| Event Id | 1168 |
| Source | NTDS Intersite Messaging |
| Description | Error 997(3e5) has occurred (Internal ID 11000252). Please contact Microsoft Product Support Services for assistance. |
| Event Information | "According to Microsoft: CAUSE: This behavior can occur if you lock the system partition and remove the Everyone group from various locations. RESOLUTION: To resolve the behavior, reset system default file permissions: 1. Set environment variables as follows: a. At a command prompt, type net share sysvol, and then press ENTER. Notice the path that is returned. b. Right-click My Computer, and then click Properties. c. On the Advanced tab, click Environment Variables. d. In the System Variables section, click New. e. In the Variable Name box, type Sysvol. f. In the Variable Value box, type the path that you noted in step a without the last \sysvol item. g. Repeat these steps to create the %DSDIT% variable and the %DSLOG% variable. To view the path for these variables, examine these variables in the registry under the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters .For example, the default location for the Database log files path and for the DSA Working Directory is the following:C:\WINNT\NTDS 2. At a command prompt, run the following commands: cd \winnt\security\templates secedit /configure /cfg ""setup security.inf"" /db ss.sdb /log ss.log /verbose secedit /configure /cfg basicdc.inf /db basicdc.sdb /log basicdc.log /verbose 3. Restart the computer." |
| Reference Links | Memory
leak in Lsass.exe DNS, Intersite Messaging, Global Catalog, NTFRS, and "Invalid Credentials" Error Messages on Domain Controller |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.