If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Faulting application services.exe... faulting module esent.dll.. Help!
Hi there,
We recently removed 5 workstations from our domain and set them up on their own workgroup with a file share on one of the computers serving data and the FrontRange Goldmine 6.0 application (BDE version not SQL). Since then all of the Windows XP machines have had this message appear in the event log 5 to 6 times a day and then reboot automatically: Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x00023352. Along with this event is the SceCli 1202 event: Security policies were propagated with warning. 0x428 : An exception occurred in the service when handling the control request. For best results in resolving this event, log on with a non-administrative account and search http://support.microsoft.com for "Troubleshooting Event 1202's". And occasionally this: SOURCE: Userenv ID: 1085 The Group Policy client-side extension Security failed to execute. Please look for any errors reported earlier by that extension. These machines are all up to date (Windows XP/SP2) and have full antivirus protection / protected by hardware firewall / the whole works... So.. what the hell is going on?? I can't find any information on Microsoft's website or Google. Any ideas? Note that one of the five machines is Windows 2000 SP4 and seems to be fine... Thanks, Drew |
Ads |
#2
|
|||
|
|||
Faulting application services.exe... faulting module esent.dll.. Help!
Same problem here (WinXP/SP2). My laptop was removed from domain to workgroup without network connetion to the server. This is the error reason: at the moment gpo (domain policy has effect to the local account policy) does not work well and system shutdown/esent.dll errors occur and events 1202 and 1000. Solution: restore WinXP default local policies (copy group policy folder) or join a computer back to the domain and remove it again (must be connected to the server). Sami Holtta, MCSA -- Samiholt ------------------------------------------------------------------------ Posted via http://www.mcse.ms ------------------------------------------------------------------------ View this thread: http://www.mcse.ms/message1131051.html |
#3
|
|||
|
|||
Faulting application services.exe... faulting module esent.dll.. Help!
Btw, sometimes you cannot find a group policy folder, because when you create an Local GPO at the first time, you create this hidden folder: %SystemRoot%\SYSTEM32\GroupPolicy. You can also add a DisableGPO DWORD 1 Value in registry. Sami Holtta, MCSA -- Samiholt ------------------------------------------------------------------------ Posted via http://www.mcse.ms ------------------------------------------------------------------------ View this thread: http://www.mcse.ms/message1131051.html |
#4
|
|||
|
|||
I have solved same problem with crashing services.exe. User on bussiness trip removed his notebook from domain. He reports problem with error message : Title of window : Services and Controller app in error message: Error signature szAppName: Services.exe ..... in event log was event 1000 Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x0002334c. After clicking on Close button apears automatic shutdown counter and in 30 seconds system was restarted. This same behaviour repeated several times. In evet log I found misc. events with probably related with this problem: The Group Policy client-side extension Security failed to execute (event 1085) Faulting application services.exe Security policies were propagated with warning. 0x428 (event 1202) in winlogon.log (I have enabled debug for that purpose) I found: ----Configure Group Membership... Configure Administrators. Error 1332: No mapping between account names and security IDs was done. Error occurred during lookup of all accounts. It was seems that some domain policy that contains Restricted group feature remains on notebook and periodically in moment when policy was refreshed caused error with services.exe. I knew that when notebook was removed from domain then domain policy cannot applied to non-member computer. I made several actions : I again joined notebook to domain(then restart) and again I removed it and problem occured again and again. I disabled background policy refresh, I set refresh interval to max value 45 days and nothing helps. When automatic shutdown apears I stoped it every time by command shutdown /a. Every time I found in winlogon.log that some policy tryed manage membership in groups and ends with error because probably did not have access to domain (notebook was removed from domain). I have tryed to check consistency od secedit.sdb by esentutl /g %windir%\Security\Database\Secedit.sdb and all was OK. Excuse my english. After that i crossed my mind that it may not caused by deffective remained domain policy but it may caused by local group policy which contain domain accounts (SIDs). Thats my deduction. After that I moved c:\WINDOWS\security\Database\secedit.sdb and c:\WINDOWS\security\*edb* and c:\WINDOWS\security\*.log to backup folder and after restart local group policy was reseted and after that user confirmed that error never apears and all works fine. In my case (case of one of my users) problem with crashing services.exe and periodical restarts was solved by reseting local group policy (by removing database and related files). When I begin solving of this problem I spent to much time with searching similar problem on Internet but I din't found equal. This page was not usefull exactly in my cause but everytime when I searching on Inet by using misc. search engines I everytime get this page therefore I decided to write my solution here. I have writed in this my article too much informations because each user searching this problem on Internet with miscelaneous with keywords and therefore I writed so much (for search engines too). I hope that same case may happen to someone and my story may helps him. Admin from Slovak Republic (Slovakia not Slovenia) -- T0MASPosted from http://www.pcreview.co.uk/ newsgroup access |
