Windows 2003 servers, two domain controllers.



Recently, encountered the Userenv errors 1058 and 1030 being logged on one
of the domain controllers every five minutes. Problem occurred in August and
was resolved, then occurred again in October. Event log entries on the
domain controller match those in KB 887303, with Access denied as the reason
in the 1058 error messages.

Worked through the steps outlined in KB article 887303. Of course, the last
step (step eight) was the one which resolved the problem again, as it did in
August.
However, I do have a question pertaining to the permissions listed in step 5
of the KB article, as the error I was getting was Access denied, which would
indicate a permissions problem somewhere.

Step 5 refers to another KB article, 290647 with regards to the required
permissions needed on the Sysvol folder and subfolders. In that article, for
a Windows 2003 server, steps 1c-f describe clearing the box to inherit
permissions from parent for the %SystemRoot%\Windows\Sysvol\Sysvol and
%SystemRoot%\Windows\Sysvol\Sysvol\<domain> folders. Since there is no
description of what permissions to assign, this would effectively leave these
two folders with no permissions at all.

Is this correct?

I did not follow these particular steps, but continued with the remaining
permissions assignments, as well as those remaining in the 887303 article.
Also of note, there were more permissions granted to the
%SystemRoot%\Windows\Sysvol\Sysvol\<domain>\Policies\<policy_name> folders on
my servers than outlined in the article, for groups like Enterprise Domain
Controllers and Domain Admins.

I’m very curious as to whether or not the permissions (or lack of) outlined
in the article are correct, as well as if the extraneous permissions could be
safely removed. I’m making the assumption that the extra permissions are
holdovers from when the domain was upgraded from Windows 2000 to 2003 several
years ago.

Rick

Hello Library,

Please porivde an unedited ipconfig /all from the servers and if exist also
from a problem client, so we can verify DNS settings.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Windows 2003 servers, two domain controllers.
>
> Recently, encountered the Userenv errors 1058 and 1030 being logged on
> one of the domain controllers every five minutes. Problem occurred in
> August and was resolved, then occurred again in October. Event log
> entries on the domain controller match those in KB 887303, with Access
> denied as the reason in the 1058 error messages.
>
> Worked through the steps outlined in KB article 887303. Of course,
> the last
> step (step eight) was the one which resolved the problem again, as it
> did in
> August.
> However, I do have a question pertaining to the permissions listed in
> step 5
> of the KB article, as the error I was getting was Access denied, which
> would
> indicate a permissions problem somewhere.
> Step 5 refers to another KB article, 290647 with regards to the
> required permissions needed on the Sysvol folder and subfolders. In
> that article, for a Windows 2003 server, steps 1c-f describe clearing
> the box to inherit permissions from parent for the
> %SystemRoot%\Windows\Sysvol\Sysvol and
> %SystemRoot%\Windows\Sysvol\Sysvol\<domain> folders. Since there is
> no description of what permissions to assign, this would effectively
> leave these two folders with no permissions at all.
>
> Is this correct?
>
> I did not follow these particular steps, but continued with the
> remaining permissions assignments, as well as those remaining in the
> 887303 article. Also of note, there were more permissions granted to
> the %SystemRoot%\Windows\Sysvol\Sysvol\<domain>\Policies\<policy_name>
> folders on my servers than outlined in the article, for groups like
> Enterprise Domain Controllers and Domain Admins.
>
> I’m very curious as to whether or not the permissions (or lack of)
> outlined in the article are correct, as well as if the extraneous
> permissions could be safely removed. I’m making the assumption that
> the extra permissions are holdovers from when the domain was upgraded
> from Windows 2000 to 2003 several years ago.
>
> Rick
>

This issue has reoccurred again today on only one of the two Domain
Controllers for the fourth for fifth month, now.
dfsutil /PurgeMUPCache run again.

Did not see the reply before, so here is the output from ipconfig /all of
the two domain controllers. There are no user machines or other servers
exhibiting the 1058 or 1030 errors.

Windows IP Configuration
Host Name . . . . . . . . . . . . : dc1
Primary Dns Suffix . . . . . . . : scdl.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : scdl.local

Ethernet adapter SCDL LAN:
Connection-specific DNS Suffix . : scdl.local
Description . . . . . . . . . . . : BASP Virtual Adapter
Physical Address. . . . . . . . . : 00-18-8B-7D-B5-B7
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.34.10.55
Subnet Mask . . . . . . . . . . . : 255.255.254.0
Default Gateway . . . . . . . . . : 10.34.10.1
DNS Servers . . . . . . . . . . . : 10.34.10.55
Primary WINS Server . . . . . . . : 10.34.10.55
Secondary WINS Server . . . . . . : 10.34.10.56


Windows IP Configuration
Host Name . . . . . . . . . . . . : dc2
Primary Dns Suffix . . . . . . . : scdl.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : scdl.local

Ethernet adapter SCDL LAN:
Connection-specific DNS Suffix . : scdl.local
Description . . . . . . . . . . . : BASP Virtual Adapter
Physical Address. . . . . . . . . : 00-18-8B-7D-B5-B4
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.34.10.56
Subnet Mask . . . . . . . . . . . : 255.255.254.0
Default Gateway . . . . . . . . . : 10.34.10.1
DNS Servers . . . . . . . . . . . : 10.34.10.56
Primary WINS Server . . . . . . . : 10.34.10.55
Secondary WINS Server . . . . . . : 10.34.10.56



"Meinolf Weber [MVP-DS]" wrote:

