Event ID 1058 & 1030 Error

25 Jun 2009 9:19 AM

Libyan_SA

hello everyone
i'm haveing a little problem here
i did check the event log, and i found this error,

=====
i did take a print screen for the error

[image: http://i44.tinypic.com/1555kw5.jpg]

[image: http://i43.tinypic.com/2nqyzw7.jpg]

=====

Event Type:    Error
Event Source:    Userenv
Event Category:    None
Event ID:    1030
Date:        6/25/2009
Time:        10:30:38 AM
User:        CICL\amna.gurpaj
Computer:    PRODAD2
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

=========================================================

Event Type:    Error
Event Source:    Userenv
Event Category:    None
Event ID:    1058
Date:        6/25/2009
Time:        10:30:38 AM
User:        CICL\amna.gurpaj
Computer:    PRODAD2
Description:
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=cicl,DC=local. The file must be present at the location <\\cicl.local\sysvol\cicl.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Logon failure: unknown user name or bad password. ). Group Policy processing aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

==========================================================

im getting this error from 15th of june , so its 10 days now,
can any one give me any help ???? -- Libyan_SA ------------------------------------------------------------------------ Libyan_SA's Profile: http://forums.techarena.in/members/108693.htm View this thread: http://forums.techarena.in/active-directory/1203247.htm http://forums.techarena.in

25 Jun 2009 10:24 AM

Meinolf Weber [MVP-DS]

Hello Libyan_SA,

What OS version are you using? Is that on a server or workstation? Please
post an unedited ipconfig /all from the machine and your DNS server, so we
can exclude DNS as a problem. Is the machine multihomed?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

Show quoteHide quote

> hello everyone
> i'm haveing a little problem here
> i did check the event log, and i found this error,
> =====
> i did take a print screen for the error
> [image: http://i44.tinypic.com/1555kw5.jpg]
>
> [image: http://i43.tinypic.com/2nqyzw7.jpg]
>
> =====
>
> Event Type:    Error
> Event Source:    Userenv
> Event Category:    None
> Event ID:    1030
> Date:        6/25/2009
> Time:        10:30:38 AM
> User:        CICL\amna.gurpaj
> Computer:    PRODAD2
> Description:
> Windows cannot query for the list of Group Policy objects. Check the
> event log for possible messages previously logged by the policy engine
> that describes the reason for this.
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> =========================================================
>
> Event Type:    Error
> Event Source:    Userenv
> Event Category:    None
> Event ID:    1058
> Date:        6/25/2009
> Time:        10:30:38 AM
> User:        CICL\amna.gurpaj
> Computer:    PRODAD2
> Description:
> Windows cannot access the file gpt.ini for GPO
> CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=cic
> l,DC=local.
> The file must be present at the location
> <\\cicl.local\sysvol\cicl.local\Policies\{31B2F340-016D-11D2-945F-00C0
> 4FB984F9}\gpt.ini>.
> (Logon failure: unknown user name or bad password. ). Group Policy
> processing aborted.
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> ==========================================================
>
> im getting this error from 15th of june , so its 10 days now, can any
> one give me any help ????
>
> http://forums.techarena.in
>

25 Jun 2009 10:36 AM

sharath_bujji

Hi,

This issue sometimes occur when there is an absence of authenticated
connectivity from the computer to the domain controller.

Try ipconfig /registerdns on the machine...as a first step and see how it
goes.

And, was there any change implemented 10 days earlier??

Go through the link below and pick the appropriate resolution to your case,
http://eventid.net/display.asp?eventid=1058&eventno=1752&source=Userenv&phase=1

Regards,
Sharath

Show quoteHide quote

"Libyan_SA" wrote:

>
> hello everyone
> i'm haveing a little problem here
> i did check the event log, and i found this error,
>
> =====
> i did take a print screen for the error
>
> [image: http://i44.tinypic.com/1555kw5.jpg]
>
> [image: http://i43.tinypic.com/2nqyzw7.jpg]
>
> =====
>
> Event Type:    Error
> Event Source:    Userenv
> Event Category:    None
> Event ID:    1030
> Date:        6/25/2009
> Time:        10:30:38 AM
> User:        CICL\amna.gurpaj
> Computer:    PRODAD2
> Description:
> Windows cannot query for the list of Group Policy objects. Check the
> event log for possible messages previously logged by the policy engine
> that describes the reason for this.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> =========================================================
>
>
> Event Type:    Error
> Event Source:    Userenv
> Event Category:    None
> Event ID:    1058
> Date:        6/25/2009
> Time:        10:30:38 AM
> User:        CICL\amna.gurpaj
> Computer:    PRODAD2
> Description:
> Windows cannot access the file gpt.ini for GPO
> CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=cicl,DC=local.
> The file must be present at the location
> <\\cicl.local\sysvol\cicl.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>.
> (Logon failure: unknown user name or bad password. ). Group Policy
> processing aborted.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> ==========================================================
>
>
> im getting this error from 15th of june , so its 10 days now,
> can any one give me any help ????
>
>
> --
> Libyan_SA
> ------------------------------------------------------------------------
> Libyan_SA's Profile: http://forums.techarena.in/members/108693.htm
> View this thread: http://forums.techarena.in/active-directory/1203247.htm
>
> http://forums.techarena.in
>
>