#5
|
|||
|
|||
Thaks a lot You have save me lot of time. -- Jasen KolevPosted from http://www.pcreview.co.uk/ newsgroup access |
#6
|
|||
|
|||
We're seeing the same thing here; I can confirm the results. And since Tomas
posted a reply here, I thought I should too! Tomas' workaround worked for me, too, but while it fixes the ESENT.DLL crash, it has side effects you need to be aware of. If there are other security policies in GPO, they will not be removed when the computer is removed from the domain. The SceCli and Userenv errors will continue (although the SceCli one will change a bit). The only complete solution I know of is not to use Restricted Groups that have domain accounts among their members in a GPO that is in scope for a computer that will be removed from a domain. Fortunately, that was an option for us in this case, with only modest hardship. I haven't done this, yet, but will likely substitute a startup script that adds the group for me and the hardship will disappear; I don't care if the group doesn't get removed when the machine is removed from the domain. On a related note, I opened a Microsoft PSS incident for this. They have reproduced the behavior in their lab. PSS carefully avoided giving me any information about whether they intended to develop a fix; hopefully they will. This strikes me as a significant bug. -- Jeff Vandervoort JRVsystems "T0MAS" T0MAS.1q1k2c@ wrote in message ... I have solved same problem with crashing services.exe. User on bussiness trip removed his notebook from domain. He reports problem with error message : Title of window : Services and Controller app in error message: Error signature szAppName: Services.exe ..... in event log was event 1000 Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x0002334c. After clicking on Close button apears automatic shutdown counter and in 30 seconds system was restarted. This same behaviour repeated several times. In evet log I found misc. events with probably related with this problem: The Group Policy client-side extension Security failed to execute (event 1085) Faulting application services.exe Security policies were propagated with warning. 0x428 (event 1202) in winlogon.log (I have enabled debug for that purpose) I found: ----Configure Group Membership... Configure Administrators. Error 1332: No mapping between account names and security IDs was done. Error occurred during lookup of all accounts. It was seems that some domain policy that contains Restricted group feature remains on notebook and periodically in moment when policy was refreshed caused error with services.exe. I knew that when notebook was removed from domain then domain policy cannot applied to non-member computer. I made several actions : I again joined notebook to domain(then restart) and again I removed it and problem occured again and again. I disabled background policy refresh, I set refresh interval to max value 45 days and nothing helps. When automatic shutdown apears I stoped it every time by command shutdown /a. Every time I found in winlogon.log that some policy tryed manage membership in groups and ends with error because probably did not have access to domain (notebook was removed from domain). I have tryed to check consistency od secedit.sdb by esentutl /g %windir%\Security\Database\Secedit.sdb and all was OK. Excuse my english. After that i crossed my mind that it may not caused by deffective remained domain policy but it may caused by local group policy which contain domain accounts (SIDs). Thats my deduction. After that I moved c:\WINDOWS\security\Database\secedit.sdb and c:\WINDOWS\security\*edb* and c:\WINDOWS\security\*.log to backup folder and after restart local group policy was reseted and after that user confirmed that error never apears and all works fine. In my case (case of one of my users) problem with crashing services.exe and periodical restarts was solved by reseting local group policy (by removing database and related files). When I begin solving of this problem I spent to much time with searching similar problem on Internet but I din't found equal. This page was not usefull exactly in my cause but everytime when I searching on Inet by using misc. search engines I everytime get this page therefore I decided to write my solution here. I have writed in this my article too much informations because each user searching this problem on Internet with miscelaneous with keywords and therefore I writed so much (for search engines too). I hope that same case may happen to someone and my story may helps him. Admin from Slovak Republic (Slovakia not Slovenia) -- T0MASPosted from http://www.pcreview.co.uk/ newsgroup access |
#7
|
|||
|
|||
How do I move those files? The system says they are locked and in safe mode
they are gone? "Jeff Vandervoort" wrote: We're seeing the same thing here; I can confirm the results. And since Tomas posted a reply here, I thought I should too! Tomas' workaround worked for me, too, but while it fixes the ESENT.DLL crash, it has side effects you need to be aware of. If there are other security policies in GPO, they will not be removed when the computer is removed from the domain. The SceCli and Userenv errors will continue (although the SceCli one will change a bit). The only complete solution I know of is not to use Restricted Groups that have domain accounts among their members in a GPO that is in scope for a computer that will be removed from a domain. Fortunately, that was an option for us in this case, with only modest hardship. I haven't done this, yet, but will likely substitute a startup script that adds the group for me and the hardship will disappear; I don't care if the group doesn't get removed when the machine is removed from the domain. On a related note, I opened a Microsoft PSS incident for this. They have reproduced the behavior in their lab. PSS carefully avoided giving me any information about whether they intended to develop a fix; hopefully they will. This strikes me as a significant bug. -- Jeff Vandervoort JRVsystems "T0MAS" T0MAS.1q1k2c@ wrote in message ... I have solved same problem with crashing services.exe. User on bussiness trip removed his notebook from domain. He reports problem with error message : Title of window : Services and Controller app in error message: Error signature szAppName: Services.exe ..... in event log was event 1000 Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x0002334c. After clicking on Close button apears automatic shutdown counter and in 30 seconds system was restarted. This same behaviour repeated several times. In evet log I found misc. events with probably related with this problem: The Group Policy client-side extension Security failed to execute (event 1085) Faulting application services.exe Security policies were propagated with warning. 