| Author |
 Topic  |
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
 Posted - 09/08/2004 : 05:23:20 AM
|
Hi, Im receieving the below errors on my workstations, i am logging on as some new users but GPO is not completly applying and the logon script won't run as a result, which maps the shares.
Event Type: Error Event Source: Userenv
Event Category: None Event ID: 1091
Date: 08/09/2004 Time: 09:51:59
User: NT AUTHORITY\SYSTEM Computer: E11A01
Description:
The Group Policy client-side extension Internet Explorer Branding failed to log RSOP (Resultant Set of Policy) data. Please look for any errors reported earlier by that extension.
Event Type: Warning Event Source: MRxSmb
Event Category: None Event ID: 3019
Date: 08/09/2004 Time: 10:03:50
User: N/A Computer: E11A01
Description:
The redirector failed to determine the connection type.
Data:
0000: 00 00 00 00 04 00 4e 00 ......N.
0008: 00 00 00 00 cb 0b 00 80 ....Ë..#128;
0010: 00 00 00 00 84 01 00 c0 ....#132;..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
I enabled user logging and have weeded the below out as the only errors in the whole log.
USERENV(23c.fa4) 09:43:32:728 ProcessGPOs: Processing extension Internet Explorer Branding
USERENV(23c.fa4) 09:43:32:728 ReadStatus: Read Extension's Previous status successfully.
USERENV(23c.fa4) 09:43:32:728 CompareGPOLists: The lists are the same.
USERENV(23c.fa4) 09:43:32:728 ProcessGPOList: Entering for extension Internet Explorer Branding
USERENV(23c.fa4) 09:43:32:728 UserPolicyCallback: Setting status UI to Applying Internet Explorer Branding policy...
USERENV(23c.fa4) 09:43:32:744 LogExtSessionStatus: Successfully logged Extension Session data
USERENV(23c.fa4) 09:43:32:744 UserPolicyCallback: Setting status UI to Applying your personal settings...
USERENV(23c.fa4) 09:43:32:744 ProcessGPOList: Extension Internet Explorer Branding returned 0x4e4.
USERENV(23c.fa4) 09:43:32:744 ProcessGPOList: Extension Internet Explorer Branding was not able to log data. Error = 0x80004005, dwRet = 1252,leaving the log dirty
I can't figure out what setting in gpo is actually causing this issue. im running WinXP SP2/SP1 on a 2003 domain. The servers are not reporting any problems, so im guessing it's just a setting on the user groups gpo... but what one. Im in mandatory mode in ICM.
My computer has it's IP set the others tested on have dhcp and all seems well enough, permissons all seem fine too, the gpo have authenticated users with read permissons.
Any thoughts?
|
|
|
ptwilliams
Moderator
United Kingdom
4401 Posts
Status: offline |
Posted - 09/08/2004 : 06:51:02 AM
|
I think it's the IPSec settings that are causing this:
-- http://support.microsoft.com/?id=823608
Also, this message:
Event Type: Warning Event Source: MRxSmb
Event Category: None Event ID: 3019
Date: 08/09/2004 Time: 10:03:50
User: N/A Computer: E11A01
Description:
The redirector failed to determine the connection type.
Generally indicates that you are accessing, via UNC, the local machine. For example, you run \\server01\d$ interactively on server01.
I've come across this with GPO processing when one of my DCs computer accounts was missing; otherwise it's always the share/ UNC thing. Are you sure this is related??
If it is, is this box a DC? If so, are you *sure* replication, etc. is fine??
|
 |
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 09/08/2004 : 07:03:05 AM
|
the ms error isn't related, ipsec is not what is failing here, it's the internet branding part of my group policy.
The mrxsmb might not be related, but i am getting it, so i thought it would be worth mentioning.
No the workstation is not running as a dc, it's xp pro sp2. i had connected to my $ share of my removable disk, so the mrxsmb error might be because of that.
====
USERENV(23c.fa4) 09:43:32:744 ProcessGPOList: Extension Internet Explorer Branding returned 0x4e4.
