Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows
To resolve this issue, follow these steps:
- Use an account that has administrative credentials to log on to Windows Server 2003.
- Try to add the Administrators group and SERVICE group accounts to the Impersonate a client after authentication policy setting. To do this, follow these steps:
- Click Start, click Run, type gpedit.msc, and then click OK.
- In the console tree, locate and then expand the following node:
Computer Configuration\Windows
Settings\Security Settings\Local Policies\User Rights Assignment
- Locate and then double-click Impersonate a client after authentication.
- Click Add User or Group.
Note If the Add User or Group button is disabled and if the computer is a domain controller, use the Domain Controller Security Policy administrative tool to make the policy changes. This policy tool will override the local security policy settings. If this computer is a member server and the Add User or Group button is disabled, identify all Group Policy settings that apply to this computer, and then make the policy changes to the appropriate Group Policy settings. - In the Enter the object names to select box, type Administrators, and then click OK.
- Repeat step d through e for the SERVICE group account.
- Click OK to close the Impersonate a client after authentication Properties dialog box.
- On the File menu, click Exit.
- Restart the computer.
If you can add the Administrators group and SERVICE group accounts to the Impersonate a client after authentication policy setting, restart the computer. The issue will be resolved. If you cannot modify the policy and you still experience network communication issues, follow steps 3 through 5. - Change the logon account for the RPC service from the NT AUTHORITY\NetworkService account to the Local System account, and then restart the computer. After you follow this step, network communication is restored. However, you must now follow steps 4 through 5 to reconfigure the RPC service to run under the NetworkService
account. To modify the logon account for the RPC service, follow these steps:
- Click Start, click Run, type Services.msc, and then click OK.
- Locate and then double-click Remote Procedure Call (RPC).
- Click the Log On tab, click Local System account, and then click OK.
- On the File menu, click Exit to close the Services snap-in.
- Restart the computer.
- Add the Administrators group and SERVICE group accounts to the Impersonate a client after authentication policy setting, and then update Group Policy. To do this, follow these steps:
- Click Start, click Run, type gpedit.msc, and then click OK.
- In the console tree, locate and then expand the following node:
Computer Configuration\Windows
Settings\Security Settings\Local Policies\User Rights Assignment
- Locate and then double-click Impersonate a client after authentication.
- In the Impersonate a client after authentication Properties dialog box, click Add User or Group.
Note If the Add User or Group button is disabled and if the computer is a domain controller, use the Domain Controller Security Policy administrative tool to make the policy changes. This policy tool will override the local security policy settings. If this computer is a member server and the Add User or Group button is disabled, identify all Group Policy settings that are applicable to this computer, and then make the policy changes in the appropriate Group Policy settings. - In the Enter the object names to select box, type Administrators, and then click OK.
- Repeat step d through e for the SERVICE group account.
- Click OK.
- On the File menu, click Exit.
- Click Start, click Run, type gpupdate /force to update Group Policy.
- Use the Group Policy Object Editor to make sure that the Impersonate a client after authentication policy includes the Administrators group and SERVICE group accounts.
- Use Registry Editor to modify the logon account settings for the RPC service so that it uses the NT Authority\NetworkService account. This is the default configuration for Windows Server 2003 with SP1. To do this, follow these steps.
- Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
Note Make sure that you make a copy of the registry subkey before you modify any settings. - Double-click ObjectName.
- In the Value data box, type NT Authority\NetworkService.
- Click OK.
- On the File menu, click Exit.
- Restart the computer.