0x428 (event 1202) in winlogon.log (I have enabled debug for that purpose) I found: ----Configure Group Membership... Configure Administrators. Error 1332: No mapping between account names and security IDs was done. Error occurred during lookup of all accounts. It was seems that some domain policy that contains Restricted group feature remains on notebook and periodically in moment when policy was refreshed caused error with services.exe. I knew that when notebook was removed from domain then domain policy cannot applied to non-member computer. I made several actions : I again joined notebook to domain(then restart) and again I removed it and problem occured again and again. I disabled background policy refresh, I set refresh interval to max value 45 days and nothing helps. When automatic shutdown apears I stoped it every time by command shutdown /a. Every time I found in winlogon.log that some policy tryed manage membership in groups and ends with error because probably did not have access to domain (notebook was removed from domain). I have tryed to check consistency od secedit.sdb by esentutl /g %windir%\Security\Database\Secedit.sdb and all was OK. Excuse my english. After that i crossed my mind that it may not caused by deffective remained domain policy but it may caused by local group policy which contain domain accounts (SIDs). Thats my deduction. After that I moved c:\WINDOWS\security\Database\secedit.sdb and c:\WINDOWS\security\*edb* and c:\WINDOWS\security\*.log to backup folder and after restart local group policy was reseted and after that user confirmed that error never apears and all works fine. In my case (case of one of my users) problem with crashing services.exe and periodical restarts was solved by reseting local group policy (by removing database and related files). When I begin solving of this problem I spent to much time with searching similar problem on Internet but I din't found equal. This page was not usefull exactly in my cause but everytime when I searching on Inet by using misc. search engines I everytime get this page therefore I decided to write my solution here. I have writed in this my article too much informations because each user searching this problem on Internet with miscelaneous with keywords and therefore I writed so much (for search engines too). I hope that same case may happen to someone and my story may helps him. Admin from Slovak Republic (Slovakia not Slovenia) -- T0MASPosted from http://www.pcreview.co.uk/ newsgroup access |
#8
|
|||
|
|||
That didn't happen on my test system, but I don't like that workaround
anyway...too many side-effects. So I've only done it on one system, just to confirm PSS's results. My suggestion is to create a Startup Script that adds the Restricted Groups to the local SAM instead of using the AD Restricted Groups feature. Also, an update for all lurkers...make sure to append your "me too" message to this thread and keep it alive. I just received a call from MS PSS and they are evaluating the cost-effectiveness of fixing this issue. The guy I spoke to was skeptical that it affected many people...his reasoning was, "How many people disjoin a computer from a domain?". My client has a good reason to do so...how about you? I've given the Google Search URL for this thread to them and have reason to believe it's being monitored. I'm going to forward it again to the PSS contact who's preparing the business case for fixing it. So keep posting, folks! -- Jeff Vandervoort JRVsystems "DSipp" wrote in message ... How do I move those files? The system says they are locked and in safe mode they are gone? "Jeff Vandervoort" wrote: We're seeing the same thing here; I can confirm the results. And since Tomas posted a reply here, I thought I should too! Tomas' workaround worked for me, too, but while it fixes the ESENT.DLL crash, it has side effects you need to be aware of. If there are other security policies in GPO, they will not be removed when the computer is removed from the domain. The SceCli and Userenv errors will continue (although the SceCli one will change a bit). The only complete solution I know of is not to use Restricted Groups that have domain accounts among their members in a GPO that is in scope for a computer that will be removed from a domain. Fortunately, that was an option for us in this case, with only modest hardship. I haven't done this, yet, but will likely substitute a startup script that adds the group for me and the hardship will disappear; I don't care if the group doesn't get removed when the machine is removed from the domain. On a related note, I opened a Microsoft PSS incident for this. They have reproduced the behavior in their lab. PSS carefully avoided giving me any information about whether they intended to develop a fix; hopefully they will. This strikes me as a significant bug. -- Jeff Vandervoort JRVsystems "T0MAS" T0MAS.1q1k2c@ wrote in message ... I have solved same problem with crashing services.exe. User on bussiness trip removed his notebook from domain. He reports problem with error message : Title of window : Services and Controller app in error message: Error signature szAppName: Services.exe ..... in event log was event 1000 Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x0002334c. After clicking on Close button apears automatic shutdown counter and in 30 seconds system was restarted. This same behaviour repeated several times. In evet log I found misc. events with probably related with this problem: The Group Policy client-side extension Security failed to execute (event 1085) Faulting application services.exe Security policies were propagated with warning. 