Note : Old Post – Republished
We have encountered a strange issue recently and i have to say that MS is not documenting this feature very well.
In the Event Viewer -Application Log- if you have an error id 1053 and description is similar to “Windows Cannot determine the user or computer name access is denied. Group policy aborted
When you run the resultant set of policy, if you have a red cross in the report and an error similar to the following in the component status section
Group Policy Infrastructure failed due to the error listed below. (…) Access Denied … policy aborted
When you run DCDiag, you receive a warning about attribute userAccountControl value that is 0x82020 instead of 0x82000
Default value exists for this UserAccountControl attribute (see http://support.microsoft.com/kb/305144)
If a machine cannot process the GPO, it’s possible that the UserAccount Control flag value has been changed and you need to reset it to the default value
You need to reset the value to the default. You will need Adsiedit.msc go to the Domain node and locate the DC who has the problem. Right-click on the DC object and in the attributes tab locate the useraccountControl attribute. The default value should be set to 532480.
In some other blogs, I was reading that pre-creating accounts in your AD could change the value of this attribute
I think that this post might be useful because i’ve seen a lot of people having a “similar” problem. maybe this trick will solve their problems.. Who knows
till next time