Extra files are created in the System32 folder when you turn on logging for Security Configuration Client processing in Windows 2000 (323555)


The information in this article applies to:

  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Advanced Server SP3
  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Server SP3
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
  • Microsoft Windows 2000 Professional SP3
This article was previously published under Q323555


Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

When you turn on logging for Security Configuration Client processing in Microsoft Windows 2000, extra files are created in the Winnt\System32 folder of your computer, where Winnt is the folder where Windows is installed. These extra files have file names that are similar to the following:

12/27/2001 12:58a 202 ?icurity=impersonation dynamic false

RESOLUTION

Service pack information

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to obtain the latest Windows 2000 service pack

File information

The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. 
   Date         Time   Version            Size    File name
   --------------------------------------------------------------
   27-Sep-2002  00:05  5.0.2195.6069     124,176  Adsldp.dll       
   27-Sep-2002  00:05  5.0.2195.5781     131,344  Adsldpc.dll      
   27-Sep-2002  00:05  5.0.2195.5781      62,736  Adsmsext.dll     
   27-Sep-2002  00:05  5.0.2195.6052     358,160  Advapi32.dll     
   27-Sep-2002  00:05  5.0.2195.5265      42,256  Basesrv.dll      
   27-Sep-2002  00:05  5.0.2195.6058      49,424  Browser.dll      
   27-Sep-2002  00:05  5.0.2195.6012     135,952  Dnsapi.dll       
   27-Sep-2002  00:05  5.0.2195.6012      96,016  Dnsrslvr.dll     
   27-Sep-2002  00:05  5.0.2195.5722      45,328  Eventlog.dll     
   27-Sep-2002  00:05  5.0.2195.5907     222,992  Gdi32.dll        
   27-Sep-2002  00:05  5.0.2195.6059     146,704  Kdcsvc.dll       
   06-Sep-2002  01:18  5.0.2195.6048     200,976  Kerberos.dll     
   27-Sep-2002  00:05  5.0.2195.6011     708,880  Kernel32.dll     
   21-Aug-2002  16:27  5.0.2195.6023      71,248  Ksecdd.sys
   26-Sep-2002  02:01  5.0.2195.6072     507,664  Lsasrv.dll       
   26-Sep-2002  02:01  5.0.2195.6072      33,552  Lsass.exe        
   27-Sep-2002  00:05  5.0.2195.4733     332,560  Msgina.dll       
   27-Aug-2002  22:53  5.0.2195.6034     108,816  Msv1_0.dll       
   27-Sep-2002  00:05  5.0.2195.5979     307,472  Netapi32.dll     
   27-Sep-2002  00:05  5.0.2195.5966     360,720  Netlogon.dll     
   27-Sep-2002  00:05  5.0.2195.6048     918,800  Ntdsa.dll        
   27-Sep-2002  00:05  5.0.2195.6025     389,392  Samsrv.dll       
   27-Sep-2002  00:05  5.0.2195.5951     129,296  Scecli.dll       
   27-Sep-2002  00:05  5.0.2195.5951     302,864  Scesrv.dll       
   10-Sep-2002  15:50  5.0.2195.6053     123,392  Sp3res.dll       
   13-Jun-2001  05:05  5.0.2195.3727       3,856  Svcpack1.dll     
   26-Jun-2001  02:17  3.10.0.103         47,808  User.exe
   27-Sep-2002  00:05  5.0.2195.6063     380,176  User32.dll       
   27-Sep-2002  00:05  5.0.2195.5968     369,936  Userenv.dll      
   27-Sep-2002  00:05  5.0.2195.5859      48,912  W32time.dll      
   04-Jun-2002  21:32  5.0.2195.5859      57,104  W32tm.exe        
   25-Sep-2002  18:04  5.0.2195.6070   1,642,512  Win32k.sys
   12-Sep-2002  19:50  5.0.2195.6056     179,472  Winlogon.exe     
   27-Sep-2002  00:05  5.0.2195.5935     243,472  Winsrv.dll       
   27-Sep-2002  00:05  5.0.2195.6052     126,224  Wldap32.dll      
   27-Sep-2002  00:05  5.0.2195.5774      72,976  Wmicore.dll      
   26-Sep-2002  02:01  5.0.2195.6072     507,664  Lsasrv.dll       
   27-Sep-2002  00:05  5.0.2195.6011     708,880  Kernel32.dll     
   27-Sep-2002  00:05  5.0.2195.6070   1,642,512  Win32k.sys
   27-Sep-2002  00:05  5.0.2195.5935     243,472  Winsrv.dll

WORKAROUND

Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
To work around this issue, turn off logging for Security Configuration Client processing. When you do this, the extra files are not created.

To turn off logging, follow these steps:
  1. Start Registry Editor.
  2. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}

  3. In the right pane, right-click the ExtensionDebugLevel value, and then click Modify on the drop-down menu.
  4. In the Value Data box, type 0 to replace the 2, and then click OK.
  5. Quit Registry Editor.
  6. To immediately apply these settings, type the following command at a command prompt and then press ENTER:

    secedit /refreshpolicy machine_policy /enforce

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
This problem was first corrected in Microsoft Windows 2000 Service Pack 4.

MORE INFORMATION

You may delete the extra files that are created when you turn on logging for Security Configuration Client processing in Windows 2000. These files are not significant.

REFERENCES

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

245422 How to enable logging for Security Configuration Client processing in Windows 2000

Modification Type:MinorLast Reviewed:9/27/2005
Keywords:kbHotfixServer kbQFE kbbug kbfix kbWin2000preSP4Fix KB323555 kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.