Win2003SP1 DC loses all shares, roaming profiles cannot logon or logoff

Hi all,

This problem just popped up about three weeks ago. I have a Windows 2003
Standard Domain Controller and a bunch of Windows XP SP2 clients. We run
roaming profiles and redirected folders, and have a handful of GPOs.

Every five minutes in the Application event log I have an Information
item (1704) that tells me "Security policy in the Group policy objects has
been applied successfully." That's not the problem... I don't mind an event
log full of Information items. I mention this only to say that sometimes it
will stop logging this event. Of course I never notice this until a couple
of hours later when someone tries to logon or logoff. Other times the
5-minute-interval logging continues right up until...

I'll start getting the following errors:

1509
Source: Userenv
User: username
Windows cannot copy file \\dcname\profiles\username\ntuser.ini to location
c:\documents and settings\username\ntuser.ini. Possible causes of this
error include network problems or insufficient security rights. If this
problem persists, contact your network administrator.
DETAIL - The specified network name is no longer available.

and

1515
Source: Userenv
Windows has backed up this user's profile [same user as above, btw].
Windows will automatically try ot use the backed up profile the next time
this user logs on.

Those two are for a remote user. There are also these:

1058
Source: Userenv
User: NT AUTHORITY\SYSTEM
Windows cannot access the file gpt.ini for GPO
cn={blah}.cn=policies.cn=system.DC=domainname. The file must be present at
the location \\domainname\sysvol\domainname\Policies\{blah}\gpt .ini.
(Configuration information could not be read from the domain controller,
either because the machine is unavailable or access has been denied.).
Group Policy processing aborted.

1030
Source: Userenv
User: NT AUTHORITY\SYSTEM
Windows cannot query for the list of Group Policy objects. Check the event
log for possible messages previously logged by the policy engine that
describes the reason for this.

1058 and 1030 are also logged when the Administrator tries to log in locally
to the domain controller.

If I happen to be logged in by RDP to the DC when this happens, I can do
anything I like on the server. There is no bandwidth issue, there is no
server resource issue, and locally everything is working like a charm. The
only thing that I cannot do is logoff (thus a polite shutdown is nigh
impossible) and I cannot access "network" shares that come as part of the
administrator logon script. I cannot access shares that are physically
located on the same computer. I can access the drives locally, by drive
letter, just fine.

This will happen out of nowhere, at various times of day or night, never
right after some other event (as far as I can tell), and I am unable to
determine if there is something else happening that might be causing it.
All services that are set to automatically run are started when this is
happening.

I am somewhat suspicious of my Symantec AV which is also running (server) on
the DC. I have had nothing but trouble with this piece of crap since they
moved to version 9 (now a couple of subversions into 10).

I've checked for any weird issues relating to windows updates that might
have occurred around the time that this started, but I haven't found
anything recent. There was some issue with permissions on important
directories, but that was with an update that was issued (and applied to our
server) in June/July.

Does anyone have any thoughts on what might be causing this? I would be
eternally grateful.

Many possibilities. This case studies may help,

Event ID 1058, 1059 and 1030 Event ID 1058, 1059 and 1030. Event ID 1058 is Group Policy related issue. Normally, there are two symptoms: "network path not found" and "access denied". ...
http://www.chicagotech.net/troublesh.../event1058.htm


Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
"IconoclastX" <iconoclastx at gmail dot com> wrote in message news:%23JFb38R$(E-Mail Removed)...
Hi all,

This problem just popped up about three weeks ago. I have a Windows 2003
Standard Domain Controller and a bunch of Windows XP SP2 clients. We run
roaming profiles and redirected folders, and have a handful of GPOs.

Every five minutes in the Application event log I have an Information
item (1704) that tells me "Security policy in the Group policy objects has
been applied successfully." That's not the problem... I don't mind an event
log full of Information items. I mention this only to say that sometimes it
will stop logging this event. Of course I never notice this until a couple
of hours later when someone tries to logon or logoff. Other times the
5-minute-interval logging continues right up until...

I'll start getting the following errors:

1509
Source: Userenv
User: username
Windows cannot copy file \\dcname\profiles\username\ntuser.ini to location
c:\documents and settings\username\ntuser.ini. Possible causes of this
error include network problems or insufficient security rights. If this
problem persists, contact your network administrator.
DETAIL - The specified network name is no longer available.

and

1515
Source: Userenv
Windows has backed up this user's profile [same user as above, btw].
Windows will automatically try ot use the backed up profile the next time
this user logs on.

Those two are for a remote user. There are also these:

1058
Source: Userenv
User: NT AUTHORITY\SYSTEM
Windows cannot access the file gpt.ini for GPO
cn={blah}.cn=policies.cn=system.DC=domainname. The file must be present at
the location \\domainname\sysvol\domainname\Policies\{blah}\gpt .ini.
(Configuration information could not be read from the domain controller,
either because the machine is unavailable or access has been denied.).
Group Policy processing aborted.

