some (definatly not all) XP SP2 clients are logging userenv 1030 and lsasrv
40961 errors in our 2003 SP1 AD domain.

All clients are subject to the same policies, which they all succesfully
enforce.
On the affected PC's the 1030 errors are mixed with seccli 1704 messages
stating the policy has been applied succesfully.
No servers are reporting errors.

I had a hunch it was a rogue time server on the network and have found that
when I run w32tm /monitor on one of the affected PC's I get the error:
GetDcList failed with error code:0x80070057. On one of the PC's that is
unaffected this command returns the domain controllers and their time
offsets.

this points to a problem with DNS, but all clients use the same DNS servers,
some clients return the domain controllers list and offsets, others do not.
time servers are set in group policy and all PC's have W32time 35 messages
reporting time is being syncronised with the correct time source (the PDC
emulator)


Any pointers?

EventID: 1030:
http://www.eventid.net/display.asp?eventid=1030&eventno=3275&source=SceCli&phase=1

1704 is an RPC error, which probably means you have DNS issues.  Check the
KBs mentioned in the above article and also check the DNS settings on a
working and non-working machine.  Also consider the possibility of a network
or firewall problem.

For more info. look at %systemroot%\debug\usermode\userenv.log on a good and
bad machine and google the errors.

NTP time syncronization
Creating a Lab Environment Using Virtual Machine
Internet Access group
Automatic workstation object removal
Is there an easy way to delete old computer name from ADUC?
SC.exe tool
Backup of Active Directory Integrated DNS zone
Active Directory Site And Services Problem between 2 DC
The target principal name is incorrect
Object Security