USERENV(23c.fa4) 09:43:32:744 ProcessGPOList: Extension Internet Explorer Branding was not able to log data. Error = 0x80004005, dwRet = 1252,leaving the log dirty
====
the above it the error im trying to solve, my logon script under \\dc\netlogon is not running on these new accounts, i presume because gp is not finishing itself.
any further help?
many thanks |
|
|
|
dmarelia
Moderator
USA
2828 Posts
Status: offline |
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 09/09/2004 : 03:11:36 AM
|
Hi,
The logon script was my fault, found out when i looked properly and noticed a misplaced EndIf on the kix script.
I reset IEM, but still no joy. the only settings i've set is the proxy and homepage. I've added these reg keys to my kixscript for now, but i want to get rid of this problem.
Is there anyway other than userevn.log to find out in more detail whats going on?
The mrxsmb errors are still cropping up, some on there own accord, some a few seconds within the RSOP error.
Thanks for your help |
|
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 09/09/2004 : 10:44:04 AM
|
Just to update, im actually getting this on every account even my account. I have gone through gpmc and ensured that every GPO had the latest adm's. but this is still happening, so im stumped.
Any Clues? |
|
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 09/09/2004 : 10:54:46 AM
|
I have a main GPO with just the computer policy enabled which is enforced with no overide, this applies to everyone.
My account has a user gpo different from the other accounts, but both have the computer policy disabled. |
|
|
|
dmarelia
Moderator
USA
2828 Posts
Status: offline |
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 09/10/2004 : 03:14:30 AM
|
every GPO the inetres.adm template. the root domain gpo only has the computer config active and the ou's for my users only have the users config enabled.
every GPO also has conf, system, wmplayer (MP10) and wuau.
I can export my gpos to xml if you want to have a look. |
|
|
|
dmarelia
Moderator
USA
2828 Posts
Status: offline |
|
|
ashredox
Welcome Newcomer
3 Posts
Status: offline |
Posted - 09/22/2004 : 03:01:16 AM
|
Yeah I am having the exact same problem on one of my winxp PC (with sp2). The domain is win2003. All the rest of the PCs are fine.
The error in the userenv.log is "Extension Internet Explorer Branding was not able to log data. Error = 0x80004005, dwRet = 1252,leaving the log dirty"
Any ordinary user has this error except when I log on as the domain admin on that PC. The interesting thing is that the same group policy is also applied to the doamin admin also, yet the entry in userenv.log for the domain admin account says it detected the dirty log but cleared it.
Any help would be appriciated. |
|
|
|
dmarelia
Moderator
USA
2828 Posts
Status: offline |
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 09/30/2004 : 04:45:51 AM
|
this is my brndlog.txt, this is the same for other users who are not part of the administrators group.
08/31/2004 15:24:11 COM initialized on a second attempt with S_FALSE success code!
08/31/2004 15:24:11 Processing Group Policy...
08/31/2004 15:24:11 Starting Internet Explorer group policy processing part 1 (copying files) ...
08/31/2004 15:24:11 Done.
08/31/2004 15:24:11 Clearing policies set by a previous list of GPOs...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Starting Internet Explorer group policy processing part 2 ...
08/31/2004 15:24:12 Branding Internet Explorer...
08/31/2004 15:24:12 Command line is "BrandInternetExplorer /mode:gp /ins:"C:\Documents and Settings\loughlina.mydomain\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0\INSTALL.INS" /flags:eriu=1,favo=1,qlo=1,swu=1,sbs=1".
08/31/2004 15:24:12 Global branding settings are:
08/31/2004 15:24:12 Context is (0x00800200) "Group Policy";
08/31/2004 15:24:12 Settings file is "C:\Documents and Settings\loughlina.mydomain\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0\INSTALL.INS";
08/31/2004 15:24:12 Target folder path is "C:\Documents and Settings\loughlina.mydomain\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0".
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 About to clear previous branding...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing migration of old settings...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing wininet setup...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing deletion of connection settings...
08/31/2004 15:24:12 Existing connection settings weren't specified to be deleted!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing zones HKCU settings...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing local machine policies and restrictions...
08/31/2004 15:24:12 "seczones.inf" processed successfully.
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing current user policies and restrictions...
08/31/2004 15:24:12 "seczones.inf" processed successfully.
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing legacy policies and restrictions...
08/31/2004 15:24:12 There are no legacy *.inf files to process!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing general customizations...
