1

A bit of background. I have a small network of 10 computers (2 DCs and 8 laptops). The DCs crashed when security came an implemented new policies and we had to rebuild them. We had to rejoin the laptops to them and rebuild our GPOs. I am getting an error with my password policy.

I am getting this error for a setting on GPO. My Password policy gives me an error stating

The Policy "Passwords" resulted in the following error An unknown error occurred when attempting to open the database

I checked my Event log it gives me a Event 1202 with error 0x57 and it I checked the winlogon.log and I get the following:

Start processing undo values for 7 settings.
There is already an undo value for group policy setting <MinimumPasswordLength>.
There is already an undo value for group policy setting <PasswordHistorySize>
There is already an undo value for group policy setting <MaximumPasswordAge>.
There is already an undo value for group policy setting <MinimumPasswordAge>.
There is already an undo value for group policy setting <PasswordComplexity>.
There is already an undo value for group policy setting <RequireLogonToChangePassword>.
There is already an undo value for group policy setting <ClearTestPassword>.
Error 87: The parameter is incorrect.

The entire Password policy shows red circles with X's in them. I check and changed the Default Domain Policy to make them the same as my Password GPO but it still shows the red X's. Our security checker is showing that the password minimumllength is 7 which is the Local GPEDIT setting. In practice testing the password policy is set to 14 (The password GPO setting). So I am confused here. So I guess the Local policy is taking control of the password settings somewhere? But in practice it isn't. Where in registry can I check the actual setting and verify the GPO is set correctly.

Please move this question to ServerFault if warranted.

1

There are two reasons this can happen. One, the RequireLogonToChangePassword, and two, a min password length greater than 14.

Microsoft removed the RequireLogonToChangePassword option sometime between Windows 2003 and Windows 2008 R2. It looks like this issue affects older domains that used to have this flag, such as ours, which is about 18 years old.

While our GPTTMPL.inf file for the default domain policy no longer has the "RequireLogonToChangePassword" entry, the error still happens. Not only does each member server remember the setting's undo value (as shown below), but I found our "Default Domain Policy" had "skewed" settings in the Password Policy.

If you enable debugging for SciCli (registry entry ExtensionDebugLevel=2), the following shows the error in C:\Windows\Security\logs\winlogon.log:

----Configure Security Policy...
        Start processing undo values for 7 settings.
        There is already an undo value for group policy setting <MinimumPasswordLength>.
        Undo value for the undefined group policy setting <PasswordHistorySize> wasn't reset successfully (87).  Undo value was not removed.
        There is already an undo value for group policy setting <MaximumPasswordAge>.
        There is already an undo value for group policy setting <MinimumPasswordAge>.
        There is already an undo value for group policy setting <PasswordComplexity>.
        Undo value for the undefined group policy setting <RequireLogonToChangePassword> wasn't reset successfully (87).  Undo value was not removed.
        There is already an undo value for group policy setting <ClearTextPassword>.
Error 87: The parameter is incorrect.

There is an error resetting the undo value. Here is how we were able to fix this:

  1. Log into a domain controller and edit the "Default Domain Policy" GPO from the "Group Policy Management Editor".
  2. Navigate to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Account Policies -> Password Policy.
  3. Click on each of the six policy settings in the right pane and change their setting, click APPLY, then change the setting back, and click APPLY again.
  4. If the minimum password length is above 14, set it to 14.
  5. Let the domain sync and run "gpupdate /force" from the command prompt on the domain member that you are testing.

If this works, you will now see this in the C:\Windows\Security\logs\winlogon.log:

----Configure Security Policy...
        Start processing undo values for 7 settings.
        There is already an undo value for group policy setting <MinimumPasswordLength>.
        Undo value for undefined group policy setting <PasswordHistorySize> was reset successfully and removed.
        There is already an undo value for group policy setting <MaximumPasswordAge>.
        There is already an undo value for group policy setting <MinimumPasswordAge>.
        There is already an undo value for group policy setting <PasswordComplexity>.
        Undo value for undefined group policy setting <RequireLogonToChangePassword> was reset successfully and removed.
        There is already an undo value for group policy setting <ClearTextPassword>.
    Configure password information.

Notice that the "RequireLogonToChangePassword" now states that it was reset successfully.

If you need to have passwords greater than 14, you must use a "Fine Grained Password Policy": https://blogs.technet.microsoft.com/reference_point/2013/04/12/fine-grained-password-policies-gui-in-windows-server-2012-adac/

0

My apologies guys...Here is the answer to this problem.

Summary of Issue • Security logs stopped working after reboots. • Application logs show the following warning error: Security policies were propagated with warning. 0x57 : The parameter is incorrect.

Cause of Issue

A setting in in the security policy GPO followed into the new domain. The domain was upgraded multiple times, going back to earlier 2000's and there is a setting that is a remnant of this that needs removed. It is causing the 0x57 errors and the Error 87: The parameter is incorrect.