0x428 (event 1202) in winlogon.log (I have enabled debug for that purpose) I found: ----Configure Group Membership... Configure Administrators. Error 1332: No mapping between account names and security IDs was done. Error occurred during lookup of all accounts. It was seems that some domain policy that contains Restricted group feature remains on notebook and periodically in moment when policy was refreshed caused error with services.exe. I knew that when notebook was removed from domain then domain policy cannot applied to non-member computer. I made several actions : I again joined notebook to domain(then restart) and again I removed it and problem occured again and again. I disabled background policy refresh, I set refresh interval to max value 45 days and nothing helps. When automatic shutdown apears I stoped it every time by command shutdown /a. Every time I found in winlogon.log that some policy tryed manage membership in groups and ends with error because probably did not have access to domain (notebook was removed from domain). I have tryed to check consistency od secedit.sdb by esentutl /g %windir%\Security\Database\Secedit.sdb and all was OK. Excuse my english. After that i crossed my mind that it may not caused by deffective remained domain policy but it may caused by local group policy which contain domain accounts (SIDs). Thats my deduction. After that I moved c:\WINDOWS\security\Database\secedit.sdb and c:\WINDOWS\security\*edb* and c:\WINDOWS\security\*.log to backup folder and after restart local group policy was reseted and after that user confirmed that error never apears and all works fine. In my case (case of one of my users) problem with crashing services.exe and periodical restarts was solved by reseting local group policy (by removing database and related files). When I begin solving of this problem I spent to much time with searching similar problem on Internet but I din't found equal. This page was not usefull exactly in my cause but everytime when I searching on Inet by using misc. search engines I everytime get this page therefore I decided to write my solution here. I have writed in this my article too much informations because each user searching this problem on Internet with miscelaneous with keywords and therefore I writed so much (for search engines too). I hope that same case may happen to someone and my story may helps him. Admin from Slovak Republic (Slovakia not Slovenia) -- T0MASPosted from http://www.pcreview.co.uk/ newsgroup access |
#9
|
|||
|
|||
I am soo glad I found this post!!!!
I too am having the exact same problem. I had users that were disjoined from the Domain when we opened up an outstation. After all my searching for a problem I was convinced it had to be something specific with the "other" network they are now on. I am going to start wading through your fixes and see where I get. There was definately a business reason for removing the computers from the Domain and I would DEFINATELY call this a BUG... Thanks again! "Jeff Vandervoort" wrote: That didn't happen on my test system, but I don't like that workaround anyway...too many side-effects. So I've only done it on one system, just to confirm PSS's results. My suggestion is to create a Startup Script that adds the Restricted Groups to the local SAM instead of using the AD Restricted Groups feature. Also, an update for all lurkers...make sure to append your "me too" message to this thread and keep it alive. I just received a call from MS PSS and they are evaluating the cost-effectiveness of fixing this issue. The guy I spoke to was skeptical that it affected many people...his reasoning was, "How many people disjoin a computer from a domain?". My client has a good reason to do so...how about you? I've given the Google Search URL for this thread to them and have reason to believe it's being monitored. I'm going to forward it again to the PSS contact who's preparing the business case for fixing it. So keep posting, folks! -- Jeff Vandervoort JRVsystems "DSipp" wrote in message ... How do I move those files? The system says they are locked and in safe mode they are gone? "Jeff Vandervoort" wrote: We're seeing the same thing here; I can confirm the results. And since Tomas posted a reply here, I thought I should too! Tomas' workaround worked for me, too, but while it fixes the ESENT.DLL crash, it has side effects you need to be aware of. If there are other security policies in GPO, they will not be removed when the computer is removed from the domain. The SceCli and Userenv errors will continue (although the SceCli one will change a bit). The only complete solution I know of is not to use Restricted Groups that have domain accounts among their members in a GPO that is in scope for a computer that will be removed from a domain. Fortunately, that was an option for us in this case, with only modest hardship. I haven't done this, yet, but will likely substitute a startup script that adds the group for me and the hardship will disappear; I don't care if the group doesn't get removed when the machine is removed from the domain. On a related note, I opened a Microsoft PSS incident for this. They have reproduced the behavior in their lab. PSS carefully avoided giving me any information about whether they intended to develop a fix; hopefully they will. This strikes me as a significant bug. -- Jeff Vandervoort JRVsystems "T0MAS" T0MAS.1q1k2c@ wrote in message ... I have solved same problem with crashing services.exe. User on bussiness trip removed his notebook from domain. He reports problem with error message : Title of window : Services and Controller app in error message: Error signature szAppName: Services.exe ..... in event log was event 1000 Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x0002334c. After clicking on Close button apears automatic shutdown counter and in 30 seconds system was restarted. This same behaviour repeated several times. In evet log I found misc. events with probably related with this problem: The Group Policy client-side extension Security failed to execute (event 1085) Faulting application services.exe Security policies were propagated with warning. 