08/31/2004 15:24:12 Browser title is set to "Microsoft Internet Explorer provided by Swalcliffe Park School".
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing Help->About customization...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing browser toolbar buttons...
08/31/2004 15:24:12 There are no toolbar buttons to process!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing root certificates...
08/31/2004 15:24:12 This feature is for ISPs only!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing deletion of favorites and/or quick links...
08/31/2004 15:24:12 None of the favorites folders were specified to be deleted!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing favorites...
08/31/2004 15:24:12 There are no favorites to add!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing ordering of favorites...
08/31/2004 15:24:12 Favorites will be put into the default position!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing quick links...
08/31/2004 15:24:12 There are no quick links to add!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing ordering of quick links...
08/31/2004 15:24:12 Quick Links will be put into the default position!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing connection settings...
08/31/2004 15:24:12 Settings from the *.ins file will be applied to LAN connection!
08/31/2004 15:24:12 Processing autoconfig settings from the ins file...
08/31/2004 15:24:12 "Flags" is set to 0x1.
08/31/2004 15:24:12 "Autoconfig URL" is set to "".
08/31/2004 15:24:12 "Autoproxy URL" is set to "".
08/31/2004 15:24:12 "Autoconfig reload delay" is set to 0 minutes.
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing proxy settings from the ins file...
08/31/2004 15:24:12 "Flags" is set to 0x3.
08/31/2004 15:24:12 "ProxyServer" is set to "server2:8080".
08/31/2004 15:24:12 "ProxyBypass" is set to "<local>".
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Notified ICW that connection to the Internet is configured.
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing TrustedPublisherLockdown restriction...
08/31/2004 15:24:12 This restriction is not set!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Registering download URLs as safe for updating IE...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Deleting links...
08/31/2004 15:24:12 No links to delete!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Branding Outlook Express...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing active desktop customizations...
08/31/2004 15:24:12 No desktop customizations to process!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing channels and their categories (if any)...
08/31/2004 15:24:12 There are no channels to process!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing software update channels...
08/31/2004 15:24:12 There are no software update channels to add!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Actual processing of channels by calling webcheck.dll "DllInstall" API...
08/31/2004 15:24:12 There is no webcheck processing necessary!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Showing channel bar on the desktop...
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Processing subscriptions...
08/31/2004 15:24:12 There are no subscriptions to process!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Refreshing browser settings...
08/31/2004 15:24:12 Skipping browser refresh at login time!
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Done.
08/31/2004 15:24:12 Favorites will be put into the default position!
08/31/2004 15:24:12 Quick Links will be put into the default position!
08/31/2004 15:24:12 There are no subscriptions to process!
08/31/2004 15:24:12 Done processing group policy.
|
|
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 09/30/2004 : 04:49:20 AM
|
just looked at my seczones.inf under C:\Documents and Settings\loughlina.mydomain\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0
first few lines below.
[Version]
Signature=$Chicago$
AdvancedINF=2.5
[DefaultInstall]
RequiredEngine=SetupAPI,"Fatal Error - missing setupapi.dll"
CustomDestination=CustInstDestSection
AddReg=AddReg.Hkcu,AddReg.Hklm
[IeakInstall.Hkcu]
RequiredEngine=SetupAPI,"Fatal Error - missing setupapi.dll"
CustomDestination=CustInstDestSection
AddReg=AddReg.Hkcu
[IeakInstall.Hklm]
RequiredEngine=SetupAPI,"Fatal Error - missing setupapi.dll"
CustomDestination=CustInstDestSection
AddReg=AddReg.Hklm
is this any problem? |
|
|
|
dmarelia
Moderator
USA
2828 Posts
Status: offline |
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 10/08/2004 : 03:47:13 AM
|
Internet Explorer Branding is whats being flagged up in RSOP.
The homepages and Favorites are not being processed.
USERENV(23c.fa4) 09:43:32:728 ProcessGPOs: Processing extension Internet Explorer Branding
USERENV(23c.fa4) 09:43:32:728 ReadStatus: Read Extension's Previous status successfully.
USERENV(23c.fa4) 09:43:32:728 CompareGPOLists: The lists are the same.
