HEX
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/8.4.25
System: Windows NT DESKTOP-4TAV2RJ 10.0 build 19045 (Windows 10) AMD64
User: fred (0)
PHP: 8.4.25
Disabled: NONE
Upload Files
File: C:/Windows/System32/zh-TW/scecli.dll.mui
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$5�<�q�R�q�R�q�R�e���p�R�e�P�p�R�Richq�R�PEL�!:

`4@ 878.rdata�@@.rsrc@ 8@@��}B
T88��}B$��8.rdata8x.rdata$zzzdbg �.rsrc$01�$xf.rsrc$02 ����Fi{�w�WR��T��<�;��0{��}B��0�H���� ��8��P��h����������������������(�@�X�p�����K��M��N����0@P`p�������� 0@P`p��$��P%B��%��|&F��)���,��X/�
��94�$;�� > �@At��A2��A���Cp�HDn��D|�4EV��E*��E���GV�I�
��S��MUI�����~��,;��;��l��ݯ�;�0p�5��)	Ɣ���MUIzh-TW
ck(W-��[�[hQ'` %sck(W�^�z %sPA\�[hQ-��[���0R�[hQ'`�{,g�v��S�O�_�v�Bf�|vu/��� %d00|vu/��� %d (Snapshot �|q}�[hQ'`0R %s Bf)0ˊ�S�����j %s �N�s�0}nj
�0|vu/��� %d (	�eQ DLL %s Bf)0|vu/��� %d (�S�_z�^ %s MO@WBf)0�b�S
kVgO(u�Bf|vu/��� 0x%x0�V�pHQMR|vu GPO /����&N*gU�t GPO %s0!q�lX[�S�{,g0/����x = %d0

	%s0�D}�SGRir�N %s -N&N*g�[��{,g0�^�z %s �v,g_j�,g0U�t GP �{,g %s0Z0x%x : %s

�S�N(W https://support.microsoft.com �S�_�POUL��v2�����f0�gb� "troubleshooting 1202 events"0�[��v EFS �SGR: w��^/f %d0

(W�PI{}&N*g�[� EFS �SGR

\ EFS �SGR2QX[0RNP�fBf_j�xBf�/����x = %d

LSA -N�sX[�v EFS �SGR (w��^=%d)

�rKa=%d -��[ EFS �SGR (w��^ %d)

EFS �SGR&N*g���f

!q�l��_U LSA �O-��[ EFS �SGR0/���=%d

�gb��P�d-N�vTuO EFS �SGRBf|vu/��� %d0

PA�S�_ DS 9h
T1zBf|vu/��� %d0��_U�Sk~P}0R DS Bf|vu/��� %d0\�SGR���f2QX[0R,g_j GPO nj�e�^Bf�|vu/��� %d0\�SGR���f��w�P�0R�SGR_�dBf|vu/��� %d0�-��D}�SGRir�N %s �]b�R0W�^�z0|vu/��� %d (����-��{,g0R %s Bf)0|vu/��� %d (�^�z�v� %s Bf)0��aԚ
N���!q�lU�t�P}T�N0�S�_�-� GPO �v�jHh�|q}_Bf|vu/��� 0x%x0+�S�_��f�҉r�Bf (DC, Server, Professional) |vu/��� %d0|vu/��� %d (��_U GPO %s Bf)0|vu/��� %d (�_ GPO %s ���S�SGRBf)0��_Unj�e�^Bf|vu/��� %d0�^�z,{�N�WL��}�v_xeBf|vu/��� %d0�^�z�WL��}Bf|vu/��� %d0�]2QX[�|q}�[hQ'`�SGR�N�SO(u�
kP��gb�0PA�gb��|q}�[hQ'`�SGR�N�SO(u�
kP�Bf|vu/��� %d0/��� %d�(ux�� %x �yd��-�-��[0�YhQ�e�|q}�v�[hQ'`-��[�-�<P�f�e�}�W�c6R�z�v�[hQ'`-��[�-�<P:�[hQ'`-��[:O
ghV ((W services.exe gQ)\*g1\�}0�S��(W�|q}͑�e��_j-N0N!k�P�dBf��SGRg�Q!k��Vf�0�[݈�_,{N!k͑�e��_jBfU�t�SGR�{x�hV���f�[݈�v LSA �SGR�]���f0�[݈�v SAM �SGR�]���f0��w�SGR:O
ghV0�
N/fg�_NP GPO : DC 
N�v�}�W�SGR��euN�0�
N/fg�_NP GPO0�/fg�_NP GPO : DC 
N�v�}�W�SGR��euN�0�/fg�_NP GPO0&(W winlogon -Nbk�WL��}�S(u�SGR�P�d0ˊ�pNO��]\O�^�z�SNP�WL��}0�SGR:O
ghV\*g1\�}�ˊ͑f��xe #%d0	ck(WWY(u�[hQ'`�SGRck(WWY(u�|q}�[hQ'`�SGR0N0x%x : %s

