Re: Win2003SP1 DC loses all shares, roaming profiles cannot logon or logoff

Hello IconoclastX" iconoclastx at gmail dot com,

Did you upgrade to SP1 at the time when the errors starts?
If so check youir DNS server settings from your network card, that it points to the right DNS IP address.

For the 1058 and 1030 events look here:
http://support.microsoft.com/kb/842804/en-us

http://support.microsoft.com/kb/314494/en-us

http://support.microsoft.com/kb/839499/en-us

Best regards

myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.



Hi all,

This problem just popped up about three weeks ago. I have a
Windows 2003 Standard Domain Controller and a bunch of Windows XP SP2
clients. We run roaming profiles and redirected folders, and have a
handful of GPOs.

Every five minutes in the Application event log I have an
Information item (1704) that tells me "Security policy in the Group
policy objects has been applied successfully." That's not the
problem... I don't mind an event log full of Information items. I
mention this only to say that sometimes it will stop logging this
event. Of course I never notice this until a couple of hours later
when someone tries to logon or logoff. Other times the
5-minute-interval logging continues right up until...

I'll start getting the following errors:

1509
Source: Userenv
User: username
Windows cannot copy file \\dcname\profiles\username\ntuser.ini to
location
c:\documents and settings\username\ntuser.ini. Possible causes of
this
error include network problems or insufficient security rights. If
this
problem persists, contact your network administrator.
DETAIL - The specified network name is no longer available.
and

1515
Source: Userenv
Windows has backed up this user's profile [same user as above, btw].
Windows will automatically try ot use the backed up profile the next
time
this user logs on.
Those two are for a remote user. There are also these:

1058
Source: Userenv
User: NT AUTHORITY\SYSTEM
Windows cannot access the file gpt.ini for GPO
cn={blah}.cn=policies.cn=system.DC=domainname. The file must be
present at
the location \\domainname\sysvol\domainname\Policies\{blah}\gpt.ini.
(Configuration information could not be read from the domain
controller,
either because the machine is unavailable or access has been denied.).
Group Policy processing aborted.
1030
Source: Userenv
User: NT AUTHORITY\SYSTEM
Windows cannot query for the list of Group Policy objects. Check the
event
log for possible messages previously logged by the policy engine that
describes the reason for this.
1058 and 1030 are also logged when the Administrator tries to log in
locally to the domain controller.

If I happen to be logged in by RDP to the DC when this happens, I can
do anything I like on the server. There is no bandwidth issue, there
is no server resource issue, and locally everything is working like a
charm. The only thing that I cannot do is logoff (thus a polite
shutdown is nigh impossible) and I cannot access "network" shares that
come as part of the administrator logon script. I cannot access
shares that are physically located on the same computer. I can access
the drives locally, by drive letter, just fine.

This will happen out of nowhere, at various times of day or night,
never right after some other event (as far as I can tell), and I am
unable to determine if there is something else happening that might be
causing it. All services that are set to automatically run are started
when this is happening.

I am somewhat suspicious of my Symantec AV which is also running
(server) on the DC. I have had nothing but trouble with this piece of
crap since they moved to version 9 (now a couple of subversions into
10).

I've checked for any weird issues relating to windows updates that
might have occurred around the time that this started, but I haven't
found anything recent. There was some issue with permissions on
important directories, but that was with an update that was issued
(and applied to our server) in June/July.

Does anyone have any thoughts on what might be causing this? I would
be eternally grateful.



.