Re: Event ID 1202

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance


The Authenticated user group is a Special Identities, which doesn't exist
and as such you can't control the membership. Check the following article
for more information:
http://technet2.microsoft.com/WindowsServer/f/?en/library/6375943b-1089-4ec5-9b2d-823b884ec1ec1033.mspx

The errors you have are two different things. The first 1058, is caused
because the GPO processing can't access the gpt.ini. First check the
permissions on file and make sure the station\user has permissions to read
the file. I have seen a similar problem caused by the file being locked by
another station. Use station management to check if this file has been held
open.

The second problem is not related to the first. I think you are on the right
track, check that your policy is not trying to set or configure the contents
of the Authenticated users group.

I hope this helps
Gary.


"Jeff" <Jeff@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6FF4BA59-1EE9-4D06-A0C3-6BCF23C6FBD7@xxxxxxxxxxxxxxxx
For some reason my client workstations can no longer access group policy.
Here is the event log application error message:

Event ID: 1058
Source: Userenv
Windows cannot access the file gpt.ini for GPO
cn={CA3E9EAE-FD06-4B8D-9D5A-E2159B4BD0E3},cn=policies,cn=system,DC=pai,DC=com.
The file must be present at the location
<\\pai.com\SysVol\pai.com\Policies\{CA3E9EAE-FD06-4B8D-9D5A-E2159B4BD0E3}\gpt.ini>.
(Access is denied. ). Group Policy processing aborted.

So I check my domain controller and this error is listed:

Event ID: 1202
Source: SceCLI
Security policies are propagated with warning. 0x534 : No mapping between
account names and security IDs was done.

As I investigate this issue, I run the FIND /I "Cannot Find" c:\winnt\....
and it returns the Authenticated User as the account that it cannot find.
After running the FIND /I "Mapping" command it returns the
seChangeNotifyPrivilage which I believe is the ByPass Traverse Checking.
The
Authenticated account has this privilage on the dc.

Here is a stupid question, but should there be a Authenticated User
account
in Users and Computers? I can't seem to find the group. And would this be
the
reason for the errors? Can I create an Authenticated Users group? I don't
know if this account was accidently deleted.

THanks





.

Relevant Pages

  • Re: Event ID 1202
    ... Make sure that you have permissions to access that gpt.ini file, ... The Authenticated user group is a Special Identities, ... and it returns the Authenticated User as the account that it cannot find. ... Can I create an Authenticated Users group? ...
    (microsoft.public.windows.group_policy)
  • Re: User authentication
    ... and insert Authenticated user set. ... authentication and i want to track user activities in report. ... user account how to add it to become authenticated users group? ...
    (microsoft.public.isa.configuration)
  • Re: NTFS Permissions with Authenticated User VS KDC (Kerboros question)
    ... At login via Kerberos the account gets a TGT ... Now, when that account attempts to access a resource, if that resource ... is copied into the service ticket and extended with added information ... server with authenticated user NTFS permission. ...
    (microsoft.public.windows.server.security)
  • Re: File/Printer Sharing problem
    ... It used to work when I got the laptop and originally set it up. ... For me, there were two accounts, Authenticated User that I like to use on shares that had full access rights on the share and the Everyone User that was deleted off the share with all other accounts except for the Authenticated User not being deleted when you take the path of right-clicking a folder selecting Properties and the Security Tab. ... With the Share Permission button path, the Everyone group was still there and the account had read only access that overrode the Authenticated User account. ... I did that with my wireless network when I was into wireless in case my wireless was hacked with someone joining my network and being all over the top of my machines. ...
    (alt.internet.wireless)
  • Re: Account Privacy
    ... what is the best way to make an account so ... > Remove all the "read" security permissions set on the Authenticated Users ... Can we just delete the Authenticated Users group ...
    (microsoft.public.windows.server.active_directory)