USERENV(23c.fa4) 09:43:32:728 ProcessGPOList: Entering for extension Internet Explorer Branding
USERENV(23c.fa4) 09:43:32:728 UserPolicyCallback: Setting status UI to Applying Internet Explorer Branding policy...
USERENV(23c.fa4) 09:43:32:744 LogExtSessionStatus: Successfully logged Extension Session data
USERENV(23c.fa4) 09:43:32:744 UserPolicyCallback: Setting status UI to Applying your personal settings...
USERENV(23c.fa4) 09:43:32:744 ProcessGPOList: Extension Internet Explorer Branding returned 0x4e4.
USERENV(23c.fa4) 09:43:32:744 ProcessGPOList: Extension Internet Explorer Branding was not able to log data. Error = 0x80004005, dwRet = 1252,leaving the log dirty |
|
|
|
dmarelia
Moderator
USA
2828 Posts
Status: offline |
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 10/11/2004 : 06:57:24 AM
|
| I have tried that already, but to no avail. |
|
|
|
j.voisey
Welcome Newcomer
Cyprus
5 Posts
Status: offline |
Posted - 12/16/2004 : 09:01:05 AM
|
| Is anyone running Windows XP sp2 clients in a Windows Server 2003 domain who doesn't get these errors when applying Internet Explorer Maintenance settings in a GPO? |
Jeremy Voisey |
Edited by - j.voisey on 12/16/2004 09:33:39 AM |
|
|
|
j.voisey
Welcome Newcomer
Cyprus
5 Posts
Status: offline |
Posted - 12/16/2004 : 09:10:01 AM
|
I'm getting the exactly same problem in a School Lab.
We have a Windows Server 2003 (Enteprise) and XP Clients.
Internet Explorer Branding is failing when
Non-Admin users log onto Windows XP sp2 clients. It works fine otherwise.
The reason that brndlog looks fine, is that the process doesn't reach that far. So brndlog records the last sucessful application.
Verbose logging doesn't shed any new light on the cause of the error.
In addition, If you try RSOP for a non-admin user (while logged on as an admin) you get the warning on the user and the following error.
11 December 2004 15:40:05
Internet Explorer Branding failed due to the error listed below and failed to log resultant set of policy information.
There is no error listed below!
if you've found a soloution I'd be very grateful to know what it was.
|
Jeremy Voisey |
|
|
|
ashredox
Welcome Newcomer
3 Posts
Status: offline |
Posted - 12/19/2004 : 8:09:24 PM
|
Okay I got a solution but it is really one that needs a bit of work but is very easy. Yes the whole thing seems to be related to folder redirection and the fact the IE maintenace policy only seems to be created and received by the user on first logon. So far nothing has solved this issue excpet this:
1. Identify the user account that is having the problem.
2. Log the user off.
3. Create a new OU anywhere and put the affceted user account in this OU.
4. Block policy inheritance to this OU. Very important to make sure this user is not getting any plocies from anywhere.
Create a new IE plocy in it that sets the proxy and home page only.
5. Delete the affacted users's profile. Make sure you do not delete the users documents and such
6. Delete the affacted users application data folder. Since all this was redirected for me I just delete the folders.
7. get the user to log on.
8. You will now notice that the user can get the home folder settings and can browse the Internet.
9. Log the user off now.
10. Move the user back to his/her old OU.
11. Get the user to log on. Create any printers and mail profile that the user had before.
12. Delete the OU you created in step 3 and the associated policy that you created with it.
cheers
|
|
|
|
dmarelia
Moderator
USA
2828 Posts
Status: offline |
|
|
ashredox
Welcome Newcomer
3 Posts
Status: offline |
Posted - 12/19/2004 : 11:54:01 PM
|
Yeah I know that but hardly anybody has a solution. I took a day out just to investigate it and get an interim solution that I posted.
cheers |
|
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 12/20/2004 : 05:11:30 AM
|
unfortunatly, you can't do this interim fix for a 100 users. it's just not feasable.
i just put the homepage and proxy settings in my kix logon script, thats the best interim solution for a large AD.
if anyone wants the script, i'll happily post it. |
|
|
|
j.voisey
Welcome Newcomer
Cyprus
5 Posts
Status: offline |
Posted - 12/20/2004 : 07:00:43 AM
|
quote:
Originally posted by alanloughlin
unfortunatly, you can't do this interim fix for a 100 users. it's just not feasable.
i just put the homepage and proxy settings in my kix logon script, thats the best interim solution for a large AD.
if anyone wants the script, i'll happily post it.
