I've seen that error before, but not with the part you have that says "a possible attempt to compromise security". In our case, it is because the computer account is in a location in AD where it does not have enough rights to read its own account information (can also happen to user accounts). Adding permissions will always resolve it for us. Do you have a setup like ours where you move important accounts to a locked-down location in your AD?
-Bonnie From: James Rankin [mailto:[EMAIL PROTECTED] Sent: Tuesday, July 22, 2008 5:51 AM To: NT System Admin Issues Subject: Re: Strange event viewer error As in my first post, this is the error, 1053 in the application log from source Userenv Windows cannot determine the user or computer name. (The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you. ). Group Policy processing aborted. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. 2008/7/22 Kelsay, Mark <[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>>: Could you post the error? From: James Rankin [mailto:[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>] Sent: 22 July 2008 13:23 To: NT System Admin Issues Subject: Re: Strange event viewer error No useful information on there unfortunately. Lots of weird and wonderful solutions though, none of which seem to apply to my situation. I was just wondering if anyone had seen it before under similar circumstances and might be able to give me some pointers. 2008/7/22 Kelsay, Mark <[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>>: Have you looked it up on www.eventid.net<http://www.eventid.net>? I find this to be a valuable resource. Mark From: James Rankin [mailto:[EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]>] Sent: 22 July 2008 08:58 To: NT System Admin Issues Subject: Strange event viewer error Does anyone know what might be causing event id 1053 in my application log on one particular server? Operations Manager is going berserk about it and I am wondering whether it is anything to worry about. The server in question is a Windows 2003 SP2 member server running some database applications that interact with a Sun server, occasionally the server is under heavy load but nothing too far off the map. The event id text is "Windows cannot determine the user or computer name. (The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you. ). Group Policy processing aborted." Any pointers would be appreciated, Google indicated some possible issues with handle leaks but there are none on the system. TIA, JRR ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ****** This email is sent for and on behalf of Inspop.com Limited ****** Authorised and regulated by the Financial Services Authority. Registration no. 310635. Inspop.com Limited (also trading as "Confused.com") is registered in England and Wales at 2nd Floor, Friary House, Greyfriars Road, Cardiff, CF10 3AE (Reg. No. 03857130 ). Any opinions expressed in this email are those of the individual and not necessarily the company. This email and any files transmitted with it, including replies and forwarded copies (which may contain alterations) subsequently transmitted from the Company, are confidential and solely for the use of the intended recipient. It may contain material protected by attorney-client privilege. If you are not the intended recipient or the person responsible for delivering to the intended recipient, be advised that you have received this email in error and that any use is strictly prohibited. If you have received this email in error please notify the Information Security Officer by telephone on +44 (0) 29 2043 4200. Please then delete this email and destroy any copies of it. This email has been swept for viruses before leaving our system. Security Warning: Please note that this email has been created in the knowledge that Internet email is not a 100% secure communications medium. We advise that you understand and accept this lack of security when emailing us. Viruses: Although we have taken steps to ensure that this email and any attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free. We may monitor the content of E-mails sent and received via our network for viruses or unauthorised use and for other lawful business purposes. ________________________________________________________________________ This e-mail has been scanned for all viruses by Messagelabs. The service is powered by MessageLabs. ________________________________________________________________________ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ****** This email is sent for and on behalf of Inspop.com Limited ****** Authorised and regulated by the Financial Services Authority. Registration no. 310635. Inspop.com Limited (also trading as "Confused.com") is registered in England and Wales at 2nd Floor, Friary House, Greyfriars Road, Cardiff, CF10 3AE (Reg. No. 03857130 ). Any opinions expressed in this email are those of the individual and not necessarily the company. This email and any files transmitted with it, including replies and forwarded copies (which may contain alterations) subsequently transmitted from the Company, are confidential and solely for the use of the intended recipient. It may contain material protected by attorney-client privilege. If you are not the intended recipient or the person responsible for delivering to the intended recipient, be advised that you have received this email in error and that any use is strictly prohibited. If you have received this email in error please notify the Information Security Officer by telephone on +44 (0) 29 2043 4200. Please then delete this email and destroy any copies of it. This email has been swept for viruses before leaving our system. Security Warning: Please note that this email has been created in the knowledge that Internet email is not a 100% secure communications medium. We advise that you understand and accept this lack of security when emailing us. Viruses: Although we have taken steps to ensure that this email and any attachments are free from any virus, we advise that in keeping with good computing practice the recipient should ensure they are actually virus free. We may monitor the content of E-mails sent and received via our network for viruses or unauthorised use and for other lawful business purposes. ________________________________________________________________________ This e-mail has been scanned for all viruses by Messagelabs. The service is powered by MessageLabs. ________________________________________________________________________ ~ Upgrade to Next Generation Antispam/Antivirus with Ninja! ~ ~ <http://www.sunbelt-software.com/SunbeltMessagingNinja.cfm> ~
