Question about errors found in the event viewer

Posted on 2005-05-04
Medium Priority
Last Modified: 2008-01-09
I am seeing the following errors in Application section of  Event Viewer every 90 minutes (roughly)

Source: SceCli    EventID: 1202
Security policies are propagated with warning. 0x2 : The system cannot find the file specified.

Source: ESENT   EventID: 454
services (384) Database recovery/restore failed with unexpected error -1811.

Source: ESENT    EventID: 439
services (384) Unable to write a shadowed header for file C:\WINNT\security\templates\spsecupd.sdb.

This is a 2000 Server (SP4) system.. Any ideas on how to fix this?  I did a little research and none of the solutions I found seemed to fit my situation.  They were saying things about disk storage being low and other simple things like that.

Question by:bwooden
  • 2

Expert Comment

ID: 13928799
As an admin, one of the most usefull websites that I have come across is www.eventid.net
You simple typy in the EventID number and it brings back results of the problem you had and solutions that users used to resolve the issue.

Check it out :)

Hope I could help
LVL 10

Accepted Solution

Seelan Naidoo earned 1000 total points
ID: 13929009
Looks like a corrupt security database file.

Event ID 439 relates to a corrupt security database file which can be rebuilt using the Security Configuration and Analysis snap-in in MMC

To resolve this issue, use the procedure described in this section to re-create the local Group Policy file.

Important Implementing a security template on a domain controller may change the settings of the Default Domain Controller Policy or Default Domain Policy. The applied template may overwrite permissions on new files, registry keys and system services created by other programs. Restoring these policies might be necessary after applying a security template. Before performing these steps on a domain controller, create a backup of the SYSVOL share.

Note When you use the following procedure, your computer is returned to the original installation state where the Local Security Policy is not defined.
You may have to start your computer in Safe mode to rename or move files.

1. Open the %SystemRoot%\Security folder, create a new folder, and then name it "OldSecurity".  
2. Move all of the files ending in .log from the %SystemRoot%\Security folder to the OldSecurity folder.
3. Find the Secedit.sdb file in the %SystemRoot%\Security\Database folder, and then rename this file to "Secedit.old".
4. Click Start, click Run, type mmc, and then click OK.
5. Click Console, click Add/Remove Snap-in, and then add the Security and Configuration snap-in.
6. Right-click Security and Configuration and Analysis, and then click Open Database.
7. Browse to the %SystemRoot%\Security\Database folder, type Secedit.sdb in the File name box, and then click Open.
8. When you are prompted to import a template, click Setup Security.inf, and then click Open.

Note If you receive an "Access denied" message, you can safely ignore it.

I also had a similar issue due to a disk space. Not enough free space to write temp file.

Author Comment

ID: 13929402
Thank you SeanUK777, that worked like a champ.  
LVL 10

Expert Comment

by:Seelan Naidoo
ID: 13929677
pleasure to be of assistence =)

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
If anyone asked you to network diagram of the internet, it was drawn in the form of a fluffy cloud which further became known as cloud computing. Popularly cloud computing is defined as workloads that run over the internet in a commercial provider’s…
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question