| Event Id | 1029 |
| Source | MSExchangeMU |
| Description | Failed to replicate the security descriptor to the metabase. Users may not be able to read or write data to the metabase. Error code is <error code>. |
| Event Information | According to Microsoft: CAUSE: This issue may occur if the "Manage auditing and security log" permission (SeSecurityPrivilege) is removed from the Exchange Enterprise Servers group on some domain controllers or on all domain controllers. The Exchange Enterprise Servers group must have the "Manage auditing and security log" permission on all domain controllers in the domain. RESOLUTION: To resolve this issue, follow these steps: 1. Use Policytest.exe to troubleshoot permissions issues. Policytest.exe is located in the Support\Utils\I386 folder on the Exchange 2000 Server CD. Use Policytest.exe to determine whether the "Manage auditing and security log" permission for the Exchange Enterprise Servers group is missing from a domain controller. 2. Reset the Exchange Enterprise Server default permissions at the domain level. 3. Verify the default domain controllers policy. 4. Manually add permissions to the domain controller. The File Replication service (FRS) may not replicate the updated security policy to one or more domain controllers after you run the setup /domainprep command. If this problem occurs, you must manually assign the correct permissions to the Exchange Enterprise Servers group. If some domain controllers or all domain controllers do not have the correct permissions, assign the "Manage auditing and security log" permission to the Exchange Enterprise Servers group. Then, wait for the setting to replicate to the other domain controllers. |
| Reference Links | Issues that may occur when the "Manage auditing and security log" permission is removed from the Exchange Enterprise Servers group in Exchange 2000 Server |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.