Re: Security policies are propagated with warning. 0xd : The data is invalid.

I'm looking at this purely from the security policy perspective. The
Userenv.log error is also troublesome but I'm unsure why it would be
surfacing. More context from userenv might be required.

If the env vars are set, the next thing I would to is to start looking
through the GPO security templates and find the one configuring those
settings. It's possible that the line where they are defined is malformed
causing you to get this error. The lines for the file security section are
formed like this:
"<FileName>",<InheritancePropagationType>,"<SDDL>"
The propagation type can be 0, 1, or 2. Also, if the SDDL is longer than
512 chars, it will be broken up into additional fields. You could probably
script the search by using "secedit /validate" to find the problematic
template in the DC's %windir%\security\templates\policies. Once found,
there's a GUID in the template that identifies which GPO it came from. The
template has to be located locally for secedit to work.

N

--
This posting is provided "AS IS" with no warranties, and confers no rights.
Any opinions or policies stated within are my own and do not necessarily
constitute those of my employer. Use of included script samples are subject
to the terms specified at http://www.microsoft.com/info/cpyright.htm


"DK1088" <anonymous@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:0fd501c536bf$919cc130$a401280a@xxxxxxxxxx
>
> To follow up the responses:
>
> Nick - The environment variables are set, as per the KB
> article that covered that previously mentioned.
>
> Ptwilliams - Permissions on the Sysvol are correct (I've
> even compared them to other installed DC's that are not
> here to make sure).
>
> Brandon - I suspect a Bascidc.inf was imported into the
> policy, from what little information I have been given,
> but am unsure how to correct that. AD and GPO settings
> are replicating and applying normally (I've created new
> GPO's just to test this), so nothing 'appears' to be
> impacted, but this 5-minute warning is very annoying, and
> I would like to resolve to have piece of mind for myself
> and others. (And no, no groups with special permissions
> for security logs).
>
> Thanks all!
>


.

Relevant Pages

  • Re: security template file import
    ... gpttmpl.inf in the secedit folder of the GPO file system folder ... > in here is a single file - GPTTMPL.INF that lists the securtiy settings ... > as i can see is a copy of an imported security settings file) - is this ... >> template outside of the GPO which you edit to contain all the security ...
    (microsoft.public.win2000.security)
  • Re: security template file import
    ... one final and very specific issue on security / GPO. ... the observed behaviour when using an imported security template is that we ... When policy propagated it would just ...
    (microsoft.public.win2000.security)
  • Re: security template file import
    ... i sort a little more comfortable going through the reimport of the security ... in here is a single file - GPTTMPL.INF that lists the securtiy settings (and ... when the DC as a group policy client downloads the GPO it sticks the ... > template outside of the GPO which you edit to contain all the security ...
    (microsoft.public.win2000.security)
  • Re: security template file import
    ... one of the more "well documented" features of the GPO based security policy. ... modify the security template - ...
    (microsoft.public.win2000.security)
  • Re: Installer and Security
    ... you have to import the template into a security database before you ... I think SECEDIT will also import the template to a database too, ... unless you find and run the ADMINPAK.MSI file to install the extra MMCs]. ...
    (microsoft.public.win2000.security)