JSI Tip 2378. Group Policies may not be applied and Events 1001 and 1000 are logged?JSI Tip 2378. Group Policies may not be applied and Events 1001 and 1000 are logged?

If your DFS Client is disabled, Group Policies may not be applied and your Event log contains messages similar to:

        Event Type: Error        Event Source: Userenv        Event Category: None        Event ID: 1000        Date: 4/7/2000        Time: 4:25:40 AM        User: NT AUTHORITYSYSTEM        Computer: MYCOMPUTER        Description: Windows cannot access the registry information at        \mydomain.comsysvolmydomain.comPolicies\{31B2F340-016D-11D2-945F-00C04FB984F9}Machineregistry.pol        with (51).         Event Type: Error        Event Source: SceCli        Event Category: None        Event ID: 1001        Date: 4/7/2000        Time: 4:30:46 AM        User: N/A        Computer: MYCOMPUTER        Description: Security policy cannot be propagated. Cannot access the template. Error code = 3.        \mydomain.comsysvolmydomain.comPolicies\{31B2F340-016D-11D2-945F-00C04FB984F9}MachineMicrosoftWindows        NTSecEditGptTmpl.inf.         Event Type: Error        Event Source: Userenv        Event Category: None        Event ID: 1000        Date: 4/7/2000        Time: 4:30:46 AM        User: NT AUTHORITYSYSTEM        Computer: MYCOMPUTER        Description: The Group Policy client-side extension Security was passed flags (17) and returned a failure        status code of (3).

If the DFS Client is disabled, you can NOT access the \Sysvol share, which would cause this problem.

To check / enable the DFS Client, use Regedt32 to navigate to:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesMup

Double-click the DisableDFS value name, a REG_DWORD data type.

A data value of 0, the default, enables the DFS Client. A data value of 1 disables the DFS Client.

NOTE: If the DisableDFS value name is missing, the DFS Client is enabled.