XADM: Policytest Utility Returns 'Right NOT Found' Result (328662)

RESOLUTION

1. Use the Policytest tool (Policytest.exe) to troubleshoot permissions. Policytest.exe is located on the Exchange 2000 Server CD-ROM in the Support\Utils\I386 folder. Use Policytest to determine if the "Manage auditing and security logs" permission for the Exchange Enterprise Servers group is missing on any or all of the domain controllers. A successful result returns information that is similar to the following:

   ================================================
   Local domain is "<example.com>" (EXAMPLE)
   Account is "EXAMPLE\Exchange Enterprise Servers"
   ========================
     DC      = "<ComputerName>"
     In site = "<Default-First-Site-Name>"
     Right found:  "SeSecurityPrivilege"
   							

   NOTE: A successful result shows that the "Manage auditing and security logs" permissions exist. You must have domain administrator rights to run Policytest successfully.For additional information about the Policytest utility, click the article number below to view the article in the Microsoft Knowledge Base:

   281537 XADM: Description of the Policytest.exe Utility

2. Manually add the SeSecurityPrivilege right to all domain controller Group Policy Objects. The setup.exe /domainprep command only updates the Default Domain Controllers policy. This command does not update additional domain controller policies that may be applied after the Default Domain Controllers policy. To manually add the SeSecurityPrivilege right:
   1. Start the Active Directory Users and Computers snap-in.
   2. Right-click the Domain Controllers container, and then click Properties.
   3. Click the Group Policy tab, click Default Domain Controllers Policy in the Group Policy Object Links box, and then click Edit.
   4. Expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click User Rights Assignment.
   5. In the right pane, double-click Manage auditing and security log, click Add, click Browse, click Exchange Enterprise Servers, click Add, and then click OK.
   6. In the Add user or group dialog box, click OK, and then click OK.
   7. Quit the Group Policy snap-in.
   8. If additional domain controller policies are listed in the Domain Controllers Properties dialog box, click the next domain controller policy, and then click Edit.
   9. Expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click User Rights Assignment.
   10. In the right pane, double-click Manage auditing and security log, and then click to select the Define these policy settings check box.
   11. Click Add, click Browse, click Administrators, click Add, click Exchange Enterprise Servers, click Add, and then click OK.
   12. In the Add user or group dialog box, click OK, and then click OK.
   13. Quit the Group Policy snap-in.
   14. Repeat this process to edit the permissions of all the other domain controller Group Policy Objects.
   15. When you are finished, click OK to close the Domain Controllers Properties dialog box, and then wait for the changes to be replicated throughout the domain.
   16. Run the Policytest utility to confirm that the following result is returned for each domain controller in the domain:

       Right found: "SeSecurityPrivilege"

   17. Restart the Exchange 2000 services.
3. Move all domain controller objects back into the Domain Controllers container, and then wait five minutes until the default domain controller policy is refreshed. The default domain controller policy is refreshed every 5 minutes. To refresh the default domain controller policy manually, run secedit /refreshpolicy machine_policy /enforce on every domain controller.For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

   227302 Using SECEDIT to Force a Group Policy Refresh Immediately