1058 1030 and no access to \\domain\share

[Daniel Pardoen]

Dear All,

I have the following problem on a DC and I hope there someone to help me.

The errors:

Event 1058
Windows cannot access the file gpt.ini for GPO
CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=tkdmsc,DC=nl.
The file must be present at the location
<\\tkdmsc.nl\sysvol\tkdmsc.nl\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Access is denied. ). Group Policy processing aborted.

Event 1030
Windows cannot query for the list of Group Policy objects. Check the event
log for possible messages previously logged by the policy engine that
describes the reason for this.

Symptoms

1. From the DC I cannot access the share \\tkdmsc\sysvol I get a logon
window. When mapping C:\WINDOWS\SYSVOL\sysvol\tkdmsc.nl there is no problem.
From a other server I can also map both shares.
2. When I click on a GPO to edit it, I get the error unable to logon.
3. there are no FRS issues

The configuration:

SBS 2003 SP2
All updates installed
Removed local virus scanner (just to rule out)

What did I try.

I already tried lost of post on the internet and also tried to resolve the
issue whit help op eventide.net
1. Check share and NTFS permission and compared it whit to other identical
servers
2. Multiple reboots
3. dfsutil /PurgeMupCache
4. Network Access: Let Everyone permissions apply to anonymous users =
"Enabled".
5. Network Access: Shares that can be accessed anonymously -> Add SYSVOL to
the list.
6. Logon to the server whit a other Administrator (Full admin)
7. Dcgpofix ( I get the error: Unable to read EFS certificates from
Registry.pol file of Default Domain Policy. The error was: Logon failure:
unknown user name or bad password.
8. DCdiag (everything passed) maybe I did not take a good look)
9. -netsh interface ip reset (tried to restore the IP stack)
10. Checked the order for the Nic’s (one active and that one is on top)

Some info:

E:\>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : flater
Primary Dns Suffix . . . . . . . : tkdmsc.nl
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : tkdmsc.nl
Ethernet adapter Server Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-11-43-DA-35-00
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.202.0.52
Subnet Mask . . . . . . . . . . . : 255.255.252.0
Default Gateway . . . . . . . . . : 10.202.0.81
DNS Servers . . . . . . . . . . . : 127.0.0.1
Primary WINS Server . . . . . . . : 10.202.0.52

[Meinolf Weber]

You talk about a second NIC, is it enabled, then please post also an ipconfig
/all from it. For the DNS server ip i would change to the real one instead
of the loopback ip address.

Also check this out:
http://www.eventid.net/display.asp?e...serenv&phase=1

http://www.eventid.net/display.asp?e...serenv&phase=1

[Ryan Hanisco]

I have run into this problem before, though it was usually after a migration
or a server replacement where everything wasn't fully out of system before
the new server was brought in.

Have a look at the following article:

http://support.microsoft.com/kb/888943

Good luck, let me know if I can help in any way.

[Daniel Pardoen]

Thank you for your post.

When i take a look the settings are correct so this isn't the sollution to
our problem.

Do you have any other suggestion?

[Daniel Pardoen]

The second nic is disabled and i tried to put in the normal ip of the server
as dns. (Actualy that was yhe original setting)

Do you have other options to solve this issue?

[Harj]

After you changed the DNS settings, run the following command
ipconfig /flushdns & ipconfig /registerdns & net stop netlogon & net
start netlogon

[kumarsse]

Not able to access \\domain\sysvol, I am able to access with \\ip address\sysvol
Not able to edit gpo
Dcgpofix ( I get the error: Unable to read EFS certificates from
Registry.pol file of Default Domain Policy. The error was: Logon
failure:

[joel84]

You CAN use the tool DSACLS, that is included in the Support Tools for Windows 2000 and Windows Server 2003, to remove the Deny Access permissions from the Domain Administrators group. You must know the distinguished name (also known as DN) of the GPO to use this tool. Use the tool ADSIEdit.msc. That is included in the Support Tools for Windows 2000 and Windows Server 2003, to determine the distinguished name of the GPO in Active Directory. To reset permissions, the following steps would be useful :

1. Start ADSIEdit.msc on the PDC emulator.
2. Under ADSIEdit, click Domain NC, and Then locate the container Following:
   
   Domain_Name container \ CN = System \ CN = Policies container
   The right pane lists the global universal identification numbers (GUIDs) for all the GPOs in the domain.
3. Locate That the policy has-been restricted, And Then note the distinguished name of this object, for example:
   
   cn = {f5e14b83-0181-437e-878c-8d16cb945d68}, cn = Policies, cn = system, dc = jlc, dc = com
4. Use DSACLS to remove the Deny Access permissions That Have Been Assigned to Domain Administrators group. Use the following syntax:
   
   dsacls distinguished_name / R "domain_name \ domain admins"
5. DSACLS Use with the / g switch to grant access to the Domain Administrators group. Use the following syntax:
   
   dsacls distinguished_name / G "domain_name \ domain admins": GA
6. On the PDC emulator, start Microsoft Windows Explorer, And Then browse to the Winnt \ Sysvol \ Sysvol \ domain_name \ Policies folder. The GUID for the GPO is restricted listed in this folder.
7. Right-click the GUID for the GPO, click Properties, click the Security tab, and Then Give the Domain Administrators group Full Control permissions.
8. Check the subfolders under this GPO object to confirm domain Administrators That Also Have Rights to These folders.

After you complete this procedure, if you log on using a Domain Administrator account, you CAN open and edit this GPO.

[jimmyjack1982]

Hey guys and girls, I had this exact same problem and it was due to the Domain Admin password being changed recently. I rebooted the DC and the error went away.

Just thought I'd add my 2cents.