stealthwifi12
asked on
Event ID 1053 Source Userenv Category None User NT AUTHORITY\SYSTEM
I started recieving the below error about 300 times a day in my event log right after upgrading from WSS 2.0 to 3.0. WSS 3.0 administration and sites work fine. I checked the services for WSS and none are running as NT AUTHORITY\SYSTEM. No other changes have been made and dcdiag comes back with all passed. Once again everything worked fine until the wss 3.0 upgrade. SharePoint Central Administration v3 app pool is running as Network Service, and the only sharepoint site is running as IWAM_SERVERNAME.
No noticable issues except for the event log being filled up with this error.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1053
Date: 5/14/2009
Time: 8:21:49 AM
User: NT AUTHORITY\SYSTEM
Computer: SERVERNAME
Description:
Windows cannot determine the user or computer name. (The format of the specified domain name is invalid. ). Group Policy processing aborted.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
No noticable issues except for the event log being filled up with this error.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1053
Date: 5/14/2009
Time: 8:21:49 AM
User: NT AUTHORITY\SYSTEM
Computer: SERVERNAME
Description:
Windows cannot determine the user or computer name. (The format of the specified domain name is invalid. ). Group Policy processing aborted.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Haven't confirmed this yet ... but it is looking like WSS 3 is supposed to use .NET 3 and the error messages you are showing are referencing .Net 2 ... could be an issue with the .Net version.
Ooops ... meant to post this link along with that statement ... http://technet.microsoft.com/en-us/library/cc288005.aspx
ASKER
.NET 3 is installed (attacehd picture)
framework.bmp
framework.bmp
Ok, not sure on the .Net 2 issues ... since they only show up once it might not be an issue.
Have you checked the network configuration on the server?
This appears to be an IP domain reference problem.
Under older versions of the OS this was caused by the DNS suffix not matching the domain reference of the domain controller.
Have you checked the network configuration on the server?
This appears to be an IP domain reference problem.
Under older versions of the OS this was caused by the DNS suffix not matching the domain reference of the domain controller.
ASKER
Network config is fine, dcdiag comes back all passed.
I did a repair of wss 3 and restart now all of a sudden I am getting these two:
Event Type: Error
Event Source: Windows SharePoint Services 2.0
Event Category: None
Event ID: 1000
Date: 5/15/2009
Time: 10:09:23 AM
User: N/A
Computer: SERVER
Description:
#30002: Error 5 opening registry key "SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\Secure\ConfigDb ".
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Windows SharePoint Services 2.0
Event Category: None
Event ID: 1000
Date: 5/15/2009
Time: 10:09:23 AM
User: N/A
Computer: SERVER
Description:
(#5: Access is denied.)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I did a repair of wss 3 and restart now all of a sudden I am getting these two:
Event Type: Error
Event Source: Windows SharePoint Services 2.0
Event Category: None
Event ID: 1000
Date: 5/15/2009
Time: 10:09:23 AM
User: N/A
Computer: SERVER
Description:
#30002: Error 5 opening registry key "SOFTWARE\Microsoft\Shared
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: Windows SharePoint Services 2.0
Event Category: None
Event ID: 1000
Date: 5/15/2009
Time: 10:09:23 AM
User: N/A
Computer: SERVER
Description:
(#5: Access is denied.)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
ASKER
On that key:
System has full control
STS_WPG has read
Network Service has read
Admin has full control
System has full control
STS_WPG has read
Network Service has read
Admin has full control
It looks like something did not get installed and is still running from v2.
Have you rebooted since you did the upgrade?
Have you rebooted since you did the upgrade?
ASKER
I added WSS_WPG wth Read permissions and that didn't change anything
ASKER
Yep rebooted after upgrade and am rebooting now as well. I will post any new errors when it comes back online.
This might help. http://bloggingabout.net/blogs/mglaser/archive/2006/12/08/Upgrade-TFS-V1-to-WSS-3.0-Guide.aspx
It is a detailed step by step guide to installing wss 3 on a server that already has 2. It might give you some idea as to what is causing the problem you are having.
It is a detailed step by step guide to installing wss 3 on a server that already has 2. It might give you some idea as to what is causing the problem you are having.
