none
Multiple 1202 event id

    Question

  • Hi,

    I'm trying to troubleshoot an issue in VMWare View preventing me from copy/pasting from the host to the VM and the other way around.

    During my investigations, I stumbled upon multiple errors in Application Event Logs, with event id = 1202

    I tried to follow the steps described in the following KB : https://support.microsoft.com/en-us/kb/974639

    I launched find /i "cannot find" %SYSTEMROOT%\security\logs\winlogon.log but it returned nothing.

    I tried to edit GptTmpl.inf but I did not fin anything suspicious

    And I tried to download the fix and install it to my VM and it told me that it did not apply to my system.

    Then I tried to launch RSOP and saw that one of my rules that added domain admins to the local administrators had a red cross:

    This Restricted Group assignment is part of the "Default Domain Policy" GPO, so it's applied to everything in the domain.

    I'm wondering if the error come from the fact that it tries to apply to the domain controllers itself, and as they don't have a local "Administrators" group, they return an error.

    Am I right ? If so, should I just put my user rights assignment at a lower level ?

    Thanks.


    R.

    Monday, November 09, 2015 8:48 AM

Answers

  • Hi,

    After moving my GPO at a lower level, excluding DCs, I no longer have the error in my logs.

    Thanks !


    R.

    • Marked as answer by Rodolphe Beck Friday, November 20, 2015 1:08 PM
    Friday, November 20, 2015 8:08 AM

All replies

  • What does the 1202 error say as the reason in the events description? 

    But, to give an opinion on the questions asked.  I would move restricted groups out of the default domain policy (not really recommended to update it directly anyway) and put it 'closer' to the workstations/servers or at least a place that will not apply to DC's.  As you said it does apply to all computer objects, even DC's (with no local groups).

    • Proposed as answer by vaadadmin2010 Friday, November 20, 2015 1:07 PM
    Monday, November 09, 2015 5:21 PM
  • Hi Rodolphe Beck,

    Thanks for your post.

    For error 1202, could you please check about the related error code. This error code distinguishes the type of failure that causes the SCECLI 1202 event. According to the link you provide, it is 0x534, right? And what's your operating system. This issue may occur when a Windows 7 or Windows Server 2008 R2 member computer modifies any security setting in the Default Domain Controllers Policy on a Windows Server 2008 R2 domain controller. Have you tried the temporary workaround, manually edit the GPTMPL.INF file? If not, you may take a look.

    Event 1202 with status 0x534 logged on Windows Server 2008 R2 domain controllers after modifying security policy

    https://support.microsoft.com/en-us/kb/2000705

    Besides, for your initial issue VMWare View preventing me from copy/pasting from the host to the VM, you may check the thread below. And I suggest you may also post in VMWARE forum for more professional support about VMware

    https://communities.vmware.com/thread/436411?start=15&tstart=0

    Best Regards,

    Mary Dong


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, November 10, 2015 3:19 AM
    Moderator
  • Hi,

    After moving my GPO at a lower level, excluding DCs, I no longer have the error in my logs.

    Thanks !


    R.

    • Marked as answer by Rodolphe Beck Friday, November 20, 2015 1:08 PM
    Friday, November 20, 2015 8:08 AM