Prev: Operation terminated with error -1808 (JET_errDiskFull, No space l
Next: MSExchangeActiveSyncNotify
From: jason on 28 Jul 2006 13:28
Hi all,
I've been getting the following errors on all the PCs on the SBS2003
network:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1053
Date: 7/21/2006
Time: 9:28:20 PM
User: NT AUTHORITY\SYSTEM
Computer: PC12
Description:
Windows cannot determine the user or computer name. (The specified domain
either does not exist or could not be contacted. ). Group Policy processing
aborted.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I can't remember where, but I read a suggestion to create a userenv.log
(\windows\debug\usermode) through the registry. This is what I get out of
that log:
USERENV(2ce8.1808) 13:19:04:806 InitializePolicyProcessing: Initialised
Machine Mutex/Events
USERENV(2ce8.1808) 13:19:04:806 InitializePolicyProcessing: Initialised User
Mutex/Events
USERENV(2ce8.1808) 13:19:04:806 LibMain: Process Name:
\??\C:\WINDOWS\system32\winlogon.exe
USERENV(1b38.1878) 13:19:23:618 LibMain: Process Name:
C:\WINDOWS\system32\mmc.exe
USERENV(1b38.1878) 13:19:23:618 GetProfileType: Profile already loaded.
USERENV(1b38.1878) 13:19:23:634 GetProfileType: ProfileFlags is 0
USERENV(1498.2390) 13:19:38:899 ImpersonateUser: Failed to impersonate user
with 5.
USERENV(1498.2390) 13:19:38:899 GetUserNameAndDomain Failed to impersonate
user
USERENV(1498.2390) 13:19:38:915 ImpersonateUser: Failed to impersonate user
with 5.
USERENV(1498.2390) 13:19:38:915 GetUserDNSDomainName: Failed to impersonate
user
USERENV(1498.2390) 13:19:38:915 ImpersonateUser: Failed to impersonate user
with 5.
USERENV(1498.2390) 13:19:38:915 GetUserNameAndDomain Failed to impersonate
user
USERENV(1498.2390) 13:19:38:915 ImpersonateUser: Failed to impersonate user
with 5.
USERENV(1498.2390) 13:19:38:915 GetUserDNSDomainName: Failed to impersonate
user

Does anybody have any ideas what is going on here?
Thanks.
Jason



From: jcbrown on 28 Jul 2006 16:29
Without deciphering the usermode debug log, I can only suggest
verifying the two things that have best helped with event 1053.

1. that the PCs use exclusively the SBS server for DNS
2. that the PCs are joined to the full domain name, i.e. 'domain.local'
and not just 'domain'





jason wrote:
> Hi all,
> I've been getting the following errors on all the PCs on the SBS2003
> network:
> Event Type: Error
> Event Source: Userenv
> Event Category: None
> Event ID: 1053
> Date: 7/21/2006
> Time: 9:28:20 PM
> User: NT AUTHORITY\SYSTEM
> Computer: PC12
> Description:
> Windows cannot determine the user or computer name. (The specified domain
> either does not exist or could not be contacted. ). Group Policy processing
> aborted.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> I can't remember where, but I read a suggestion to create a userenv.log
> (\windows\debug\usermode) through the registry. This is what I get out of
> that log:
> USERENV(2ce8.1808) 13:19:04:806 InitializePolicyProcessing: Initialised
> Machine Mutex/Events
> USERENV(2ce8.1808) 13:19:04:806 InitializePolicyProcessing: Initialised User
> Mutex/Events
> USERENV(2ce8.1808) 13:19:04:806 LibMain: Process Name:
> \??\C:\WINDOWS\system32\winlogon.exe
> USERENV(1b38.1878) 13:19:23:618 LibMain: Process Name:
> C:\WINDOWS\system32\mmc.exe
> USERENV(1b38.1878) 13:19:23:618 GetProfileType: Profile already loaded.
> USERENV(1b38.1878) 13:19:23:634 GetProfileType: ProfileFlags is 0
> USERENV(1498.2390) 13:19:38:899 ImpersonateUser: Failed to impersonate user
> with 5.
> USERENV(1498.2390) 13:19:38:899 GetUserNameAndDomain Failed to impersonate
> user
> USERENV(1498.2390) 13:19:38:915 ImpersonateUser: Failed to impersonate user
> with 5.
> USERENV(1498.2390) 13:19:38:915 GetUserDNSDomainName: Failed to impersonate
> user
> USERENV(1498.2390) 13:19:38:915 ImpersonateUser: Failed to impersonate user
> with 5.
> USERENV(1498.2390) 13:19:38:915 GetUserNameAndDomain Failed to impersonate
> user
> USERENV(1498.2390) 13:19:38:915 ImpersonateUser: Failed to impersonate user
> with 5.
> USERENV(1498.2390) 13:19:38:915 GetUserDNSDomainName: Failed to impersonate
> user
>
> Does anybody have any ideas what is going on here?
> Thanks.
> Jason