0x428 (event 1202) in winlogon.log (I have enabled debug for that purpose) I found: ----Configure Group Membership... Configure Administrators. Error 1332: No mapping between account names and security IDs was done. Error occurred during lookup of all accounts. It was seems that some domain policy that contains Restricted group feature remains on notebook and periodically in moment when policy was refreshed caused error with services.exe. I knew that when notebook was removed from domain then domain policy cannot applied to non-member computer. I made several actions : I again joined notebook to domain(then restart) and again I removed it and problem occured again and again. I disabled background policy refresh, I set refresh interval to max value 45 days and nothing helps. When automatic shutdown apears I stoped it every time by command shutdown /a. Every time I found in winlogon.log that some policy tryed manage membership in groups and ends with error because probably did not have access to domain (notebook was removed from domain). I have tryed to check consistency od secedit.sdb by esentutl /g %windir%\Security\Database\Secedit.sdb and all was OK. Excuse my english. After that i crossed my mind that it may not caused by deffective remained domain policy but it may caused by local group policy which contain domain accounts (SIDs). Thats my deduction. After that I moved c:\WINDOWS\security\Database\secedit.sdb and c:\WINDOWS\security\*edb* and c:\WINDOWS\security\*.log to backup folder and after restart local group policy was reseted and after that user confirmed that error never apears and all works fine. In my case (case of one of my users) problem with crashing services.exe and periodical restarts was solved by reseting local group policy (by removing database and related files). When I begin solving of this problem I spent to much time with searching similar problem on Internet but I din't found equal. This page was not usefull exactly in my cause but everytime when I searching on Inet by using misc. search engines I everytime get this page therefore I decided to write my solution here. I have writed in this my article too much informations because each user searching this problem on Internet with miscelaneous with keywords and therefore I writed so much (for search engines too). I hope that same case may happen to someone and my story may helps him. Admin from Slovak Republic (Slovakia not Slovenia) -- T0MASPosted from http://www.pcreview.co.uk/ newsgroup access |
#10
|
|||
|
|||
Faulting application services.exe... faulting module esent.dll
Well, my "grass roots" campaign has failed. Only 1 "me too". Whether that
had anything to do with the outcome or not, I don't know, but the response I just received from Microsoft is that they have no current plans to fix this bug. It has been submitted as a change request for future consideration. Folks, it's official: We're on our own. Good luck! -- Jeff Vandervoort JRVsystems "Bosmm" wrote in message ... I am soo glad I found this post!!!! I too am having the exact same problem. I had users that were disjoined from the Domain when we opened up an outstation. After all my searching for a problem I was convinced it had to be something specific with the "other" network they are now on. I am going to start wading through your fixes and see where I get. There was definately a business reason for removing the computers from the Domain and I would DEFINATELY call this a BUG... Thanks again! "Jeff Vandervoort" wrote: That didn't happen on my test system, but I don't like that workaround anyway...too many side-effects. So I've only done it on one system, just to confirm PSS's results. My suggestion is to create a Startup Script that adds the Restricted Groups to the local SAM instead of using the AD Restricted Groups feature. Also, an update for all lurkers...make sure to append your "me too" message to this thread and keep it alive. I just received a call from MS PSS and they are evaluating the cost-effectiveness of fixing this issue. The guy I spoke to was skeptical that it affected many people...his reasoning was, "How many people disjoin a computer from a domain?". My client has a good reason to do so...how about you? I've given the Google Search URL for this thread to them and have reason to believe it's being monitored. I'm going to forward it again to the PSS contact who's preparing the business case for fixing it. So keep posting, folks! -- Jeff Vandervoort JRVsystems "DSipp" wrote in message ... How do I move those files? The system says they are locked and in safe mode they are gone? "Jeff Vandervoort" wrote: We're seeing the same thing here; I can confirm the results. And since Tomas posted a reply here, I thought I should too! Tomas' workaround worked for me, too, but while it fixes the ESENT.DLL crash, it has side effects you need to be aware of. If there are other security policies in GPO, they will not be removed when the computer is removed from the domain. The SceCli and Userenv errors will continue (although the SceCli one will change a bit). The only complete solution I know of is not to use Restricted Groups that have domain accounts among their members in a GPO that is in scope for a computer that will be removed from a domain. Fortunately, that was an option for us in this case, with only modest hardship. I haven't done this, yet, but will likely substitute a startup script that adds the group for me and the hardship will disappear; I don't care if the group doesn't