It's nice to know that it's an MS problem and not my fault!
I'd be grateful if you post a copy of the script.
|
Jeremy Voisey |
|
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 12/21/2004 : 03:51:38 AM
|
WRITEVALUE("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings", "ProxyEnable", "00000001", "REG_DWORD")
WRITEVALUE("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings", "EnableHttp1_1", "00000001", "REG_DWORD")
WRITEVALUE("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings", "ProxyHttp1.1", "00000001", "REG_DWORD")
WRITEVALUE("HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings", "ProxyServer", "proxyserver:8080", "REG_SZ")
WRITEVALUE("HKCU\Software\Microsoft\Internet Explorer\Main", "Start Page", "http://intranet/", "REG_SZ")
each write value should be on it's own line. you can get kix from kixtart.org |
|
|
|
dmarelia
Moderator
USA
2828 Posts
Status: offline |
|
|
mjwigham
Welcome Newcomer
1 Posts
Status: offline |
Posted - 01/07/2005 : 12:08:27 PM
|
Does anyone have the Fix available for download?
I spent 30 mins on the phone to Microsoft UK (situated in Ireland) this afternoon before they told me that that the Fix was withdrawn.
The guy on the phone didn't have a clue why it was removed or when a new fix would be available. |
|
|
|
alanloughlin
Welcome Newcomer
19 Posts
Status: offline |
Posted - 01/10/2005 : 04:22:42 AM
|
i finally got the fix after much debate with MS uk, and then... nothing, the fix doesn't actually fix this problem.
The hotfix only seems to contain iedkcs32.dll, this probably fixed somebodys problem but not this one. |
|
|
|
ianpage
Welcome Newcomer
United Kingdom
1 Posts
Status: offline |
Posted - 01/27/2005 : 04:52:28 AM
|
| I too am in communication with Microsoft UK about this issue. If I have any luck I'll be sure to post their response. |
|
|
|
adjuster
Welcome Newcomer
USA
6 Posts
Status: offline |
Posted - 01/28/2005 : 12:15:52 AM
|
I just got the hotfix from Microsoft by calling (800) 936-3600, choosing "Professional Support", choosing the "Obtain a Hotfix" option, and referencing article # 888254 with the nice lady who answered. It was actually wildly painless... I was surprised.
Initially, it was not working. This didn't surprise me since I didn't have any instructions on how to use it, and only knew to ask for it based on the postings in this forum.
I forced a policy refresh using "gpupdate.exe", and using SysInternals "RegMon", I found that during the policy refresh, winlogon.exe was looking for the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPO_BRANDING_WITH_FOLDER_REDIRECTION_KB888254
I created the key, but that still didn't fix it. RegMon showed that it was now looking for two values under that key, one called "winlogon.exe", and another called "*". I looked at the other keys around that, and found that they had DWORD values under them like:
"explorer.exe"=DWORD:00000001
or
"*"=DWORD:00000001
So I went ahead and created a "*" DWORD set to 1 under the key above, and the hotfix began to work.
---
Chalk this one up to yet another scenario where if I had the source code to the product I could just review the source, figure out the problem myself, and patch it. *sigh* Several more hours of my life wasted to the "state of the art" in troubleshooting closed-source software. Anybody besides me embarassed about how we "IT professionals" mostly have to poke and prod at problems, search web sites, and generally look like idiots in front of our co-workers or customers because, for the most part, we can't just get out the source and solve the damned problems?
(Before anybody says "You couldn't find the cause of that problem in the Windows source because you could never navigate the millions of lines of code and pick out that one little bit", think about the fact that it was already clear that the problem was inside the Internet Explorer branding DLL (IEDKCS32.DLL) based on reading docs about how Internet Explorer Maintenance policies are applied. Looking at the hotfix with "strings", I find things like "d:\nt\inetcore\setup\ieak5\brandll\globals.cpp". Looks like the source tree is pretty well organized to me... betya' I could've found and patched it... :)
|
|
|
|
Topic |
|
GPO and RSOP Issue
