Event ID 1053 - Group Policy

Question

Recently encountered this error, following some FRS issues with SYSVOL and our NETLOGON folders (event id 13508, if anyone's interested). These replication issues have been resolved, but there is an issue with clients applying group policies. The computer side
of the policy applies every time, no problem. The issue is to do with user policies.
If a user logs on to a machine they were using prior to our replication issues, they receive all the relevant policies and the machine is locked down, as expected. If they log on to a machine they've never logged on to before, they don't receive any user group
policy settings and the event viewer lists error 1053 (with the machine being wide open to their assault).
Event 1053: The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following: 
a) Name Resolution failure on the current domain controller. 
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
Running a gpupdate /force doesn't apply these policies, only presenting this error...
The processing of group policy. Windows could not resolve the user name.
This could be caused by one of the following:
a) Name Resolution failure on the current domain controller - We're quite confident this isn't the problem.
b) Active Directory Replication Latency (An account created on another domain controller has no replicated to the current domain controller) - Checked this, all accounts have been replicated. 
Upon producing a GPreport I receive this error:
Group Policy Infrastructure failed due to the error listed below.
The specified account does not exist. 
Note: Due to the GP Core failure, none of the other Group Policy components processed their policy. Consequently, status information for the other components is not available.
Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between 13/11/2014 14:06:30 and 13/11/2014 14:06:32.
System
Provider
[ Name]
Microsoft-Windows-GroupPolicy
[ Guid]
{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
EventID
1053
Version
0
Level
2
Task
0
Opcode
1
Keywords
0x8000000000000000
TimeCreated
[ SystemTime]
2014-11-14T08:18:32.372783400Z
EventRecordID
59591
Correlation
[ ActivityID]
{C3B036F5-272A-42A7-8AB1-2C2C2DCA0448}
Execution
[ ProcessID]
1100
[ ThreadID]
3000
Channel
System
Computer
XX-XXXX-XX.XXXXXXX.local
Security
[ UserID]
S-1-5-21-4153847986-3925515210-898707684-6794
EventData
SupportInfo1
1
SupportInfo2
1632
ProcessingMode
1
ProcessingTimeInMilliseconds
1544
ErrorCode
1317
ErrorDescription
The specified account does not exist. 
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
  <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}"
/>
  <EventID>1053</EventID>
  <Version>0</Version>
  <Level>2</Level>
  <Task>0</Task>
  <Opcode>1</Opcode>
  <Keywords>0x8000000000000000</Keywords>
  <TimeCreated
SystemTime="2014-11-14T08:18:32.372783400Z" />
  <EventRecordID>59591</EventRecordID>
  <Correlation
ActivityID="{C3B036F5-272A-42A7-8AB1-2C2C2DCA0448}" />
  <Execution ProcessID="1100" ThreadID="3000" />
  <Channel>System</Channel>
  <Computer>XX-XXXX-XX.XXXXXXX.local</Computer>
  <Security UserID="S-1-5-21-4153847986-3925515210-898707684-6794" />
  </System>
<EventData>
  <Data Name="SupportInfo1">1</Data>
  <Data Name="SupportInfo2">1632</Data>
  <Data Name="ProcessingMode">1</Data>
  <Data Name="ProcessingTimeInMilliseconds">1544</Data>
  <Data Name="ErrorCode">1317</Data>
  <Data Name="ErrorDescription">The specified account does not exist.</Data>
  </EventData>
  </Event>
Any help would be much appreciated. 
Thanks,
J.

Answer 1

Hi J,
Looks like this could be an access/permissons issue. Could you just confirm a couple of things though:
Use nslookup to
confirm you can resolve addresses of the domain controllers
Use ipconfig /all on a user PC to make sure you are hitting the correct DNS servers
Assuming this is all okay (which I'm sure it is), take a look at
this thread with a similar issue. In the end it was determined that several necessary ports were not open on the DC, which resulted in errors with group policy.
Have a read of that and let us know how you get on. Sorry I can't be of more help at the moment, it feels like this might be a "trial and error" problem!
Regards,
James Henderson
MTA: Windows Server Admin Essentials
MTA: Networking Fundamentals