| Event Information | According to Microsoft :
Cause :
This event is logged when failed to secure the machine account.
Resolution :
Remove the ACE from the security descriptor
The system failed to update the security descriptor on the computer account that is named in the Event Viewer event message text. Ensure that the Builtin Account Operators group does not appear on the access control entry (ACE) of the computer account. Perform the following procedure using a domain member computer that has domain administrative tools installed.
To perform this procedure, you must have membership in Domain Admins or you must have been delegated the appropriate authority.
To manually secure a computer account:- Open Active Directory Users and Computers. To open Active Directory Users and Computers, click Start. In Start Search, type dsa.msc, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
- On the View menu, ensure that Advanced Features is enabled. If this command is enabled, there is a check mark in the menu next to Advanced Features. If this command is not enabled, click Advanced Features. When you enable Advanced Features, you can see the Security tab in the properties of objects in Active Directory Users and Computers.
- Right-click the object that represents your domain, and then click Find.
- In the Find Users, Contacts, and Groups dialog box, in Find, click Computers. This changes the dialog box name to Find Computers.
- On the Computers tab, in Computer name, type the name of the computer, and then click Find Now. The computer object that you want to modify should appear in the search results.
- Right-click the object that represents the computer account, and then click Properties.
- On the Security tab of computernameProperties, look for the Account Operators group in the list of users and groups. If you find Account Operators, click the group, click Remove, and then click OK.
Verify :
The Security Accounts Manager (SAM) secures computer accounts by removing the default Full Control permissions, which are assigned to the Builtin Account Operators group, from the access control entry (ACE) of a computer account. Perform the following procedure using a domain member computer that has domain administrative tools installed.
To perform this procedure, you must have membership in Domain Admins or you must have been delegated the appropriate authority.
To verify that the SAM secured a computer account successfully:- Open Active Directory Users and Computers. To open Active Directory Users and Computers, click Start. In Start Search, type dsa.msc, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
- On the View menu, ensure that Advanced Features is enabled. If this command is enabled, there is a check mark in the menu next to Advanced Features. If this command is not enabled, click Advanced Features. When you enable Advanced Features, you can see the Security tab in the properties of objects in Active Directory Users and Computers.
- Right-click the object that represents your domain, and then click Find.
- In the Find Users, Contacts, and Groups dialog box, in Find, click Computers. This changes the dialog box name to Find Computers.
- On the Computers tab, in Computer name, type the name of the computer, and then click Find Now. The computer object that you want to modify should appear in the search results.Right-click the object that represents the computer account, and then click Properties.
- On the Security tab of computername Properties, verify that the Account Operators group does not appear in the list of users and groups.
|