> Hello Library,
>
> Please porivde an unedited ipconfig /all from the servers and if exist also
> from a problem client, so we can verify DNS settings.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>

> > Windows 2003 servers, two domain controllers.
> >
> > Recently, encountered the Userenv errors 1058 and 1030 being logged on
> > one of the domain controllers every five minutes. Problem occurred in
> > August and was resolved, then occurred again in October. Event log
> > entries on the domain controller match those in KB 887303, with Access
> > denied as the reason in the 1058 error messages.
> >
> > Worked through the steps outlined in KB article 887303. Of course,
> > the last
> > step (step eight) was the one which resolved the problem again, as it
> > did in
> > August.
> > However, I do have a question pertaining to the permissions listed in
> > step 5
> > of the KB article, as the error I was getting was Access denied, which
> > would
> > indicate a permissions problem somewhere.
> > Step 5 refers to another KB article, 290647 with regards to the
> > required permissions needed on the Sysvol folder and subfolders. In
> > that article, for a Windows 2003 server, steps 1c-f describe clearing
> > the box to inherit permissions from parent for the
> > %SystemRoot%\Windows\Sysvol\Sysvol and
> > %SystemRoot%\Windows\Sysvol\Sysvol\<domain> folders. Since there is
> > no description of what permissions to assign, this would effectively
> > leave these two folders with no permissions at all.
> >
> > Is this correct?
> >
> > I did not follow these particular steps, but continued with the
> > remaining permissions assignments, as well as those remaining in the
> > 887303 article. Also of note, there were more permissions granted to
> > the %SystemRoot%\Windows\Sysvol\Sysvol\<domain>\Policies\<policy_name>
> > folders on my servers than outlined in the article, for groups like
> > Enterprise Domain Controllers and Domain Admins.
> >
> > I’m very curious as to whether or not the permissions (or lack of)
> > outlined in the article are correct, as well as if the extraneous
> > permissions could be safely removed. I’m making the assumption that
> > the extra permissions are holdovers from when the domain was upgraded
> > from Windows 2000 to 2003 several years ago.
> >
> > Rick
> >

>
>
> .
>

"Library Sysadmin" <LibrarySysadmin@newsgroup> wrote in
message news:3093424D-068E-4A7B-84B8-1D87671A296D@newsgroup

> This issue has reoccurred again today on only one of the two Domain
> Controllers for the fourth for fifth month, now.
> dfsutil /PurgeMUPCache run again.
>
> Did not see the reply before, so here is the output from ipconfig /all of
> the two domain controllers. There are no user machines or other servers
> exhibiting the 1058 or 1030 errors.
>
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : dc1
> Primary Dns Suffix . . . . . . . : scdl.local
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : scdl.local
>
> Ethernet adapter SCDL LAN:
> Connection-specific DNS Suffix . : scdl.local
> Description . . . . . . . . . . . : BASP Virtual Adapter
> Physical Address. . . . . . . . . : 00-18-8B-7D-B5-B7
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 10.34.10.55
> Subnet Mask . . . . . . . . . . . : 255.255.254.0
> Default Gateway . . . . . . . . . : 10.34.10.1
> DNS Servers . . . . . . . . . . . : 10.34.10.55
> Primary WINS Server . . . . . . . : 10.34.10.55
> Secondary WINS Server . . . . . . : 10.34.10.56
>
>
> Windows IP Configuration
> Host Name . . . . . . . . . . . . : dc2
> Primary Dns Suffix . . . . . . . : scdl.local
> Node Type . . . . . . . . . . . . : Hybrid
> IP Routing Enabled. . . . . . . . : No
> WINS Proxy Enabled. . . . . . . . : No
> DNS Suffix Search List. . . . . . : scdl.local
>
> Ethernet adapter SCDL LAN:
> Connection-specific DNS Suffix . : scdl.local
> Description . . . . . . . . . . . : BASP Virtual Adapter
> Physical Address. . . . . . . . . : 00-18-8B-7D-B5-B4
> DHCP Enabled. . . . . . . . . . . : No
> IP Address. . . . . . . . . . . . : 10.34.10.56
> Subnet Mask . . . . . . . . . . . : 255.255.254.0
> Default Gateway . . . . . . . . . : 10.34.10.1
> DNS Servers . . . . . . . . . . . : 10.34.10.56
> Primary WINS Server . . . . . . . : 10.34.10.55
> Secondary WINS Server . . . . . . : 10.34.10.56
>
>
>
> "Meinolf Weber [MVP-DS]" wrote:
>

The DNS settings recommendation is to point to itself first, and a partner
as the second entry. WINS points only to itself if it is a WINS server, if
not a WINS server, provide one or more WINS addresses.

As for the errors:

EventID 1030, Assuming Sourcename = Userenv:
http://eventid.net/display.asp?event...serenv&phase=1

EventId 1058, assuming sourcename = Userenv
http://eventid.net/display.asp?event...serenv&phase=1

Also, I've seen this at one place I worked at. I was on the Exchange team,
but unfortunately, we did not have AD access however we knew that something
was altered permissions-wise. If a non-domain admin stays logged on for the
time it takes for the Kerb ticket to renew, the ticket will get denied and
cause those errors. Logging off, then on again usually took care of it. In
some cases we had to restart. For the user base, some users stayed logged on
all the time (locked their workstations), and would experience the same
symptom. We simply asked them to restart.

I know that isn't much info, but that was what we've found after extensive
testing without AD access. And yes, we tried the dfsutil MUP purge, but that
wasn't helpful.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA
2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.