get removed when the machine is removed from the domain. On a related note, I opened a Microsoft PSS incident for this. They have reproduced the behavior in their lab. PSS carefully avoided giving me any information about whether they intended to develop a fix; hopefully they will. This strikes me as a significant bug. -- Jeff Vandervoort JRVsystems "T0MAS" T0MAS.1q1k2c@ wrote in message ... I have solved same problem with crashing services.exe. User on bussiness trip removed his notebook from domain. He reports problem with error message : Title of window : Services and Controller app in error message: Error signature szAppName: Services.exe ..... in event log was event 1000 Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x0002334c. After clicking on Close button apears automatic shutdown counter and in 30 seconds system was restarted. This same behaviour repeated several times. In evet log I found misc. events with probably related with this problem: The Group Policy client-side extension Security failed to execute (event 1085) Faulting application services.exe Security policies were propagated with warning. 0x428 (event 1202) in winlogon.log (I have enabled debug for that purpose) I found: ----Configure Group Membership... Configure Administrators. Error 1332: No mapping between account names and security IDs was done. Error occurred during lookup of all accounts. It was seems that some domain policy that contains Restricted group feature remains on notebook and periodically in moment when policy was refreshed caused error with services.exe. I knew that when notebook was removed from domain then domain policy cannot applied to non-member computer. I made several actions : I again joined notebook to domain(then restart) and again I removed it and problem occured again and again. I disabled background policy refresh, I set refresh interval to max value 45 days and nothing helps. When automatic shutdown apears I stoped it every time by command shutdown /a. Every time I found in winlogon.log that some policy tryed manage membership in groups and ends with error because probably did not have access to domain (notebook was removed from domain). I have tryed to check consistency od secedit.sdb by esentutl /g %windir%\Security\Database\Secedit.sdb and all was OK. Excuse my english. After that i crossed my mind that it may not caused by deffective remained domain policy but it may caused by local group policy which contain domain accounts (SIDs). Thats my deduction. After that I moved c:\WINDOWS\security\Database\secedit.sdb and c:\WINDOWS\security\*edb* and c:\WINDOWS\security\*.log to backup folder and after restart local group policy was reseted and after that user confirmed that error never apears and all works fine. In my case (case of one of my users) problem with crashing services.exe and periodical restarts was solved by reseting local group policy (by removing database and related files). When I begin solving of this problem I spent to much time with searching similar problem on Internet but I din't found equal. This page was not usefull exactly in my cause but everytime when I searching on Inet by using misc. search engines I everytime get this page therefore I decided to write my solution here. I have writed in this my article too much informations because each user searching this problem on Internet with miscelaneous with keywords and therefore I writed so much (for search engines too). I hope that same case may happen to someone and my story may helps him. Admin from Slovak Republic (Slovakia not Slovenia) -- T0MASPosted from http://www.pcreview.co.uk/ newsgroup access |
#11
|
|||
|
|||
Faulting application services.exe... faulting module esent.dll
And, at this writing at least, the bug still does not appear to be
documented on Microsoft's Knowledge Base. I've requested that it be added...for whatever that's worth. -- Jeff Vandervoort JRVsystems "Bosmm" wrote in message ... I am soo glad I found this post!!!! I too am having the exact same problem. I had users that were disjoined from the Domain when we opened up an outstation. After all my searching for a problem I was convinced it had to be something specific with the "other" network they are now on. I am going to start wading through your fixes and see where I get. There was definately a business reason for removing the computers from the Domain and I would DEFINATELY call this a BUG... Thanks again! "Jeff Vandervoort" wrote: That didn't happen on my test system, but I don't like that workaround anyway...too many side-effects. So I've only done it on one system, just to confirm PSS's results. My suggestion is to create a Startup Script that adds the Restricted Groups to the local SAM instead of using the AD Restricted Groups feature. Also, an update for all lurkers...make sure to append your "me too" message to this thread and keep it alive. I just received a call from MS PSS and they are evaluating the cost-effectiveness of fixing this issue. The guy I spoke to was skeptical that it affected many people...his reasoning was, "How many people disjoin a computer from a domain?". My client has a good reason to do so...how about you? I've given the Google Search URL for this thread to them and have reason to believe it's being monitored. I'm going to forward it again to the PSS contact who's preparing the business case for fixing it. So keep posting, folks! -- Jeff Vandervoort JRVsystems "DSipp" wrote in message ... How do I move those files? The system says they are locked and in safe mode they are gone? "Jeff Vandervoort" wrote: We're seeing the same thing here; I can confirm the results. And since Tomas posted a reply here, I thought I should too! Tomas' workaround worked for me, too, but while it fixes the ESENT.DLL crash, it has side effects you need to be aware of. If there are other security policies in GPO, they will not be removed when the computer is removed from the domain. The SceCli and Userenv errors will continue (although the SceCli one will change a bit). The only