January 2018 – A Geeks World

Customer is repeatedly getting this Event ID on all Servers and Clients, especially on the Domain Controllers being logged every 5 minute.

Warning	1/26/2018 3:08:15 PM	SceCli	1202	None

Log Name:      Application
Source:        SceCli
Date:          1/26/2018 3:08:15 PM
Event ID:      1202
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      SERVERNAME
Description:
Security policies were propagated with warning. 0x57 : The parameter is incorrect.

Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="SceCli" />
    <EventID Qualifiers="32768">1202</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2018-01-26T14:08:15.607182700Z" />
    <EventRecordID>147038</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SERVERNAME</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x57 : The parameter is incorrect.

Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".</Data>
  </EventData>
</Event>

Warning 1/26/2018 3:08:15 PM SceCli 1202 None

Log Name: Application

Source: SceCli

Date: 1/26/2018 3:08:15 PM

Event ID: 1202

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer: SERVERNAME

Description:

Security policies were propagated with warning. 0x57 : The parameter is incorrect.

Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".

Event Xml:

<Channel>Application</Channel>

<Computer>SERVERNAME</Computer>

</System>

<Data>0x57 : The parameter is incorrect.

Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".</Data>

</EventData>

</Event>

Searching for that Error gives thousands of results, most less helpful.The way I solved this problem was like this.

On one of the servers having the problem, run RSOP.MSC
Resultant Set of Policies showed a Warning on the Computer policies. Selecting properties there showed the same error as in our Event Log.
Browsing the Tree showed that there were a problem in the Password Policy section, from the Default Domain Policy.
Which were also visible in GPMC (Group Policy Management Console)
By modifying the Default Domain Policy and fixing the bad entries (no clue how they got there). The Error message (and problem) is now gone.