Error message when you try to view the settings for a GPO in GPMC with Service Pack 1 on a Windows Server 2003-based computer: "An error has occurred while collecting data for Security Configuration Engine (SCE) Extension"

View products that this article applies to.

SYMPTOMS

On a Windows Server 2003-based computer, you try to use Group Policy Management Console (GPMC) with Service Pack 1 to view the settings for a Group Policy object (GPO). However, you receive the following error message after you expand Security Settings on the Settings tab of the GPO:

An error has occurred while collecting data for Security Configuration Engine (SCE) Extension.

This error impacts the following settings:
Account Policies (Password Policy, Account Lockout Policy, Kerberos Policy)
Local Policies (Audit Policy, User Rights Assignment, Security Options)
Event Log
Restricted Groups
System Services
Registry
File System
The following errors apply to all of the above settings:
The file "\\<Domain SysVol>\<Group Policy Object GUID>\Machine\microsoft\windows nt\secedit\gpttmpl.inf" is not in a valid format. Details: Index was out of range. Must be non-negative and less than the size of the collection. Parameter name: index

In this situation, you cannot view any Group Policy settings when you expand Security Settings. This problem occurs if the Restricted Groups setting is defined in the GPO.

Back to the top

CAUSE

This problem occurs if the Gpttmpl.inf file contains incorrect information. After you define the Restricted Groups setting in a GPO, the Gpttmpl.inf file in the corresponding Group Policy folder contains a [Group Membership] segment that resembles the following:

 [Group Membership]
<Restrict group name or SID>_Memberof = 
<Restrict group name or SID>_Members =

This problem occurs if either of the entries under the [Group Membership] segment is missing.

Back to the top

RESOLUTION

To resolve this problem, find the information that is missing from the Gpttmpl.inf file. Then, add the missing information back to the Gpttmpl.inf file.

Back to the top

MORE INFORMATION

If you enable verbose logging for GPMC, more information will be logged in the Gpmgmt.log file and in the GpmgmtManaged.log file. Both files reside in the temporary (%Temp%) folder of the current user. When this problem occurs, a message that resembles the following is logged in the GpmgmtManaged.log file:

Reporting(3516.1276)17:45:21 SecuritySettings::InitializeGPO:******The following exception occurred:
*******Message : Index was out of range. Must be non-negative and less than the size of the collection.
Parameter name: index
*******StackTrace :
at System.Collections.SortedList.GetKey(Int32 index)
at Microsoft.GroupPolicy.Reporting.Extensions.Security.SecuritySettings.InitializeGPO(GPOContext context)
Reporting(3516.1276)17:45:21 GPOUserOrComputerConfig::.ctor:******The following exception occurred:
*******Message : Errors.Extensions.GeneralFileError
*******Descriptive Message : The file "\\<DNS domain name>\SysVol\<Domain name>\Policies\<Policy GUID>\Machine\microsoft\windows nt\secedit\gpttmpl.inf" is not in a valid format. Details: Index was out of range. Must be non-negative and less than the size of the collection.
Parameter name: index
*******StackTrace :

To enable verbose logging for GPMC, follow these steps:

Click Start, click Run, type regedit, and then click OK.
Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
On the Edit menu, point to New, and then click Key.
Type Diagnostics, and then press ENTER.
Click the subkey that you created in step 4.
On the Edit menu, point to New, and then click DWORD Value.
Type gpmgmttracelevel, and then press ENTER.
Right-click gpmgmttracelevel, and then click Modify.
In the Value data box, type 2, and then click OK.
On the Edit menu, point to New, and then click DWORD Value.
Type gpmgmtlogfileonly, and then press ENTER.
Right-click gpmgmtlogfileonly, and then click Modify.
In the Value data box, type 1, and then click OK.
Exit Registry Editor.