Event 1202 every 5 minutes after removing IIS from a DC

  • Thread starter Thread starter Corbin O'Reilly
  • Start date Start date
C

Corbin O'Reilly

Hi. A predecessor of mine had IIS setup on a Windows 2000 Domain Controller.
I know that is not recommended. We uninstalled IIS and now we get an Event
1202 every 5 minutes in the Application Log on the domain controller. Here
is the error message:

Security policies are propagated with warning. 0x4b8 : An extended error has
occurred.

For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "Troubleshooting Event
1202s".

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Could someone please help me correct this problem? My theory is that a
domain account that no longer exists is being referenced in Group Policy.
Thanks for the help.
 
You should first turn up winlogon logging and reproduce the failure.
Location of the log file - %windir%\security\logs

Registry Location -
HKLM\Software\Microsoft\WindowsNT\CurrentVersion\WinLogon\GPExtensions\
{827D319E-6EAC-11D2-A4EA-00C04F79F83A

Registry Setting - Add the REG_DWORD value "ExtensionDebugLevel"
and set it to 0x2

This log contains additional info that may shed more light on the useless
1202s.
 
Thanks guys. It looks like the problem is fixed. An IWAM account that no
longer exists was referenced in the Domain Controller Policy. I removed the
reference and the Event 1202 alerts stopped.
 
Back
Top