Event ID 1202 with error code 0x8 (8)

I had a small number of servers getting event ID 1202 with error code 0x8 (8) when I tried to manually force a group policy change with the command secedit /refreshpolicy machine_policy /enforce.

From searching the Web, it appears I’m not the first to have the error, but it appears I may be the first to have solved it. I have contacted Microsoft, and none of the support reps I worked with have seen this particular error. I do have a ticket open with them and will share this information with them in hopes of it helping someone else.

In the meantime, I might as well share the information with the rest of the world too.

0x8 means insufficient storage space. This is puzzling because these servers had plenty of free space on their system drives (9 gigs or so), and the odd thing about it was that I had 53 servers that are configured identically (and another five that are only slightly different), and only five of the 58 exhibited the problem. The five that had the problem were consistent.

The only odd thing about the servers were that the event logs were huge. They were 400+ megabytes total on the five that had the problem. When I cleared the event logs on those problem servers, the problem went away.

As a bonus, the memory usage on those servers dropped like a rock too, which is good for performance.

This still doesn’t explain why I had 53 other servers that didn’t have a problem. But at least I solved my problem. Hopefully if you’re getting a 0x8, clearing the event logs will work for you too. And keeping your event logs small is a good idea anyway, whether you’re having this particular problem or not. It reduces memory usage.

%d bloggers like this:
WordPress Appliance - Powered by TurnKey Linux