Event ID 1001 & 1002 & the Blaster Fix

  • Thread starter Thread starter Jon Martin
  • Start date Start date
J

Jon Martin

Folks,

Lots of posts around here about people getting the USERENV 1000 and
SCECLI 1001 event IDs for various reasons. My story differs a bit, but
the event IDs generated are the same.

In our environment only a few member servers are getting these two
event IDs. What distinguishes these servers from other member servers
and garden-variety workstations is that a security template that I
created was applied locally to the member server (in other words, not
applied through group policy). The strange part here is that these
events started occurring the day we applied the patch for the Blaster
worm (Q823980). We applied the patch to all DCs, member servers and
workstations. Only those member servers with the locally applied
security template are showing the 1000 & 1001 events. (A check shows
that all locally applied security policies are in place.) Prior to the
patch there were no such event IDs.

Weird . . .
 
Jimmy,

Thanks for the reply. I've seen this Q doc and a number of others that
address these event IDs, but they do not seem to address my situation.
For instance, the one you pointed me to concerns these events
happening on DCs. My DCs are not having these events, just a few
handful of member servers that had my custom security template applied
locally. A couple of thousand other member servers and workstations
are not generating these events.
 
Back
Top