J
Jon Martin
Folks,
Lots of posts around here about people getting the USERENV 1000 and
SCECLI 1001 event IDs for various reasons. My story differs a bit, but
the event IDs generated are the same.
In our environment only a few member servers are getting these two
event IDs. What distinguishes these servers from other member servers
and garden-variety workstations is that a security template that I
created was applied locally to the member server (in other words, not
applied through group policy). The strange part here is that these
events started occurring the day we applied the patch for the Blaster
worm (Q823980). We applied the patch to all DCs, member servers and
workstations. Only those member servers with the locally applied
security template are showing the 1000 & 1001 events. (A check shows
that all locally applied security policies are in place.) Prior to the
patch there were no such event IDs.
Weird . . .
Lots of posts around here about people getting the USERENV 1000 and
SCECLI 1001 event IDs for various reasons. My story differs a bit, but
the event IDs generated are the same.
In our environment only a few member servers are getting these two
event IDs. What distinguishes these servers from other member servers
and garden-variety workstations is that a security template that I
created was applied locally to the member server (in other words, not
applied through group policy). The strange part here is that these
events started occurring the day we applied the patch for the Blaster
worm (Q823980). We applied the patch to all DCs, member servers and
workstations. Only those member servers with the locally applied
security template are showing the 1000 & 1001 events. (A check shows
that all locally applied security policies are in place.) Prior to the
patch there were no such event IDs.
Weird . . .