Discovery There are six Password Policy settings show in RSoP on the server in question under Computer Configuration --> Windows Settings --> Security Settings --> Account Policies --> Password Policy with errors.

  1. Enforce password history
  2. Maximum password age
  3. Minimum password age
  4. Minimum password length
  5. Password must meet complexity requirements
  6. Store passwords using reversible encryption

In RSoP where there was shown a yellow warning sign, if you click properties of that (Computer Configuration), then Error Information it shows what is causing the error:

Security has requested to process its policy settings again. This can be due to non-critical errors occurring during the previous processing of policy. Additional Information: Security policies were propagated with warning. 0x57 : The parameter is incorrect.

To identify the particular error, when you enable the winlogon.log (see below) it gives details on AD GPOs after gpupdate /force is ran.

To create it, go to regedit and track following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}

Click the key ExtensionDebugLevel and enter 2 as a Data.

Opening C:\Windows\security\logs\winlogon.log details any errors related to GPOs. The following shows an error related to the error in RSoP: ----Configure Security Policy... Start processing undo values for 7 settings. There is already an undo value for group policy setting . There is already an undo value for group policy setting . There is already an undo value for group policy setting . There is already an undo value for group policy setting . There is already an undo value for group policy setting . There is already an undo value for group policy setting . There is already an undo value for group policy setting . Error 87: The parameter is incorrect. Error configuring password information. Start processing undo values for 3 settings. There is already an undo value for group policy setting . There is already an undo value for group policy setting . There is already an undo value for group policy setting . There is already an undo value for group policy setting . Configure account force logoff information.

The GPO that is tied to the security Security Policy in this GPO above is shown in the winlogon.log files:

this is the last GPO.
**************************

Make a local copy of \\**YOUR DOMAIN**\sysvol\**YOUR DOMAIN**\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
GPLinkDomain GPO_INFO_FLAG_BACKGROUND )

When looking inside the gptTmp.inf file in sysvol (just putting this location into your browser or open in notepad), the following information is contained and of particular interest is the RequireLogonToChangePassword = 0 key and value. There are six values in AD GPO Management, and RSoP on the machine:

  1. Enforce password history
  2. Maximum password age
  3. Minimum password age
  4. Minimum password length
  5. Password must meet complexity requirements
  6. Store passwords using reversible encryption

But RequireLogonToChangePassword = 0 isn't one of them. It is intuited that by removing this settings from the GPTTMP.INF it will resolve this.

[Unicode]
Unicode=yes
[System Access]
MinimumPasswordAge = 1
MaximumPasswordAge = 90
MinimumPasswordLength = 15
PasswordComplexity = 1
PasswordHistorySize = 9
LockoutBadCount = 5
ResetLockoutCount = 30
LockoutDuration = 30
RequireLogonToChangePassword = 0
ForceLogoffWhenHourExpire = 0
ClearTextPassword = 0
[Version]
signature="$CHICAGO$"
Revision=1
[Kerberos Policy]
MaxTicketAge = 10
MaxRenewAge = 7
MaxServiceAge = 600
MaxClockSkew = 5
TicketValidateClient = 1
[Service General Setting]
"SharedAccess",4,"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
[Registry Values]
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\AuditReceivingNTLMTraffic=4,2
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\AuditNTLMInDomain=4,7
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,14
MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=4,1

Solution

Remove the value RequireLogonToChangePassword = 0 from GPTTMP.inf. Be sure to follow these instructions. Per the information from https://social.technet.microsoft.com/Forums/windows/en-US/09270ae3-264d-4e4a-9cd3-9657139e58e8/manually-edit-the-gpttmplinf-file-settings-not-visible-in-gpmc-settings-report?forum=winserverGP

After manually edit the GptTmpl.inf file, please increment the GPO version to make sure that the policy changes are retained. To do this, use one of the following methods.

Method 1: Use Group Policy Object Editor 1. Open Group Policy Object Editor. 2. Make a change. 3. Close Group Policy Object Editor.

Method 2: Manually edit the Gpt.ini file

To manually increase the GPO version, edit the Gpt.ini file that controls the Group Policy Template version numbers. To do this:

1. Open the Gpt.ini file with a text editor, such as Notepad. 
2. Increase the version number to a number that is large enough to guarantee that normal replication will not make the new version number become outdated before the policy can be reset. It is better to increment the number by either adding the number "0" to the end of the version number, or the number "1" to the beginning of the version number.
3. Save the Gpt.ini file, and then close it.

What’s more, apply the new GPO by using the Secedit tool to manually update the GPO. To do so, type secedit /refreshpolicy machine_policy /enforce at a command prompt, and then press ENTER. Then, check the application log in Event Viewer for Event 1704 to verify successful policy propagation

  • Thanks! Will try it out and mark as answer when complete – JukEboX Apr 25 '19 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.