complete solution I know of is not to use Restricted Groups that have domain accounts among their members in a GPO that is in scope for a computer that will be removed from a domain. Fortunately, that was an option for us in this case, with only modest hardship. I haven't done this, yet, but will likely substitute a startup script that adds the group for me and the hardship will disappear; I don't care if the group doesn't get removed when the machine is removed from the domain. On a related note, I opened a Microsoft PSS incident for this. They have reproduced the behavior in their lab. PSS carefully avoided giving me any information about whether they intended to develop a fix; hopefully they will. This strikes me as a significant bug. -- Jeff Vandervoort JRVsystems "T0MAS" T0MAS.1q1k2c@ wrote in message ... I have solved same problem with crashing services.exe. User on bussiness trip removed his notebook from domain. He reports problem with error message : Title of window : Services and Controller app in error message: Error signature szAppName: Services.exe ..... in event log was event 1000 Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x0002334c. After clicking on Close button apears automatic shutdown counter and in 30 seconds system was restarted. This same behaviour repeated several times. In evet log I found misc. events with probably related with this problem: The Group Policy client-side extension Security failed to execute (event 1085) Faulting application services.exe Security policies were propagated with warning. 0x428 (event 1202) in winlogon.log (I have enabled debug for that purpose) I found: ----Configure Group Membership... Configure Administrators. Error 1332: No mapping between account names and security IDs was done. Error occurred during lookup of all accounts. It was seems that some domain policy that contains Restricted group feature remains on notebook and periodically in moment when policy was refreshed caused error with services.exe. I knew that when notebook was removed from domain then domain policy cannot applied to non-member computer. I made several actions : I again joined notebook to domain(then restart) and again I removed it and problem occured again and again. I disabled background policy refresh, I set refresh interval to max value 45 days and nothing helps. When automatic shutdown apears I stoped it every time by command shutdown /a. Every time I found in winlogon.log that some policy tryed manage membership in groups and ends with error because probably did not have access to domain (notebook was removed from domain). I have tryed to check consistency od secedit.sdb by esentutl /g %windir%\Security\Database\Secedit.sdb and all was OK. Excuse my english. After that i crossed my mind that it may not caused by deffective remained domain policy but it may caused by local group policy which contain domain accounts (SIDs). Thats my deduction. After that I moved c:\WINDOWS\security\Database\secedit.sdb and c:\WINDOWS\security\*edb* and c:\WINDOWS\security\*.log to backup folder and after restart local group policy was reseted and after that user confirmed that error never apears and all works fine. In my case (case of one of my users) problem with crashing services.exe and periodical restarts was solved by reseting local group policy (by removing database and related files). When I begin solving of this problem I spent to much time with searching similar problem on Internet but I din't found equal. This page was not usefull exactly in my cause but everytime when I searching on Inet by using misc. search engines I everytime get this page therefore I decided to write my solution here. I have writed in this my article too much informations because each user searching this problem on Internet with miscelaneous with keywords and therefore I writed so much (for search engines too). I hope that same case may happen to someone and my story may helps him. Admin from Slovak Republic (Slovakia not Slovenia) -- T0MASPosted from http://www.pcreview.co.uk/ newsgroup access |
#12
|
|||
|
|||
Quote:
Mike |
#14
|
|||
|
|||
Faulting application services.exe... faulting module esent.dll.. Help!
You could try NetSwitcher?
http://www.netswitcher.com/ -- ************************************************** **** Most learned on these newsgroups Tumppi, Helsinki, FINLAND (translations from/to FI not always accurate) ************************************************** **** "rfrendreiss" kirjoitti ... Thanks for all of your responses. I am getting this error too on a laptop that was removed from the domain. There is a need to be able to remove yourself from one domain and add to another, especially if you travel to different companies and do consulting work. I have to change my domain constantly. Perhaps Microsoft could change their app to allow multiple domain connection configuration.... Oh well. Anyway thanks for the fix ideas. I have tried them and am waiting to see if I still get this message. Hopefully Microsoft will decide to put a fix out there for this. Jeff Vandervoort Wrote: And, at this writing at least, the bug still does not appear to be documented on Microsoft's Knowledge Base. I've requested that it be added...for whatever that's worth. -- Jeff Vandervoort JRVsystems "Bosmm" wrote in message ... I am soo glad I found this post!!!! I too am having the exact same problem. I had users that were disjoined from the Domain when we opened up an outstation. After all my searching for a problem I was convinced it had to be something specific with the "other" network they are now on. I am going to start wading through your fixes and see where I get. There was definately a business reason for removing the computers from the Domain and I would DEFINATELY call this a BUG... Thanks again! "Jeff Vandervoort" wrote: That didn't happen on my test system, but I don't like that workaround anyway...too many side-effects. So I've only done it on one system, just to confirm PSS's results. My suggestion is to create a Startup Script that adds the