25 Jun 2009 3:16 PM

Libyan_SA

im runing Windows 2003 server, and that error was on the event log from the server, i dont have much details yet, because today is my second day at this job and the previews system administrator just left without any notice and i came to replace him and still not used with the system here, and now im not at the office, next sunday i will be there and i will check all what you did asked and i will replay you here.

we are running 16 server there and i just did check 5 of them today and i found this error be4 i leave by 10 min , so that is why i post it in here,

about changing on the implementation, i have no idea, as i said be4 , the previews system administrator did left without any notice, and now im stuck with this. -- Libyan_SA ------------------------------------------------------------------------ Libyan_SA's Profile: http://forums.techarena.in/members/108693.htm View this thread: http://forums.techarena.in/active-directory/1203247.htm http://forums.techarena.in

30 Jun 2009 10:04 PM

JustaDA

Having the same issue here. I have noticed that every other 1058 error (Access denied, The system cannot find the path specified, etc) is not using my user name, but has SYSTEM listed instead. Started getting these new errors with "Logon failure: unknown user name or bad password" as the error a day after I changed my account password. Any suggestions as why this is attempting to my credentials? -- JustaDA ------------------------------------------------------------------------ JustaDA's Profile: http://forums.techarena.in/members/110299.htm View this thread: http://forums.techarena.in/active-directory/1203247.htm http://forums.techarena.in

30 Jun 2009 11:35 PM

Ace Fekay [Microsoft Certified Trainer]

In news:JustaDA.3um73b@DoNotSpam.com,

JustaDA <JustaDA.3um73b@DoNotSpam.com>, posted the following, which I replied to down below...: Hello JustaDA

> Having the same issue here. I have noticed that every other 1058
> error (Access denied, The system cannot find the path specified, etc)
> is not using my user name, but has SYSTEM listed instead. Started
> getting these new errors with "Logon failure: unknown user name or
> bad password" as the error a day after I changed my account password.
> Any suggestions as why this is attempting to my credentials?

After you changed your password, did you logoff and on again?

Ace

1 Jul 2009 2:23 AM

JustaDA

Yes I have logged off and on, many times actually. It is odd, because as an DA, this is happening on only one DC that I manage (I manage a handful of DCs). Another DA that I work with is having the same thing. He also changed his password the day before he started getting the errors. Happening to the both of us, on only 1 DC each. Wondering if somewhere our credentials (with our old passwords) are being cached in the system somewhere? I don't know what credentials a DC normally uses to access the SYSVOL share. I don't think the system should be using our credentials to access this. Also, we can log onto the servers with our new passwords just fine. -- JustaDA ------------------------------------------------------------------------ JustaDA's Profile: http://forums.techarena.in/members/110299.htm View this thread: http://forums.techarena.in/active-directory/1203247.htm http://forums.techarena.in

1 Jul 2009 3:39 AM

Ace Fekay [Microsoft Certified Trainer]

In news:JustaDA.3umkzc@DoNotSpam.com,

JustaDA <JustaDA.3umkzc@DoNotSpam.com>, posted the following, which I replied to down below...: Hello JustaDA

> Yes I have logged off and on, many times actually. It is odd, because
> as an DA, this is happening on only one DC that I manage (I manage a
> handful of DCs). Another DA that I work with is having the same
> thing. He also changed his password the day before he started getting
> the errors. Happening to the both of us, on only 1 DC each.
> Wondering if somewhere our credentials (with our old passwords) are
> being cached in the system somewhere? I don't know what credentials
> a DC normally uses to access the SYSVOL share. I don't think the
> system should be using our credentials to access this. Also, we can
> log onto the servers with our new passwords just fine.

It will use the logged on account credentials. I assume you've also tried restarting it.

Can the default domain administrator or the enterprise administrator account logon to it? It's starting to sound like replication may be failing on it because it may not have got the password change replicated to it. Can you logon to another DC and using computer management, connect to this machine and check the Event logs?