ASKER
Ok just rebooted and have the below:
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/15/2009
Time: 10:30:41 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\DtcInstall.log
Handle ID: -
Operation ID: {0,88064}
Process ID: 1548
Image File Name:
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: READ_CONTROL
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
ReadEA
WriteEA
ReadAttributes
WriteAttributes
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x12019F
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/15/2009
Time: 10:30:41 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\system32\MsDtc\ Trace\dtct race.log
Handle ID: -
Operation ID: {0,88309}
Process ID: 1548
Image File Name:
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: DELETE
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x10000
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/15/2009
Time: 10:31:37 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\system32\wbem\I PMISDR.dat
Handle ID: -
Operation ID: {0,337123}
Process ID: 4132
Image File Name:
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: READ_CONTROL
SYNCHRONIZE
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
WriteEA
ReadAttributes
WriteAttributes
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x120196
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
and still:
Event Type: Error
Event Source: Windows SharePoint Services 2.0
Event Category: None
Event ID: 1000
Date: 5/15/2009
Time: 10:35:29 AM
User: N/A
Computer: SERVER
Description:
#30002: Error 5 opening registry key "SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\Secure\ConfigDb ".
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/15/2009
Time: 10:30:41 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\DtcInstall.log
Handle ID: -
Operation ID: {0,88064}
Process ID: 1548
Image File Name:
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: READ_CONTROL
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
ReadEA
WriteEA
ReadAttributes
WriteAttributes
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x12019F
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/15/2009
Time: 10:30:41 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\system32\MsDtc\
Handle ID: -
Operation ID: {0,88309}
Process ID: 1548
Image File Name:
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: DELETE
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x10000
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/15/2009
Time: 10:31:37 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\system32\wbem\I
Handle ID: -
Operation ID: {0,337123}
Process ID: 4132
Image File Name:
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: READ_CONTROL
SYNCHRONIZE
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
WriteEA
ReadAttributes
WriteAttributes
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x120196
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
and still:
Event Type: Error
Event Source: Windows SharePoint Services 2.0
Event Category: None
Event ID: 1000
Date: 5/15/2009
Time: 10:35:29 AM
User: N/A
Computer: SERVER
Description:
#30002: Error 5 opening registry key "SOFTWARE\Microsoft\Shared
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
We're going to need a WSS person to help out here.
Unfortunately I just don't know enough about it.
Unfortunately I just don't know enough about it.
ASKER
I'm going to uninstall Sharepoint and do a clean install of wss 3.0 see of that helps
Check your add/remove programs ... the errors look like you still have wss 2 or part of it installed.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
One last thing to try.
Based on the error that is being reported, SPS 2.0 service is still trying to run ... the error is stating that it cannot access the particular registry setting.
I read that IIS can hold onto some config info so ...
Assuming wss 2 is completely uninstalled.
After removing WSS 3, delete all of the directories associated with SPS from the program files directory
Uninstall IIS, then remove the INETPUB directory ... this should completely remove all references to the app, unless there is something in the registry.
Reboot and then reinstall IIS then WSS 3
(if this works then the errors should be gone after the reboot.)
Based on the error that is being reported, SPS 2.0 service is still trying to run ... the error is stating that it cannot access the particular registry setting.
I read that IIS can hold onto some config info so ...
Assuming wss 2 is completely uninstalled.
After removing WSS 3, delete all of the directories associated with SPS from the program files directory
Uninstall IIS, then remove the INETPUB directory ... this should completely remove all references to the app, unless there is something in the registry.
Reboot and then reinstall IIS then WSS 3
(if this works then the errors should be gone after the reboot.)
ASKER
This is a production server hosting multiple websites, I am unable to uninstall IIS (it would take days to reconfigure). I have allready performed the other steps and that did not work.
ASKER
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/14/2009
Time: 1:17:12 AM
User: ACCESSSAFETY\IWAM_SERVERNA
Computer: SERVERNAME
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\Microsoft.NET\F
Handle ID: -
Operation ID: {0,1830899139}
Process ID: 612
Image File Name: C:\WINDOWS\system32\inetsr
Primary User Name: IWAM_SERVERNAME
Primary Domain: DOMAINNAME
Primary Logon ID: (0x0,0x520A39C)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: READ_CONTROL
SYNCHRONIZE
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
WriteEA
ReadAttributes
WriteAttributes
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x120196
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/14/2009
Time: 2:08:18 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVERNAME
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\Microsoft.NET\F
Handle ID: -
Operation ID: {0,1856821131}
Process ID: 7784
Image File Name: C:\WINDOWS\system32\inetsr
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: READ_CONTROL
SYNCHRONIZE
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
WriteEA
ReadAttributes
WriteAttributes
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x120196
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.