�S�N(W https://support.microsoft.com �S�_�POUL��v2�����f0�gb� "troubleshooting 1202 events"0



vu(WN�N�D}�SGRir�N (GPO) -N�vO(u�3^6b!q�l��㉐g�p SID Bf�1\g|vu/��� 0x5340�P/����S��/f�V�p(W GPO �vO(u�
kP�b�SP��D}P[�v�-N@b�Sgq�v8�eQ/���b�]*Rd��vO(u�3^6b@b �b0�Y�g���zl�P�N�N�ˊ#�a}�}�W�v�|q}�{t�T��O�WL�NR�R\O: 



1.	X�%R!q�l��㉐g�p SID �v3^6b:



ˊ(W}T�N�c:yW[CQ-N8�eQ: FIND /I "Cannot find"  %%SYSTEMROOT%%\Security\Logs\winlogon.log



(W FIND 8��Q-N�c(W "Cannot find" �_b��vW[2NgX�%ROUL�3^6b
T1z0



�{�O: Cannot find JohnDough.



(W�P�r�lN�O(u�
T1z "JohnDough" �v SID !q�l��$R�[0��_�S��/f�V�p3^6b�]��*Rd�0͑�e}T
T0b�b�l
NT (�O�Y "JohnDoe") @b �b0



2.	O(u RSoP �OX�%RS+TOUL�3^6b�vyr�[O(u�
kP�0�SP��D}0�S�O�n GPO:



a.	���Y -> �WL� -> RSoP.msc

b.	�j�� [��f�-��[\Windows -��[\�[hQ'`-��[\,g_j�SGR\O(u�
kP�c>m] �S [��f�-��[\Windows -��[\�[hQ'`-��[\,g_j�SGR\�SP��D}] �vP}�g��N|v�s(u�ejj��p}r� X �v/���0

c.	
\�e�NUOj�}r� X �vO(u�
kP�b�SP��D}�S+TOUL��SGR-��[�v�v
\�a GPO gR(WjL��p "�O�n GPO" �vkMON0ˊ�lack(W"uu/����vyr�[O(u�
kP�0�SP��D}0�SS+T�v�O�n GPO0



3.	�_�D}�SGR�yd�*g㉐g�v3^6b



a.	���Y -> �WL� -> MMC.EXE

b.	(W [�jHh] �R��h�x��S [�e�X/�yd�L]eQ_�{t�UCQ...]

c.	(W [�e�X/�yd�L]eQ_�{t�UCQ] 
\q��eJXx��d [�e�X...]

d.	(W [�e�Xhs�zL]eQ_�{t�UCQ] 
\q��eJXx��S [�D}�SGR]�&N	cNN [�e�X]

e.	(W [x��S�D}�SGRir�N] 
\q��eJX	cNN [p��] 	c�0

f.	(W [p���D}�SGRir�N] 
\q��eJXx��d [hQ�] "}_jd|

g.	(Wek_� 2 -N@bX�%R�v�kNP�O�n GPO��Ock(Wek_� 2 -N�N�ejj��p}r� X �vyr�[O(u�
kP�b�SP��D}0�S�N�yd�b�Ock�NUO�Sgq0R(Wek_� 1 -N@bX�%R�vOUL�3^6b��O�Ock��NO(u�
kP�b�SP��D}0BGS}�|q}�[hQ'`Bf|vu/����/����x %d0ˊ(W%windir%\security\logs\scedcpro.log -N�S��s�0}nj�e0��_U�g�N�[hQ'`nj�e�^ (�O�Y %s) Bf|vu/���0�0x%x : %s

�S�N(W https://support.microsoft.com �S�_�POUL��v2�����f0�gb� "troubleshooting 1202 events"0

