userenv-application-log-error-event-1101-1030

userenv-application-log-error-event-1101-1030

 

 

Event log on windows 2003 terminal server with Citrix presentation server 4.5. The userenv errors logged on citrix servers (terminal servers) whenever a particular group of users in an OU logged in: Error events 1101 and 1030:

 

Event ID 1101:

Windows cannot access the the object OU=TabletPCUsers,DC=localdomain,DC=gr in Active Directory. The access to the object may be denied. Group Policy processing aborted.

 

Event ID 1030:

 

Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

 

If you enable user environment debug logging, the following entries are logged:

 

ProcessGPOs: User name is: UserOrComputerDN, Domain name is: DomainName

ProcessGPOs: Domain controller is: \\DC FQDN Domain DN is DomainName

...

EvaluateDeferredOUs: Object OUName cannot be accessed

GetGPOInfo: EvaluateDeferredOUs failed. Exiting

 

What resolved the problem for this site was even simpler that applying any security policy changes. In this scenario, the application log was getting event 1101 and event 1030 for the same users in the 2003 domain.

 

The events were not being logged for all users. The commonality for these users was they were in the same user group, tabletuseraccounts and they also were in the same OU. Changing their user group had no impact on the results, but after more testing it was realized that changing their OU in fact did change the results. The event 1030 and 1101 was stopped being logged. So this was undoubtedly an OU problem in AD.

 

The solution that worked at this office and domain was that a new OU was created with a different name than the original of course. All user accounts were moved into the new OU. All accounts stopped causing event 1030 and 1101 from being entered int he event log in this windows 2003 AD domain.

 

 

 

 

 

Done