From: Steven Zhu [MSFT] on 31 Jul 2006 01:37
Hi Jason,

Thanks for posting here.

From your post, my understanding on this issue is: you get Event 1053 error
message in Event Viewer. If I am off base, please feel free to let me know.

Based on my research, the event ID 1053 issue may occur if you have account
names that use non-ASCII characters. Windows 2000 Server and Windows Server
2003 do not distinguish between non-ASCII and ASCII characters in account
names. To resolve this issue, you must either delete or rename the
conflicting accounts.

Also, please ensure that the appropriate groups are listed in the "Access
this Computer from the Network" permission. You can find this permission in
the following folder:

Computer Configuration\Windows Settings\Security Settings\Local
Policies\User Rights Assignment

The following groups have the "Access this Computer from the Network"
permission on domain controllers by default:

-Administrators
-Authenticated Users
-Everyone

Following are some useful Microsoft Knowledge Base articles for your
reference:

Event ID 1053 and 1058 appear in the Application log after you upgrade to
Windows 2000 Server or Windows Server 2003 with Active Directory
http://support.microsoft.com/?id=883271

Lookup of Permissions on ACLs Shows Only SIDs
http://support.microsoft.com/?id=262958

If the issue still persists, please collect some additional information for
my further research:

1. Have you performed some specific operation before discovering the issue?

2. What''s the detailed symptom of the specific issue except for the event
mentioned in the post?

3. Does the issue occur when using a specific user account or every use
account in your domain?
Please try the suggestions above and let me know the results at your
earliest convenience. If anything in my response is unclear or you need
further help, don''t hesitate to post back.

Thank you for your time and cooperation.

Have a nice day.

Best Regards,

Steven Zhu
MCSE
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
======================================================
PLEASE NOTE the newsgroup SECURE CODE and PASSWORD were
updated on February 14, 2006.? Please complete a re-registration process
by entering the secure code mmpng06 when prompted. Once you have
entered the secure code mmpng06, you will be able to update your profile
and access the partner newsgroups.
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
======================================================







From: jason on 31 Jul 2006 11:55
Thanks for the suggestions, Steven.

I followed those steps and still have the same issues.
> 1. Have you performed some specific operation before discovering the
> issue?
It's been hapenning for a long time, but I don't recall a certain event
before the issue started to show up.
> 2. What''s the detailed symptom of the specific issue except for the event
> mentioned in the post?
Not sure what you mean, but on this particular PC, I get a lot of other
errors I'll post below.

> 3. Does the issue occur when using a specific user account or every use
> account in your domain?
This issue is mostly with one PC, although it ocassionally happens on other
PCs. On the workstation with the most occurrences, it happens anywhere
between 1 and every three hours.