/��� 0x5B4 �S��/f�V�p�a(uz_���f�SGRO(u
�Hr API��N�SGRX[>e@S�]�����[0C!q�l\ Authenticated User �T Interactive �ReQ0R,g_j Users �D}0O(u��S�N(uKb�R�e_�e�X�[P0�N %d ͑�e-��[�jHh�[hQ'`Bf|vu/���03!q�l\ Interactive �ReQ0R,g_j Power Users �D}0O(u��S�N(uKb�R�e_�e�X�[0!q�l*Rd� GP �_�S0(W�SGR�P�dKNMR�l	g-��[yr
k0�S�NeuN�0		/��� %d���_U�_�S GPO %s		�� RSOP nj�e|vu/���0/����x %d0nj
� %s0!q�l�^�z GP �_�S0	----RSOP ��Rnj�e�]b�R��0b�R�x %d0		RSOP :��enj
�0/����x %d - �O� %s0'		RSOP :��enj
�064 MOCQb 32 MOCQ_j�x0/����x %d - %s0		ck(Wnzz RSOP nj�e�^0/����x %d		RSOP ��nj
�0/����x %d - %s0%s /fNP NTFS �x�x@S09h�x�x_j %s 
N/fNP�V�[�x�x@S0!q�l���f9h�v��[hQ'`0/��� %d��gb��x�x@Snj
� %s09h�v��[hQ'`&N*g���f0 �x�x@S %s 
N/fNP NTFS �x�x@S09h�v��[hQ'`&N*g���f0/��� %d�I��c�[hQ'`�c�CQW[2N %s09h�v��[hQ'`&N*g���f0PA&(W�[hQ'`�c�CQW[2N %s -N	g
Nck�x�v�[hQ'`nj
��[�09h�v��[hQ'`&N*g���f0/��� %d��gb� %s �v�[hQ'`0)%s �v�[hQ'`&N*g���f��V�p�[
N/f Windows �-�<P0�vMR�v�[hQ'`/f %s0+�x�x@S %s �v�-��[hQ'`
N7_0Windows ck(W�X7_�_ %s ���Y�v9h�v��[hQ'`0'�_�e�v�[hQ'`�c�CQ�gb� DACL cjBf|vu/��� %d09h�v��[hQ'`&N*g���f00SetNamedSecurityInfo �P�V %d ((W%s)0vuBfck(W %s 
N-��[�[hQ'`0F/��� %d0\9h�[hQ'`�c�CQW[2N %s �[eQ0R %windir%\security	emplates\setup security.inf0|vu/��� %d ((W %s R�g9h�v��[hQ'`�c�CQBf)0/��� %d0\�c6R�ej %x �P�0R:O
ghV0(WGS}Bf!j�d(u6b�z
kVg|vu/��� %d0(WGS}Bf���S0R�SHQ�rKa|vu/��� %d0/��� 0x%x !q�l�S�_
kVg�|q}0/��� %d�!q�l�[b0R %s �v�[hQ'`�P�N0{v�<P�[hQ'`EFS �O�_PA!O(u�3^6b�c6R: (W�{t�T8h�Q!j_��|q}�{t�TKN�cGS
kP��c:y�vL��pO(u�3^6b�c6R: j�nO(u�KN�cؚ
kP��c:y�vL��pO(u�3^6b�c6R: uP,n�a(uz_�[݈�&N�c:y�cGS
kP�O(u�3^6b�c6R: @b	g�|q}�{t�TGW�N�{t�T8h�Q!j_�WL�!O(u�3^6b�c6R: \�jHh�S{v��[eQ1YWe[��dS&N2QX[��kNO(u�MOnO(u�3^6b�c6R: �Pݑ
\�]=|�z�W�I�N��v�S�WL��j��cؚvQ
kP�O(u�3^6b�c6R: �c:y�cGS
kP�BfR�c0R�[hQLhb�%O(u�3^6b�c6R: gQ�^�v Administrator 3^6b�v�{t�T8h�Q!j_(O(u�3^6b�c6R: �Pݑ
\(W�[hQMOn�[݈�v UIAccess �a(uz_��cؚvQ
kP�'O(u�3^6b�c6R: AQ1� UIAccess �a(uz_
NO(u�[hQLhb��O�c:y�cGS
kP�PA(W�[hQLhb��c:y8�eQ��I�(W�[hQLhb��c:y��BlTa�cؚ
kP��
N�c:y
��R�bU}�cGS
kP���Bl�c:y8�eQ��I��c:y��BlTa�c:y��BlTa^� Windows �N2�MO�jHhPAUsersPA�e�X %s Bf|vu/���0\�D}��l\n�U�ReQ�D} %s Bf|vu/���0\b�Tn�U�ReQ�D} %s Bf|vu/���0\ %s �ReQ %s Bf|vu/���0
�^nir�NBf|vu/���0�^nir�N %s �v�[hQ'`�c�CQBf|vu/���0
~b
N0R %s �vnj�e^��W0
~b
N0Rܕu�W[ %s0~b
N0RX�%R�x�p %d �v@S�k0�S�_ %s �v LDAP 
T1zBf|vu/���0�^�z %s Bf|vu/���0�^�z %s Bf|vu/���0�{,g_ %s /���0
%s 
N/fck�x�vyr�k
kP�0ir�NY�eM�n (%d)0aY�vܕu�W[ %s ((W@S�k %s)0ir�N %s �kL��_�	g 3 PkMO0��_U %s Bf|vu/���0(uX�%R�x %d ��_U@S�kBf|vu/���0U�tir�N %s Bf|vu/���0�gb� %s nj
�Bf|vu/���0�gb�O(u� %s yr�k
kP�c>mBf|vu/���0�gb� %s �vxe<PBf|vu/���0{v�<P %s �kL��_�	giQPkMO0-��[ %s �[hQ'`Bf|vu/���0%s �v�[eQnj
�/���0PA��X�@�@|�@�@����������$���������H
$�[hQ'`-��[�]�P�N0R %10