Ace

1 Jul 2009 5:21 AM

Meinolf Weber [MVP-DS]

Hello Libyan_SA,

Please post the output from an uneidted ipconfig /all so we can exclude DNS
as a problem.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

Show quoteHide quote

> im runing Windows 2003 server, and that error was on the event log
> from the server, i dont have much details yet, because today is my
> second day at this job and the previews system administrator just
> left without any notice and i came to replace him and still not used
> with the system here, and now im not at the office, next sunday i will
> be there and i will check all what you did asked and i will replay you
> here.
>
> we are running 16 server there and i just did check 5 of them today
> and i found this error be4 i leave by 10 min , so that is why i post
> it in here,
>
> about changing on the implementation, i have no idea, as i said be4 ,
> the previews system administrator did left without any notice, and now
> im stuck with this.
>
> http://forums.techarena.in
>

1 Jul 2009 2:12 PM

JustaDA

Thanks for replying so promptly Ace. All EA's and DA's are able to log onto the DC with no problem. I have manually initiated replication, and it says it was successful. So we can log on and check the event logs. Anything in particular that I should be looking for there? -- JustaDA ------------------------------------------------------------------------ JustaDA's Profile: http://forums.techarena.in/members/110299.htm View this thread: http://forums.techarena.in/active-directory/1203247.htm http://forums.techarena.in

2 Jul 2009 12:38 AM

Ace Fekay [Microsoft Certified Trainer]

In news:JustaDA.3unfjc@DoNotSpam.com,

JustaDA <JustaDA.3unfjc@DoNotSpam.com>, posted the following, which I replied to down below...: Hello JustaDA

> Thanks for replying so promptly Ace. All EA's and DA's are able to
> log onto the DC with no problem. I have manually initiated
> replication, and it says it was successful. So we can log on and
> check the event logs. Anything in particular that I should be looking
> for there?

Errors in any of the logs, other than the 1030s and 1058s. . Please post them. Also Meinolf asked for an unedited ipconfig /all. Can we see that as well, please?

So if the DA and the EAs are able to logon, do they see the errors, too?

Ace

6 Jul 2009 9:31 PM

JustaDA

Ace, found out that the GPO was owned by an "Unknown user," someone that had been removed from AD. Changed the owner of the GPO, pushed replication, rebooted, and it has been cleared up. Thanks for the assistance. -- JustaDA ------------------------------------------------------------------------ JustaDA's Profile: http://forums.techarena.in/members/110299.htm View this thread: http://forums.techarena.in/active-directory/1203247.htm http://forums.techarena.in

7 Jul 2009 1:14 AM

Ace Fekay [Microsoft Certified Trainer]

"JustaDA" <JustaDA.3uxb3b@DoNotSpam.com> wrote in message news:JustaDA.3uxb3b@DoNotSpam.com...
>
> Ace, found out that the GPO was owned by an "Unknown user," someone that
> had been removed from AD. Changed the owner of the GPO, pushed
> replication, rebooted, and it has been cleared up. Thanks for the
> assistance.
>

Interesting. I have to keep that in mind as a possible cause for any future posts with these errors.

Glad you figured that out!!

Ace

25 Jun 2009 3:01 PM

Ace Fekay [Microsoft Certified Trainer]

Show quote Hide quote

"Libyan_SA" <Libyan_SA.3ubxnc@DoNotSpam.com> wrote in message
news:Libyan_SA.3ubxnc@DoNotSpam.com...
>
> hello everyone
> i'm haveing a little problem here
> i did check the event log, and i found this error,
>
> =====
> i did take a print screen for the error
>
> [image: http://i44.tinypic.com/1555kw5.jpg]
>
> [image: http://i43.tinypic.com/2nqyzw7.jpg]
>
> =====
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1030
> Date: 6/25/2009
> Time: 10:30:38 AM
> User: CICL\amna.gurpaj
> Computer: PRODAD2
> Description:
> Windows cannot query for the list of Group Policy objects. Check the
> event log for possible messages previously logged by the policy engine
> that describes the reason for this.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> =========================================================
>
>
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1058
> Date: 6/25/2009
> Time: 10:30:38 AM
> User: CICL\amna.gurpaj
> Computer: PRODAD2
> Description:
> Windows cannot access the file gpt.ini for GPO
> CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=cicl,DC=local.
> The file must be present at the location
> <\\cicl.local\sysvol\cicl.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>.
> (Logon failure: unknown user name or bad password. ). Group Policy
> processing aborted.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> ==========================================================
>
>
> im getting this error from 15th of june , so its 10 days now,
> can any one give me any help ????

Hello Libyan_SA,

I agree with Meinolf regarding seeing an unedited ipconfig /all from two of
your DCs and one from the desktop this is occuring on.

There are a number of things that can cause this, but the main thing that
may be the reason is mis-configured DNS and/or the DC is either multihomed,
of the AD DNS domain name is a single label name. The ipconfigs will help.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup/forum to benefit from collaboration among
responding engineers, as well as to help others benefit from your
resolution.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
ace***@mvps.RemoveThisPart.org
http://twitter.com/acefekay

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.