Not sure if they are related, but here are some other errors I'm getting on
that workstation:
Event Type: Warning
Event Source: Print
Event Category: None
Event ID: 20
Date: 7/31/2006
Time: 11:41:01 AM
User: NT AUTHORITY\SYSTEM
Computer: PC9
Description:
Printer Driver Lexmark Z700-P700 Series for Windows NT x86 Version-3 was
added or updated. Files:- LXBLDR5C.DLL, LXBLUI5C.DLL, LXBLUI5C.DLL,
LXBLDRV.HLP, LXBLUN5C.EXE, LXBLUNRS.DLL, LXBLFC5C.DLL, LXBLICUR.DLL,
LXBLCLR1.DLL, LXBLCLR2.DLL, LXBLCLR3.DLL, LXBLSTRN.DLL, LXBLLPA.HLP,
LXBLNOTE.HLP, LXBLDRV.CNT, LXBLLPA.CNT, LXBLMA.CNT, CONTACT.HTM,
LXBLJSWX.EXE, LXBLPSWX.EXE, LXBLJSW.DLL, LXBLJSWR.DLL, LXBLLPA.DLL,
LXBLLPAR.DLL, LXBLPRP.DLL, LXBLPRPR.DLL, LXBLPSW.DLL, LXBLPSWR.DLL,
LXBLUTIL.DLL, LXBLUPD.DLL, LXBLUPDR.DLL, LXBLPP5C.DLL, LEXEDF.DLL,
lexgo.EXE, LXBLAUAL.OUT, LXBLMCAL.OUT, LXBLCAU.OUT, LXBLKAU.OUT,
LXBLPHAU.OUT, LXBLCLN.OUT, LXBLCALN.OUT, LXBLKALN.OUT, LXBLALGN.OUT,
LXBLPHCL.OUT, LXBLPHAL.OUT, lxblsply.htm, lxbllegl.htm, lxblsk0.dll,
lxblsk1.dll, lxblsk2.dll, license.txt, lexwww.htm, ptzipw32.dll, WAVS.EXE,
duplex1.prn, duplex2.prn, LXBLGF.DLL, lxblrme.doc, lxblweb.exe, HLP256.DLL,
LEXBCE.DLL, LEXBCES.EXE, lexlmpm.dll, LEXPPS.EXE, LEXP2P32.DLL,
LEX2KUSB.DLL, lxblcomm.dll, lxblw2k.ini, lexdrvin.exe, lxblver.web,
lxblpwr.dll, LXBLPMNT.DLL, LXBLLCNT.DLL, LXBLLCNP.DLL, LXBLLSNT.EXE,
LXBLIH.EXE, LXBL.LOC, LXBLCFG.EXE, LXBLCU.DLL, LXBLCUR.DLL, LEXPING.EXE,
INSTMON.EXE, lxblvs.dll.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Warning
Event Source: LSASRV
Event Category: (3)
Event ID: 40961
Date: 7/31/2006
Time: 11:38:40 AM
User: N/A
Computer: PC9
Description:
The Security System could not establish a secured connection with the server
ldap/DELLSERVER.ASM.local/ASM.local(a)ASM.local. No authentication protocol
was available.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Any ideas?
Thanks.


"Steven Zhu [MSFT]" <v-stezhu(a)online.microsoft.com> wrote in message
news:PzHmmNGtGHA.2004(a)TK2MSFTNGXA01.phx.gbl...
> Hi Jason,
>
> Thanks for posting here.
>
> From your post, my understanding on this issue is: you get Event 1053
> error
> message in Event Viewer. If I am off base, please feel free to let me
> know.
>
> Based on my research, the event ID 1053 issue may occur if you have
> account
> names that use non-ASCII characters. Windows 2000 Server and Windows
> Server
> 2003 do not distinguish between non-ASCII and ASCII characters in account
> names. To resolve this issue, you must either delete or rename the
> conflicting accounts.
>
> Also, please ensure that the appropriate groups are listed in the "Access
> this Computer from the Network" permission. You can find this permission
> in
> the following folder:
>
> Computer Configuration\Windows Settings\Security Settings\Local
> Policies\User Rights Assignment
>
> The following groups have the "Access this Computer from the Network"
> permission on domain controllers by default:
>
> -Administrators
> -Authenticated Users
> -Everyone
>
> Following are some useful Microsoft Knowledge Base articles for your
> reference:
>
> Event ID 1053 and 1058 appear in the Application log after you upgrade to
> Windows 2000 Server or Windows Server 2003 with Active Directory
> http://support.microsoft.com/?id=883271
>
> Lookup of Permissions on ACLs Shows Only SIDs
> http://support.microsoft.com/?id=262958
>
> If the issue still persists, please collect some additional information
> for
> my further research:
>
> 1. Have you performed some specific operation before discovering the
> issue?
>
> 2. What''s the detailed symptom of the specific issue except for the event
> mentioned in the post?
>
> 3. Does the issue occur when using a specific user account or every use
> account in your domain?
> Please try the suggestions above and let me know the results at your
> earliest convenience. If anything in my response is unclear or you need
> further help, don''t hesitate to post back.
>
> Thank you for your time and cooperation.
>
> Have a nice day.
>
> Best Regards,
>
> Steven Zhu
> MCSE
> Microsoft Online Partner Support
> Get Secure! - www.microsoft.com/security
> ======================================================
> PLEASE NOTE the newsgroup SECURE CODE and PASSWORD were
> updated on February 14, 2006.? Please complete a re-registration process
> by entering the secure code mmpng06 when prompted. Once you have
> entered the secure code mmpng06, you will be able to update your profile
> and access the partner newsgroups.
> ======================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from this issue.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
> ======================================================
>
>
>
>
>
>
>


