Troubleshoot SCECLI 1202 events - Windows Server (2023)

This article describes how to troubleshoot and resolve SCECLI 1202 events.

Refers to:Windows Server 2012 R2
Original KB number:324383

Summary

The first step in troubleshooting these events is to identify the Win32 error code. This error code distinguishes the type of error that causes the SCECLI 1202 event. The following is an example of the SCECLI 1202 event. The error code is displayed in the fieldDescription. In this example, the error code is 0x534. The text after the error code is a description of the error. Once you've determined the error code, find that section of the error code in this article, and then follow the troubleshooting steps in that section.

0x534: No mapping between account names and security IDs.

the

0x6fc: Trust relationship between primary domain and trusted domain failed.

Error Code 0x534: No mapping between account names and security IDs

These error codes mean that the security account could not be resolved to a security identifier (SID). The error usually occurs because the account name was typed incorrectly or the account was deleted after it was added to the security policy setting. This is usually done in a sectionUser rightsor in the sectionRestricted groupssecurity policy settings. This can also happen if the account exists in a trust relationship and then the trust relationship is broken.

To resolve this issue, follow these steps:

1. Determine the account that is causing the crash. To do this, enable debug logging for the Security Configuration client-side extension:

   1. Launch Registry Editor.

   2. Locate and select the following registry subkey:

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F7 9F83A}

   3. W menuEditselect an itemAdd value, and then add the following registry value:

      • Value name: ExtensionDebugLevel
      • Value type: DWORD
      • Value data: 2

   4. Close Registry Editor.

2. Refresh the policy settings to reproduce the error. To refresh the policy settings, type the following at a command prompt, and then press ENTER:

   retire /refreshpolicy machine_policy /enforce

   This command creates a file namedWinlogon.login the folder%SYSTEMROOT%\Security\Logs.

3. Find the problem account. To do this, type the following command at the command prompt, and then press ENTER:

   find /i "cannot find" %SYSTEMROOT%\security\logs\winlogon.log

   The search output identifies the problem account names, for exampleThe MichaelPeltier application could not be found. In this example, the MichaelPeltier user account does not exist in the domain. Or it has a different spelling, such as MichellePeltier.

   Determine why this account cannot be recognized. For example, look for typographical errors, a deleted account, an invalid policy that applies to this computer, or a trust issue.

4. If you determine that the account needs to be removed from the policy, find the problem policy and problem setting. To determine which setting contains the unresolved account, type the following command at a command prompt on the computer that generates the SCECLI 1202 event, and then press ENTER:

   c:\>find /i "account name" %SYSTEMROOT%\security\templates\policies\gpt*.*

   In this example, the syntax and results are:

   c:\>find /i "MichaelPeltier" %SYSTEMROOT%\security\templates\policies\gpt*.*---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00002.INFSeInteractiveLogonRight = TsInternetUser,*S-1-5-32-549,*S-1-5-32-550,MichaelPeltier,*S-1-5-32-551,*S-1-5-32-544,*S-1-5-32-548---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00003.DOM

   Identifies gpt00002.inf as a cached security template from a Group Policy Object (GPO) issue that contains the issue setting. It also identifies the problem setting as SeInteractiveLogonRight. The display name of the SeInteractiveLogonRight object isLogin locally.

   For a map of constants (for example, SeInteractiveLogonRight) to their display names (for example, logging on locally), see the Microsoft Windows 2000 Server Resource Kit, Distributed Systems Guide. The map is in the sectionUser rightsappendix.

5. Determine which GPO contains the problem setting. Search the cache for the security template identified in step 4 textGPOPath=. In this example you will see:

   GPOPath={6AC1786C-016F-11D2-945F-00C04FB984F9}\MACHINE

   {6AC1786C-016F-11D2-945F-00C04FB984F9} is the GPO GUID.