1030
Source: Userenv
User: NT AUTHORITY\SYSTEM
Windows cannot query for the list of Group Policy objects. Check the event
log for possible messages previously logged by the policy engine that
describes the reason for this.

1058 and 1030 are also logged when the Administrator tries to log in locally
to the domain controller.

If I happen to be logged in by RDP to the DC when this happens, I can do
anything I like on the server. There is no bandwidth issue, there is no
server resource issue, and locally everything is working like a charm. The
only thing that I cannot do is logoff (thus a polite shutdown is nigh
impossible) and I cannot access "network" shares that come as part of the
administrator logon script. I cannot access shares that are physically
located on the same computer. I can access the drives locally, by drive
letter, just fine.

This will happen out of nowhere, at various times of day or night, never
right after some other event (as far as I can tell), and I am unable to
determine if there is something else happening that might be causing it.
All services that are set to automatically run are started when this is
happening.

I am somewhat suspicious of my Symantec AV which is also running (server) on
the DC. I have had nothing but trouble with this piece of crap since they
moved to version 9 (now a couple of subversions into 10).

I've checked for any weird issues relating to windows updates that might
have occurred around the time that this started, but I haven't found
anything recent. There was some issue with permissions on important
directories, but that was with an update that was issued (and applied to our
server) in June/July.

Does anyone have any thoughts on what might be causing this? I would be
eternally grateful.

Hello IconoclastX" iconoclastx at gmail dot com,

Did you upgrade to SP1 at the time when the errors starts?
If so check youir DNS server settings from your network card, that it points
to the right DNS IP address.

For the 1058 and 1030 events look here:
http://support.microsoft.com/kb/842804/en-us

http://support.microsoft.com/kb/314494/en-us

http://support.microsoft.com/kb/839499/en-us

Best regards

myweb
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.



> Hi all,
>
> This problem just popped up about three weeks ago. I have a
> Windows 2003 Standard Domain Controller and a bunch of Windows XP SP2
> clients. We run roaming profiles and redirected folders, and have a
> handful of GPOs.
>
> Every five minutes in the Application event log I have an
> Information item (1704) that tells me "Security policy in the Group
> policy objects has been applied successfully." That's not the
> problem... I don't mind an event log full of Information items. I
> mention this only to say that sometimes it will stop logging this
> event. Of course I never notice this until a couple of hours later
> when someone tries to logon or logoff. Other times the
> 5-minute-interval logging continues right up until...
>
> I'll start getting the following errors:
>
> 1509
> Source: Userenv
> User: username
> Windows cannot copy file \\dcname\profiles\username\ntuser.ini to
> location
> c:\documents and settings\username\ntuser.ini. Possible causes of
> this
> error include network problems or insufficient security rights. If
> this
> problem persists, contact your network administrator.
> DETAIL - The specified network name is no longer available.
> and
>
> 1515
> Source: Userenv
> Windows has backed up this user's profile [same user as above, btw].
> Windows will automatically try ot use the backed up profile the next
> time
> this user logs on.
> Those two are for a remote user. There are also these:
>
> 1058
> Source: Userenv
> User: NT AUTHORITY\SYSTEM
> Windows cannot access the file gpt.ini for GPO
> cn={blah}.cn=policies.cn=system.DC=domainname. The file must be
> present at
> the location \\domainname\sysvol\domainname\Policies\{blah}\gpt .ini.
> (Configuration information could not be read from the domain
> controller,
> either because the machine is unavailable or access has been denied.).
> Group Policy processing aborted.
> 1030
> Source: Userenv
> User: NT AUTHORITY\SYSTEM
> Windows cannot query for the list of Group Policy objects. Check the
> event
> log for possible messages previously logged by the policy engine that
> describes the reason for this.
> 1058 and 1030 are also logged when the Administrator tries to log in
> locally to the domain controller.
>
> If I happen to be logged in by RDP to the DC when this happens, I can
> do anything I like on the server. There is no bandwidth issue, there
> is no server resource issue, and locally everything is working like a
> charm. The only thing that I cannot do is logoff (thus a polite
> shutdown is nigh impossible) and I cannot access "network" shares that
> come as part of the administrator logon script. I cannot access
> shares that are physically located on the same computer. I can access
> the drives locally, by drive letter, just fine.
>
> This will happen out of nowhere, at various times of day or night,
> never right after some other event (as far as I can tell), and I am
> unable to determine if there is something else happening that might be
> causing it. All services that are set to automatically run are started
> when this is happening.
>
> I am somewhat suspicious of my Symantec AV which is also running
> (server) on the DC. I have had nothing but trouble with this piece of
> crap since they moved to version 9 (now a couple of subversions into
> 10).
>
> I've checked for any weird issues relating to windows updates that
> might have occurred around the time that this started, but I haven't
> found anything recent. There was some issue with permissions on
> important directories, but that was with an update that was issued
> (and applied to our server) in June/July.
>
> Does anyone have any thoughts on what might be causing this? I would
> be eternally grateful.
>