From: jason on 31 Jul 2006 12:33
Correction: it seems like I'm getting these Userenv errors on several PCs,
but not ALL PCs.


"jason" <jasonsantos-NOSPAM-(a)allstatesmedical.com> wrote in message
news:ebvnMnLtGHA.4612(a)TK2MSFTNGP06.phx.gbl...
> Thanks for the suggestions, Steven.
>
> I followed those steps and still have the same issues.
>> 1. Have you performed some specific operation before discovering the
>> issue?
> It's been hapenning for a long time, but I don't recall a certain event
> before the issue started to show up.
>> 2. What''s the detailed symptom of the specific issue except for the
>> event
>> mentioned in the post?
> Not sure what you mean, but on this particular PC, I get a lot of other
> errors I'll post below.
>
>> 3. Does the issue occur when using a specific user account or every use
>> account in your domain?
> This issue is mostly with one PC, although it ocassionally happens on
> other PCs. On the workstation with the most occurrences, it happens
> anywhere between 1 and every three hours.
>
> Not sure if they are related, but here are some other errors I'm getting
> on that workstation:
> Event Type: Warning
> Event Source: Print
> Event Category: None
> Event ID: 20
> Date: 7/31/2006
> Time: 11:41:01 AM
> User: NT AUTHORITY\SYSTEM
> Computer: PC9
> Description:
> Printer Driver Lexmark Z700-P700 Series for Windows NT x86 Version-3 was
> added or updated. Files:- LXBLDR5C.DLL, LXBLUI5C.DLL, LXBLUI5C.DLL,
> LXBLDRV.HLP, LXBLUN5C.EXE, LXBLUNRS.DLL, LXBLFC5C.DLL, LXBLICUR.DLL,
> LXBLCLR1.DLL, LXBLCLR2.DLL, LXBLCLR3.DLL, LXBLSTRN.DLL, LXBLLPA.HLP,
> LXBLNOTE.HLP, LXBLDRV.CNT, LXBLLPA.CNT, LXBLMA.CNT, CONTACT.HTM,
> LXBLJSWX.EXE, LXBLPSWX.EXE, LXBLJSW.DLL, LXBLJSWR.DLL, LXBLLPA.DLL,
> LXBLLPAR.DLL, LXBLPRP.DLL, LXBLPRPR.DLL, LXBLPSW.DLL, LXBLPSWR.DLL,
> LXBLUTIL.DLL, LXBLUPD.DLL, LXBLUPDR.DLL, LXBLPP5C.DLL, LEXEDF.DLL,
> lexgo.EXE, LXBLAUAL.OUT, LXBLMCAL.OUT, LXBLCAU.OUT, LXBLKAU.OUT,
> LXBLPHAU.OUT, LXBLCLN.OUT, LXBLCALN.OUT, LXBLKALN.OUT, LXBLALGN.OUT,
> LXBLPHCL.OUT, LXBLPHAL.OUT, lxblsply.htm, lxbllegl.htm, lxblsk0.dll,
> lxblsk1.dll, lxblsk2.dll, license.txt, lexwww.htm, ptzipw32.dll, WAVS.EXE,
> duplex1.prn, duplex2.prn, LXBLGF.DLL, lxblrme.doc, lxblweb.exe,
> HLP256.DLL, LEXBCE.DLL, LEXBCES.EXE, lexlmpm.dll, LEXPPS.EXE,
> LEXP2P32.DLL, LEX2KUSB.DLL, lxblcomm.dll, lxblw2k.ini, lexdrvin.exe,
> lxblver.web, lxblpwr.dll, LXBLPMNT.DLL, LXBLLCNT.DLL, LXBLLCNP.DLL,
> LXBLLSNT.EXE, LXBLIH.EXE, LXBL.LOC, LXBLCFG.EXE, LXBLCU.DLL, LXBLCUR.DLL,
> LEXPING.EXE, INSTMON.EXE, lxblvs.dll.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Event Type: Warning
> Event Source: LSASRV
> Event Category: (3)
> Event ID: 40961
> Date: 7/31/2006
> Time: 11:38:40 AM
> User: N/A
> Computer: PC9
> Description:
> The Security System could not establish a secured connection with the
> server ldap/DELLSERVER.ASM.local/ASM.local(a)ASM.local. No authentication
> protocol was available.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Any ideas?
> Thanks.
>
>
> "Steven Zhu [MSFT]" <v-stezhu(a)online.microsoft.com> wrote in message
> news:PzHmmNGtGHA.2004(a)TK2MSFTNGXA01.phx.gbl...