Restricted Groups to the local SAM instead of using the AD Restricted Groups feature. Also, an update for all lurkers...make sure to append your "me too" message to this thread and keep it alive. I just received a call from MS PSS and they are evaluating the cost-effectiveness of fixing this issue. The guy I spoke to was skeptical that it affected many people...his reasoning was, "How many people disjoin a computer from a domain?". My client has a good reason to do so...how about you? I've given the Google Search URL for this thread to them and have reason to believe it's being monitored. I'm going to forward it again to the PSS contact who's preparing the business case for fixing it. So keep posting, folks! -- Jeff Vandervoort JRVsystems "DSipp" wrote in message ... How do I move those files? The system says they are locked and in safe mode they are gone? "Jeff Vandervoort" wrote: We're seeing the same thing here; I can confirm the results. And since Tomas posted a reply here, I thought I should too! Tomas' workaround worked for me, too, but while it fixes the ESENT.DLL crash, it has side effects you need to be aware of. If there are other security policies in GPO, they will not be removed when the computer is removed from the domain. The SceCli and Userenv errors will continue (although the SceCli one will change a bit). The only complete solution I know of is not to use Restricted Groups that have domain accounts among their members in a GPO that is in scope for a computer that will be removed from a domain. Fortunately, that was an option for us in this case, with only modest hardship. I haven't done this, yet, but will likely substitute a startup script that adds the group for me and the hardship will disappear; I don't care if the group doesn't get removed when the machine is removed from the domain. On a related note, I opened a Microsoft PSS incident for this. They have reproduced the behavior in their lab. PSS carefully avoided giving me any information about whether they intended to develop a fix; hopefully they will. This strikes me as a significant bug. -- Jeff Vandervoort JRVsystems "T0MAS" T0MAS.1q1k2c@ wrote in message ... I have solved same problem with crashing services.exe. User on bussiness trip removed his notebook from domain. He reports problem with error message : Title of window : Services and Controller app in error message: Error signature szAppName: Services.exe ..... in event log was event 1000 Faulting application services.exe, version 5.1.2600.2180, faulting module esent.dll, version 5.1.2600.2180, fault address 0x0002334c. After clicking on Close button apears automatic shutdown counter and in 30 seconds system was restarted. This same behaviour repeated several times. In evet log I found misc. events with probably related with this problem: The Group Policy client-side extension Security failed to execute (event 1085) Faulting application services.exe Security policies were propagated with warning. 0x428 (event 1202) in winlogon.log (I have enabled debug for that purpose) I found: ----Configure Group Membership... Configure Administrators. Error 1332: No mapping between account names and security IDs was done. Error occurred during lookup of all accounts. It was seems that some domain policy that contains Restricted group feature remains on notebook and periodically in moment when policy was refreshed caused error with services.exe. I knew that when notebook was removed from domain then domain policy cannot applied to non-member computer. I made several actions : I again joined notebook to domain(then restart) and again I removed it and problem occured again and again. I disabled background policy refresh, I set refresh interval to max value 45 days and nothing helps. When automatic shutdown apears I stoped it every time by command shutdown /a. Every time I found in winlogon.log that some policy tryed manage membership in groups and ends with error because probably did not have access to domain (notebook was removed from domain). I have tryed to check consistency od secedit.sdb by esentutl /g %windir%\Security\Database\Secedit.sdb and all was OK. Excuse my english. After that i crossed my mind that it may not caused by deffective remained domain policy but it may caused by local group policy which contain domain accounts (SIDs). Thats my deduction. After that I moved c:\WINDOWS\security\Database\secedit.sdb and c:\WINDOWS\security\*edb* and c:\WINDOWS\security\*.log to backup folder and after restart local group policy was reseted and after that user confirmed that error never apears and all works fine. In my case (case of one of my users) problem with crashing services.exe and periodical restarts was solved by reseting local group policy (by removing database and related files). When I begin solving of this problem I spent to much time with searching similar problem on Internet but I din't found equal. This page was not usefull exactly in my cause but everytime when I searching on Inet by using misc. search engines I everytime get this page therefore I decided to write my solution here. I have writed in this my article too much informations because each user searching this problem on Internet with miscelaneous with keywords and therefore I writed so much (for search engines too). I hope that same case may happen to someone and my story may helps him. Admin from Slovak Republic (Slovakia not Slovenia) -- T0MASPosted from http://www.pcreview.co.uk/ newsgroup access -- rfrendreiss |
#15
|
|||
|
|||
Hmm, well that's just too simple. Thanks, I think I will try that!
Quote:
|
|
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Faulting module | John | Windows XP Help and Support | 0 | September 22nd 04 04:30 PM |
Screen Saver problem | Vickie | Customizing Windows XP | 1 | September 10th 04 01:35 PM |
Multiple crashes WinXP sp2 | CreamX | Windows Service Pack 2 | 6 | August 25th 04 12:59 PM |
Multiple application crashes since SP2 installation | fimmwolf | General XP issues or comments | 0 | August 16th 04 09:25 AM |