Customer is repeatedly getting this Event ID on all Servers and Clients, especially on the Domain Controllers being logged every 5 minute.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
Warning 1/26/2018 3:08:15 PM SceCli 1202 None Log Name: Application Source: SceCli Date: 1/26/2018 3:08:15 PM Event ID: 1202 Task Category: None Level: Warning Keywords: Classic User: N/A Computer: SERVERNAME Description: Security policies were propagated with warning. 0x57 : The parameter is incorrect. Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events". Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="SceCli" /> <EventID Qualifiers="32768">1202</EventID> <Level>3</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2018-01-26T14:08:15.607182700Z" /> <EventRecordID>147038</EventRecordID> <Channel>Application</Channel> <Computer>SERVERNAME</Computer> <Security /> </System> <EventData> <Data>0x57 : The parameter is incorrect. Advanced help for this problem is available on http://support.microsoft.com. Query for "troubleshooting 1202 events".</Data> </EventData> </Event> |
Searching for that Error gives thousands of results, most less helpful.The way I solved this problem was like this.
- On one of the servers having the problem, run RSOP.MSC
- Resultant Set of Policies showed a Warning on the Computer policies. Selecting properties there showed the same error as in our Event Log.
- Browsing the Tree showed that there were a problem in the Password Policy section, from the Default Domain Policy.
- Which were also visible in GPMC (Group Policy Management Console)
- By modifying the Default Domain Policy and fixing the bad entries (no clue how they got there). The Error message (and problem) is now gone.