Event log on server 2012 filed with SceCli errors

[mikemcsharry]

I'm spotting a problem on logins on domain Pcs/laptops - all weindows 7 pro talking to a server 2012

 

On server I can see that the event log is filled with scicle errors 1202

 

I've followed through the info with the event itself and i've also been able to generate a winlogon.log file

 

In the RSOP at the DC I can see it points to log on locally - the info with the event log tells you to look for the red marks

The error mark are dropping in the domain controller security policy to start with -

 

The error shows (at the domain controller) as 'no mapping between account names and security IDs

the list in here on Group Policy

 

comp config\windows setings\security settings\local policies\user rights assignment has red x at domain controller security policy

in allow log on locally policy I see

account operators

administrators

backup operators

domain

enterprise domain controllers

domain\domain users

print operators

server operators

 

noticed in the default domain policy that in same setting nothing at all defined in .../allow log on locally policy

==================================

I then logged in to a pc as domain admin and found error also showing.

PC is showing - logon as a service

IIS-WPG

NETWORK

NETWORK SERVICE

NT SERVICE\ALL SERVICES

SERVICE

Again, nothing under restricted groups

 

Nothing seems to be stopping the users working okay, but it doesn't feel that this is quite right ..

Any suggestions?

 

Before I go carving through this and make it match the 'suggested defaults' - eg domain users on the domain controller - is there anything I need to watch out for?

Edited September 27, 2017 by mikemcsharry