@�]GS}�NNP�,g�}�W�c6R�z0
N����Q�^�z�}�W�SGRir�N0

4�]{v� %1 �O�^�z�-��}�W�D}�SGRir�N0

�GPO %1 �v3^6b�SGR(�Y�g	g�vq�)�]��euN���V�p�}�W�c6R�z
N�v3^6b�SGR

�S�S�N�N��}�WI{}�D}�SGRir�N�O2�L�-��[0

0�
N!k�P�d�_��D}�SGRir�N�l	g���f0

4�D}�SGRir�N-N�v�[hQ'`�SGR�]�}WY(ub�R0

U�t�D}�SGRir�N0

��]I��c�v�x�x %1 �v�[hQ'`-��[1YWe0

ˊ�gw %%windir%%\security\logs\convert.log -N�vs�0}/���0

4(W�]I��c�v�x�x %1 -N�v�[hQ'`-��[b�R0

D�[hQ'`-��[!q�l�P�N0R�[hQ'`�{,g�v�0

�[���P�N0R %10

,!q�l�^�z�-��}�W�SGRir�N0

%1

,�[hQ'`�SGR�P�d-N+T	gf�JT0

%1

H��f������p^��}�W�c6R�z0�SGR���fg2QX[(W,g_jnj�e�^
N0

%1

4GS}/M�}�}�W�c6R�zBf|vuf�JT0

%1

P�_ LSA/SA �v�SGR���f��w�]�}�^r�0�V�p�x�xzz��
N��0

%1

49h SDDL !q�l�P�N0R�[hQ'`�{,g�v�0

�JetTerm2() !q�lck8^ܕ_j0�R ESE �[hQ'`nj�e�^�S��
NN��N!q�l�Na�y�R0Scesrv O(uYPnj�e�^�N���jg�Sgq@b	gnj�e�^0���Bf�JetInit() g�gw���j-N@bc�[�vnj�e�^MOn��N�O�_���j@b�Sgq�v@b	gnj�e�^0�Y�g(W JetTerm2() @bc�Q�v*gck8^ܕ_j��O�_g�����f�Nr�MOn�1\g|vu�P/���0�a*Rd�MO(W %%windir%%\security �v���S�j�gޞ0 

(�[hQ'`-��[&N*g���P�N0

%1

(!q�l�P�d�[hQ'`�SGR0

%1

,!q�l�^�z�-��D}�SGRir�N0

%1

D�O� LSA/SAM �v�SGR���f��w�]͑f�N1YWe0

%1

D�O� LSA/SAM �v�SGR���f!q�l�ReQ�SGRGOR0

%1

	g�N JET nj�e�^�]
d�k0ˊ�WL� esentutl /g �O�j�g�[hQ'`nj�e�^�vteT'` %%windir%%\security\Database\secedit.sdb0�Y�g�[�]
d�k�ˊVf�(W %%windir%%\security �v�-N�WL� esentutl /r 2�L�ߎԚ�O�_0�Y�gߎԚ�O�_1YWe�Vf�(W %%windir%%\security\Database\secedit.sdb �WL� esentutl /p 2�L��O�_06q�_*Rd�(W %%windir%%\security -N�v���j0

%1

��O� LSA/SAM �v�SGR���f��w*g�}�x�� PDC 1\2�L�U�t0��S��f�
N�v�
��[hQ'`�SGR�S��g����[0RvQ�N DC0

%1

��SGR_�deuN�@b	g�O� LSA/SAM �v�SGR���f��w��V�p(WI{P  PDC TekU�tBf�I{P>�Bf0��S��/f�V�p�}�0Active Directory b FRS ��[OUL�@b �b0

%1

@(W�]I��c�v�x�x-N-��[�[hQ'`Bf�	g�N�WL��}�v_xe
Nck�x0

 !q�lR�gNP�t�X��xe0

�4VS_VERSION_INFO��
4aJ
4aJ?�StringFileInfo�040404B0LCompanyNameMicrosoft CorporationTFileDescriptionWindows �[hQ'`-��[�}/�hV(u6b�z_�dn'FileVersion10.0.19041.3636 (WinBuild.160101.0800).InternalNamescecli�.LegalCopyright� Microsoft Corporation. All rights reserved.6OriginalFilenamesceclij%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.19041.3636DVarFileInfo$Translation�PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX