:
Re: event error 1202 from Scecli |
|
|
Steve,
The server operators group is indeed missing.
If I recreate it, it will not be a built in group but domain or global.
If I add it to the policy it will be listed as \\"domain"\server operator.
Will this fix the event error or do I have a bigger AD problem here?
I appreciate your suggestions.
Jeff
"Steven L Umbach" wrote:
| Quote: | I don't know what exactly is going on here but it might be interesting to
see what happens if you remove server operators from those user rights, use
gpupdate or gpedit as appropriate to refresh policy, then see if errors go
away and then add the server operators group back to see if that makes a
difference. Verify that server operators shows up in AD Users and Computers.
It should not be able to be deleted but I would check it out anyhow. ---
Steve
"jefwea" <jefwea@discussions.microsoft.com> wrote in message
news:11986AE7-5F19-424F-993C-374E126194D0@microsoft.com...
I am getting error 1202 in the event logs.
I have followed the instructions in the properties of the event as well as
in Q324383.
But can not seem to resolve.
When I look at the at the user rights for the server operater in the
default
domain controller policy, I cannot find any indication that there are
missing or unknown Sid's.
Does any one have a suggestion for this error.
Output logs are below.
Thanks for the help.
Jeff
C:\>find /I "cannot find" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
C:\>find /I "server operators"
%systemroot%\security\templates\policies\gpt*.*
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF
SeBackupPrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeInteractiveLogonRight =
*S-1-5-21-1491778951-1156932096-3766891002-1551,IUSR_A
DAM2,*S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators,*S-1-5-32-550
SeRemoteShutdownPrivilege = *S-1-5-32-544,Server Operators
SeRestorePrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeShutdownPrivilege = *S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators
,*S-1-5-32-550
SeSystemTimePrivilege = *S-1-5-32-544,Server Operators
C:\>find /i "mapping" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy
|
|
|
| Back to top |
|
|
Steven L Umbach
Guest
|
| Posted:
Fri Jan 28, 2005 2:05 pm Post subject:
Re: event error 1202 from Scecli |
|
|
Wow it is missing? I tried deleting it to see if I could and it would not
let me. If you create a group called server operators it will not be the
same obviously because the built in server operators group has a fixed sid
associated with it. If you do not need server operators group you can just
ignore the errors or they should go away if you remove server operators from
those user rights, but that is bizarre that it is missing. I did a quick
Google search for "missing server operators" and came up empty handed. I
would post about that in the active_directory group to see if anyone over
there has experienced such or has any further advice on what to do or what
caused it. An authoritative restore of Active Directory for just that group
from a System State backup may be one possibility. --- Steve
"jefwea" <jefwea@discussions.microsoft.com> wrote in message
news:5F9FFAF8-AA7E-49D6-AE44-29D4DA8E6B98@microsoft.com...
| Quote: | Steve,
The server operators group is indeed missing.
If I recreate it, it will not be a built in group but domain or global.
If I add it to the policy it will be listed as \\"domain"\server operator.
Will this fix the event error or do I have a bigger AD problem here?
I appreciate your suggestions.
Jeff
"Steven L Umbach" wrote:
I don't know what exactly is going on here but it might be interesting to
see what happens if you remove server operators from those user rights,
use
gpupdate or gpedit as appropriate to refresh policy, then see if errors
go
away and then add the server operators group back to see if that makes a
difference. Verify that server operators shows up in AD Users and
Computers.
It should not be able to be deleted but I would check it out anyhow. ---
Steve
"jefwea" <jefwea@discussions.microsoft.com> wrote in message
news:11986AE7-5F19-424F-993C-374E126194D0@microsoft.com...
I am getting error 1202 in the event logs.
I have followed the instructions in the properties of the event as well
as
in Q324383.
But can not seem to resolve.
When I look at the at the user rights for the server operater in the
default
domain controller policy, I cannot find any indication that there are
missing or unknown Sid's.
Does any one have a suggestion for this error.
Output logs are below.
Thanks for the help.
Jeff
C:\>find /I "cannot find" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
C:\>find /I "server operators"
%systemroot%\security\templates\policies\gpt*.*
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF
SeBackupPrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeInteractiveLogonRight =
*S-1-5-21-1491778951-1156932096-3766891002-1551,IUSR_A
DAM2,*S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators,*S-1-5-32-550
SeRemoteShutdownPrivilege = *S-1-5-32-544,Server Operators
SeRestorePrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeShutdownPrivilege = *S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators
,*S-1-5-32-550
SeSystemTimePrivilege = *S-1-5-32-544,Server Operators
C:\>find /i "mapping" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy
|
|
|
| Back to top |
|
|
jefwea
Guest
|
| Posted:
Fri Jan 28, 2005 8:11 pm Post subject:
Re: event error 1202 from Scecli |
|
|
Thanks for all your help.
I will post in the AD group.
"Steven L Umbach" wrote:
| Quote: | Wow it is missing? I tried deleting it to see if I could and it would not
let me. If you create a group called server operators it will not be the
same obviously because the built in server operators group has a fixed sid
associated with it. If you do not need server operators group you can just
ignore the errors or they should go away if you remove server operators from
those user rights, but that is bizarre that it is missing. I did a quick
Google search for "missing server operators" and came up empty handed. I
would post about that in the active_directory group to see if anyone over
there has experienced such or has any further advice on what to do or what
caused it. An authoritative restore of Active Directory for just that group
from a System State backup may be one possibility. --- Steve
"jefwea" <jefwea@discussions.microsoft.com> wrote in message
news:5F9FFAF8-AA7E-49D6-AE44-29D4DA8E6B98@microsoft.com...
Steve,
The server operators group is indeed missing.
If I recreate it, it will not be a built in group but domain or global.
If I add it to the policy it will be listed as \\"domain"\server operator.
Will this fix the event error or do I have a bigger AD problem here?
I appreciate your suggestions.
Jeff
"Steven L Umbach" wrote:
I don't know what exactly is going on here but it might be interesting to
see what happens if you remove server operators from those user rights,
use
gpupdate or gpedit as appropriate to refresh policy, then see if errors
go
away and then add the server operators group back to see if that makes a
difference. Verify that server operators shows up in AD Users and
Computers.
It should not be able to be deleted but I would check it out anyhow. ---
Steve
"jefwea" <jefwea@discussions.microsoft.com> wrote in message
news:11986AE7-5F19-424F-993C-374E126194D0@microsoft.com...
I am getting error 1202 in the event logs.
I have followed the instructions in the properties of the event as well
as
in Q324383.
But can not seem to resolve.
When I look at the at the user rights for the server operater in the
default
domain controller policy, I cannot find any indication that there are
missing or unknown Sid's.
Does any one have a suggestion for this error.
Output logs are below.
Thanks for the help.
Jeff
C:\>find /I "cannot find" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
Cannot find Server Operators.
C:\>find /I "server operators"
%systemroot%\security\templates\policies\gpt*.*
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM
---------- C:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF
SeBackupPrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeInteractiveLogonRight =
*S-1-5-21-1491778951-1156932096-3766891002-1551,IUSR_A
DAM2,*S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators,*S-1-5-32-550
SeRemoteShutdownPrivilege = *S-1-5-32-544,Server Operators
SeRestorePrivilege = *S-1-5-32-544,*S-1-5-32-551,Server Operators
SeShutdownPrivilege = *S-1-5-32-544,*S-1-5-32-551,*S-1-5-32-548,Server
Operators
,*S-1-5-32-550
SeSystemTimePrivilege = *S-1-5-32-544,Server Operators
C:\>find /i "mapping" %systemroot%\security\logs\winlogon.log
---------- C:\WINNT\SECURITY\LOGS\WINLOGON.LOG
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy
[Mapping] gpt00000.dom = Default Domain Policy
[Mapping] gpt00001.inf = Default Domain Controllers Policy
|
|
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in