6. To find the GPO friendly name, use the Gpotool.exe Resource Kit tool. Type the following at the command prompt, and then press ENTER:

   gpotool /verbose

   Search for the output of the GUID identified in step 5. The four lines that match the GUID contain the friendly name of the policy. Example:

   Policy {6AC1786C-016F-11D2-945F-00C04FB984F9}Policy OKDetails:------------------------------------------------------------DC: domcntlr1.wingtiptoys.comFriendly name: Default Domain Controllers Policy

The problem account, problem setting, and problem GPO have now been identified. To resolve this problem, delete or replace the problem entry.

Error code 0x2: The system cannot find the file specified

This error is similar to 0x534 and 0x6fc. This is due to an unresolvable account name. When a 0x2 error occurs, it typically indicates that an unresolvable account name is specified in the Restricted Groups policy setting.

To resolve this issue, follow these steps:

1. Determine which service or object is failing. To do this, enable debug logging for the Security Configuration client-side extension:

   1. Launch Registry Editor.

   2. Locate and select the following registry subkey:

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F7 9F83A}

   3. W menuEditselect an itemAdd value, and then add the following registry value:

      • Value name: ExtensionDebugLevel
      • Value type: DWORD
      • Value data: 2

   4. Close Registry Editor.

2. Refresh the policy settings to reproduce the error. To refresh the policy settings, type the following at a command prompt, and then press ENTER:

   retire /refreshpolicy machine_policy /enforce

   This command creates a file namedWinlogon.login the folder%SYSTEMROOT%\Security\Logs.

3. At the command prompt, type the following command, and then press ENTER:

   find /i "cannot find" %SYSTEMROOT%\security\logs\winlogon.log

   The search output identifies the problem account names, for exampleThe MichaelPeltier application could not be found. In this example, the MichaelPeltier user account does not exist in the domain. Or it has a different spelling - for example, MichellePeltier.

   Determine why this account cannot be recognized. For example, look for typographical errors, a deleted account, an incorrect policy applied to this computer, or a trust issue.

4. If you determine that the account needs to be removed from the policy, find the problem policy and problem setting. To find what setting the unresolved account contains, type the following command at a command prompt on the computer that generates the SCECLI 1202 event, and then press ENTER:

   c:\>find /i "account name" %SYSTEMROOT%\security\templates\policies\gpt*.*

   In this example, the syntax and results are:

   c:\>find /i "MichaelPeltier" %SYSTEMROOT%\security\templates\policies\gpt*.*---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00002.INFSeInteractiveLogonRight = TsInternetUser,*S-1-5-32-549,*S-1-5-32-550,JohnDough,*S-1-5-32-551,*S-1-5-32-544,*S-1-5-32-548---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00003.DOM

   Identifies gpt00002.inf as a cached security template from the problem GPO that contains the problem setting. It also identifies the problem setting as SeInteractiveLogonRight. The display name of the SeInteractiveLogonRight object isLogin locally.

   For a map of constants (for example, SeInteractiveLogonRight) to their display names (for example, logging on locally), see the Windows 2000 Server Resource Kit, Distributed Systems Guide. The map is in the sectionUser rightsappendix.

5. Determine which GPO contains the problem setting. Search the cache for the security template identified in step 4 textGPOPath=. In this example you will see:

   GPOPath={6AC1786C-016F-11D2-945F-00C04FB984F9}\MACHINE

   {6AC1786C-016F-11D2-945F-00C04FB984F9} is the GPO GUID.

6. To find the GPO friendly name, use the Gpotool.exe Resource Kit tool. Type the following at the command prompt, and then press ENTER:

   gpotool /verbose

   Search for the output of the GUID identified in step 5. The four lines that match the GUID contain the friendly name of the policy. Example:

   Policy {6AC1786C-016F-11D2-945F-00C04FB984F9}Policy OKDetails:------------------------------------------------------------DC: domcntlr1.wingtiptoys.comFriendly name: Default Domain Controllers Policy

The problem account, problem setting, and problem GPO have now been identified. To resolve this issue, search the Restricted Groups section of the security policy for the instance of the problem account (MichaelPeltier in this example), and then remove or replace the problem entry.