>> Hi Jason,
>>
>> Thanks for posting here.
>>
>> From your post, my understanding on this issue is: you get Event 1053
>> error
>> message in Event Viewer. If I am off base, please feel free to let me
>> know.
>>
>> Based on my research, the event ID 1053 issue may occur if you have
>> account
>> names that use non-ASCII characters. Windows 2000 Server and Windows
>> Server
>> 2003 do not distinguish between non-ASCII and ASCII characters in account
>> names. To resolve this issue, you must either delete or rename the
>> conflicting accounts.
>>
>> Also, please ensure that the appropriate groups are listed in the "Access
>> this Computer from the Network" permission. You can find this permission
>> in
>> the following folder:
>>
>> Computer Configuration\Windows Settings\Security Settings\Local
>> Policies\User Rights Assignment
>>
>> The following groups have the "Access this Computer from the Network"
>> permission on domain controllers by default:
>>
>> -Administrators
>> -Authenticated Users
>> -Everyone
>>
>> Following are some useful Microsoft Knowledge Base articles for your
>> reference:
>>
>> Event ID 1053 and 1058 appear in the Application log after you upgrade to
>> Windows 2000 Server or Windows Server 2003 with Active Directory
>> http://support.microsoft.com/?id=883271
>>
>> Lookup of Permissions on ACLs Shows Only SIDs
>> http://support.microsoft.com/?id=262958
>>
>> If the issue still persists, please collect some additional information
>> for
>> my further research:
>>
>> 1. Have you performed some specific operation before discovering the
>> issue?
>>
>> 2. What''s the detailed symptom of the specific issue except for the
>> event
>> mentioned in the post?
>>
>> 3. Does the issue occur when using a specific user account or every use
>> account in your domain?
>> Please try the suggestions above and let me know the results at your
>> earliest convenience. If anything in my response is unclear or you need
>> further help, don''t hesitate to post back.
>>
>> Thank you for your time and cooperation.
>>
>> Have a nice day.
>>
>> Best Regards,
>>
>> Steven Zhu
>> MCSE
>> Microsoft Online Partner Support
>> Get Secure! - www.microsoft.com/security
>> ======================================================
>> PLEASE NOTE the newsgroup SECURE CODE and PASSWORD were
>> updated on February 14, 2006.? Please complete a re-registration process
>> by entering the secure code mmpng06 when prompted. Once you have
>> entered the secure code mmpng06, you will be able to update your profile
>> and access the partner newsgroups.
>> ======================================================
>> When responding to posts, please "Reply to Group" via your newsreader so
>> that others may learn and benefit from this issue.
>> ======================================================
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>> ======================================================
>>
>>
>>
>>
>>
>>
>>
>
>


 |  Next  |  Last
Pages: 1 2
Prev: Operation terminated with error -1808 (JET_errDiskFull, No space l
Next: MSExchangeActiveSyncNotify