Group Policy Event ID 1058 Error Code 1326 (The user name or password is incorrect)

i seeing odd error on 1 of our domain controllers. have dealt event id 1058 errors whereby policy (or policies) not replicating, receiving error along error code 1326 on server, , apparently happening default domain policy:

log name:      system
source:        microsoft-windows-grouppolicy
date:          8/10/2015 3:09:54 pm
event id:      1058
task category: none
level:         error
keywords:     
user:          s-1-5-21-1484152634-2550175353-3916092219-3287
computer:      <dc name>.<domainname>
description:
processing of group policy failed. windows attempted read file http://schemas.microsoft.com/win/2004/08/events/event">
  <system>
    <provider name="microsoft-windows-grouppolicy" guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" />
    <eventid>1058</eventid>
    <version>0</version>
    <level>2</level>
    <task>0</task>
    <opcode>1</opcode>
    <keywords>0x8000000000000000</keywords>
    <timecreated systemtime="2015-08-10t19:09:54.008905300z" />
    <eventrecordid>56008</eventrecordid>
    <correlation activityid="{e6440388-aaf9-4e59-b945-73179e2adf3f}" />
    <execution processid="880" threadid="3256" />
    <channel>system</channel>
    <computer><dcname>.<domainname></computer>
    <security userid="s-1-5-21-1484152634-2550175353-3916092219-3287" />
  </system>
  <eventdata>
    <data name="supportinfo1">4</data>
    <data name="supportinfo2">820</data>
    <data name="processingmode">0</data>
    <data name="processingtimeinmilliseconds">3432</data>
    <data name="errorcode">1326</data>
    <data name="errordescription">the user name or password incorrect. </data>
    <data name="dcname"><dcname>.<domainname></data>
    <data name="gpocnname">cn={31b2f340-016d-11d2-945f-00c04fb984f9},cn=policies,cn=system,dc=<domainname>,dc=com</data>
    <data name="filepath">\\<domainname>\sysvol\<domainname>\policies\{31b2f340-016d-11d2-945f-00c04fb984f9}\gpt.ini</data>
  </eventdata>
</event>

(some information redacted)

now, haven't failed notice that the username listed sid.  based on various queries have done, sid not exist in our domain.

this replicates 1 other domain controller, our pdc , resides in our corporate datacenter.  seems dfsr trying connect outdated dc replicate, cannot find indication of why might doing this.  have looked @ dfs management console on server , looks on every other dc.  dfsr event logs not reporting wrong.

while doesn't appear hurting anything--the default domain policy updating in sysvol on server , replication diagnostics check out ok--i'd correct whatever causing this.  run similar or have ideas?

hi steviek,

thanks post.

these issues occur if computers on network cannot connect group policy objects. specifically, these objects in sysvol folders on network's domain controllers. maybe sysvol replication failed.

since sysvol diagnosis ok. follow check： examine dns settings , network properties on servers , client computers, examine server message block signing settings on client computers , member servers , make sure tcp/ip netbios helper service started on all  computers

refer following link:

https://support.microsoft.com/en-us/kb/887303

http://social.technet.microsoft.com/wiki/contents/articles/1456.event-id-1058-group-policy-preprocessing-networking.aspx

best regards,

mary dong

---

please remember mark replies answers if , unmark them if provide no help. if have feedback technet subscriber support, contact tnmff@microsoft.com.

Windows Server  >  Group Policy