Error Code 0x5: Access Denied

This error usually occurs when the system has not been given the appropriate permissions to update the service's access control list. This can happen if the administrator defines permissions for the service in the policy but does not grant Full System Account Control permission.

To resolve this issue, follow these steps:

1. Determine which service or object is failing. To do this, enable debug logging for the Security Configuration client-side extension:

   1. Launch Registry Editor.

   2. Locate and select the following registry subkey:

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F7 9F83A}

   3. W menuEditselect an itemAdd value, and then add the following registry value:

      • Value name: ExtensionDebugLevel
      • Value type: DWORD
      • Value data: 2

   4. Close Registry Editor.

2. Refresh the policy settings to reproduce the error. To refresh the policy settings, type the following at a command prompt, and then press ENTER:

   retire /refreshpolicy machine_policy /enforce

   This command creates a file namedWinlogon.login the folder%SYSTEMROOT%\Security\Logs.

3. At the command prompt, type the following command, and then press ENTER:

   find /i "error opening" %SYSTEMROOT%\security\logs\winlogon.log

   The Find output identifies a service with misconfigured permissions, for exampleError opening DNScache.Dnscacheis the short name of the DNS client service.

4. Find out which policy or policies are trying to modify the service's permissions. To do this, type the following command at the command prompt, and then press ENTER:

   find /i "service" %SYSTEMROOT%\security\templates\policies\gpt*.*".

   Below is an example command and its output:

   d:\>find /i "dnscache" %windir%\security\templates\policies\gpt*.*---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00000.DOM-- -------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00001.INF---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00002.INFDnscache,3," D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;LA)"---------- D:\WINNT\SECURITY\TEMPLATES\POLICIES\GPT00003.DOM

5. Determine which GPO contains the problem setting. Search the cache for the security template identified in step 4 textGPOPath=. In this example you will see:

   GPOPath={6AC1786C-016F-11D2-945F-00C04FB984F9}\MACHINE

   {6AC1786C-016F-11D2-945F-00C04FB984F9} is the GPO GUID.

6. To find the GPO friendly name, use the Gpotool.exe Resource Kit tool. Type the following at the command prompt, and then press ENTER:

   gpotool /verbose

   Search for the output of the GUID identified in step 5. The four lines that match the GUID contain the friendly name of the policy. Example:

   Policy {6AC1786C-016F-11D2-945F-00C04FB984F9}Policy OKDetails:------------------------------------------------------------DC: domcntlr1.wingtiptoys.comFriendly name: Default Domain Controllers Policy

A service with misconfigured permissions and a problem GPO has now been identified. To resolve this issue, search the System Services section of the security policy for an instance of the service with misconfigured permissions. Then perform a corrective action to grant the service Full System Account Control permissions.

Error code 0x4b8: An extended error has occurred

Error 0x4b8 is generic and can be caused by many different issues. To troubleshoot these errors, follow these steps:

1. Enable debug logging for the Security Configuration client-side extension:

   1. Launch Registry Editor.

   2. Locate and select the following registry subkey:

      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F7 9F83A}

   3. W menuEditselect an itemAdd value, and then add the following registry value:

      • Value name: ExtensionDebugLevel
      • Value type: DWORD
      • Value data: 2

   4. Close Registry Editor.

2. Refresh the policy settings to reproduce the error. To refresh the policy settings, type the following at a command prompt, and then press ENTER:

   retire /refreshpolicy machine_policy /enforce

   This command creates a file named Winlogon.log in a folder%SYSTEMROOT%\Security\Logs.

3. LookESENT event IDs 1000, 1202, 412 and 454 are logged multiple times in the application log. This article describes known issues that cause error 0x4b8.

Collecting data

If you need help from Microsoft Support, we recommend that you gather your information by following the steps listed inSee Collecting Information Using TSS for Problem Group Policy.