Group Policy servers WARNING Event ID:4098

Hi All,
On our Domain controller we get every 5minutes the following error:
Event ID: 4098
User: NT AUTHORITY\SYSTEM
Source: Group Policy Services
Description:
The computer 'Application Updater' preference item in the 'Default Domain Policy {31B2F340-016D-11D2-945F-00C04FB984F9}' Group Policy object did not apply because it failed with error code '0x80070424 The specified service does not exist as an installed
service.' This error was suppressed.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I just can't figure out what gpo setting is causing the problem....??
Anybody an idea how to solve this?

Hi,
According to the event description: The computer "Application Updater" preference item in the default domain policy..., we should troubleshoot this issue follow the steps as below:
1. As the GPO is Default Domain Policy, so the policy should be applied to all DCs and client, if the issue only occur on one of you DC, please check all the services, and find out the differences between DC and client.
2. Open Default Domain Policy, expand Computer Configuration, Preferences, Services. If you have new a service, please delete it and then check the result.
3. If the issue still there after the above troubleshoot, I would like suggest you to do DCGPOFIX.EXE, this tool could let us set the Default Domain Controller to the default setting.
DCGPOFIX - to be used - only in the last resort
http://blogs.technet.com/b/janelewis/archive/2006/09/22/458132.aspx
Hope this helps.
Best Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Similar Messages

  • Group Policy Error on WS 2012 Standard R2

    Hi,
    Is there anybody experiencing below given error messages ? Its coming to some of the terminal users and is not consistent. At that point of time they cant open mapped drives from the RDWEB session.
    There are no known DNS issues, UAC is disabled.
    The user 'P:' preference item in the 'Drive Maps Policy {94C23C7F-2EF8-4CA1-B3DF-C0CAF937EDE2}' Group Policy Object did not apply because it failed with error code '0x800704b8 An extended error has occurred.' This error was suppressed.
    Log Name: Application
    Source: Group Policy Drive maps
    Event ID: 4098
    Level: Warning
    --------ANOTHER ERROR MESSAGE ------------
    The user 'X:' preference item in the 'Drive Maps Policy {94C23C7F-2EF8-4CA1-B3DF-C0CAF937EDE2}' Group Policy Object did not apply because it failed with error code '0x80070008 Not enough storage is available to process this command.' This error was suppressed.
    Log Name: Application
    Source: Group Policy Drive maps
    Event ID: 4098
    Level: Warning
    I can't find any error message related to DNS in event viewer, all records look good to me.

    Hi,
    As I go through the .xml logs, nothing special was detected.
    Would you please let me the file server's hardware configuration and how is the server's performance?
    Besides that, could you please ask user to try on another pc and check if the problem still occurs.
    Then we may able to narrow down the scope for troubleshooting.
    Thanks and regards,
    Elaine
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Event 4098 Group Policy Printers, Printers intermittently don't deploy

     Hi,
    On a similar vein to this topic We also deploy printers Via the Server 2008 group policy preferences. All our PC's are Vista Business 32bit SP1. The problem we are having is that intermittently the printer will not install at logon. If you logoff and back on again it is there. On one particular PC I found this event in the Applications log.
    Log Name:      Application
    Source:        Group Policy Printers
    Date:          13/01/2009 4:07:48 PM
    Event ID:      4098
    Task Category: (2)
    Level:         Warning
    Keywords:      Classic
    User:          SYSTEM
    Computer:      E-HSS.cygnet.library.uwa.edu.au
    Description:
    The user 'HSSClient1' preference item in the 'Client Vista Domain Policy SP1 {A85CA6F0-874B-467F-B50A-939E64932884}' Group Policy object did not apply because it failed with error code '0x80070709 The printer name is invalid.' This error was suppressed.
    Event Xml:
      <System>
        <Provider Name="Group Policy Printers" />
        <EventID Qualifiers="34305">4098</EventID>
        <Level>3</Level>
        <Task>2</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2009-01-13T07:07:48.000Z" />
        <EventRecordID>37184</EventRecordID>
        <Channel>Application</Channel>
        <Computer>E-HSS.cygnet.library.uwa.edu.au</Computer>
        <Security UserID="S-1-5-18" />
    Now if this error happened every time we would change the name of the printer to be something more "Valid" but it doesn't and we can logon again and the printer installs fine. Can someone explain to me why it thinks HSSClient1 is invalid intermittently?
    From this thread I investigated the print processor of one of our printer queues and found is was not set to 'WinPrint' So on HSSClient1 I set the print processor to 'WinPrint'.  Do all printers managed/deployed by Group Policy preferences need to have their processor set to WinPrint?
    Regards
    Jason Langoulant
    UWA Library I.T.

    Hi,
    Regarding print processors , third party print processors are supported but not recommended. Print processors are user-mode dynamic-link libraries that are responsible for converting the spooled data of a print job to a format that can be sent to a print monitor. Print processors are also responsible for handling program requests to pause, to resume, and to cancel print jobs. But Print processors would be started during system startup. It’s not related to this GPO issue.
    This issue may occur if you create the Printer as TCP/IP printer. Please try to delete the original printer and try to create a new shared Printer in Group Policy Preferences.
    However, if it’s the original printer is not TCP/IP printer, please also try to recreate it and help to run the MPS report (PFE version) on the clients to collect reports. The MPS Reporting Tool is utilized to gather detailed information regarding a systems current configuration. The data collected will assist you with fault isolation.
    A . Please download MPS Reporting Tool (MPSRPT_PFE.EXE) from the following link:
    (http://www.microsoft.com/downloads/details.aspx?FamilyID=00ad0eac-720f-4441-9ef6-ea9f657b5c2f&DisplayLang=en)
    Please note: The link may be truncated when you read the E-mail. Be sure to include all text between '(' and ')' when navigating to the download location.
    B . Right click MPSRPT_PFE.EXE and select Run as Administrator to run this tool, and you will see a Command Window start up.
    C . Please type Y with the message of <Include the MSINFO32 report? (defaults to Y in 15 seconds)[Y,N]?
    D . When the tool is done you will see an Explorer Window opening up the %systemroot%\MPSReports\Setup\Reports\cab folder and containing a <Computername>MPSReports.cab file. After collecting, please use Windows Live SkyDrive (http://www.skydrive.live.com/) to upload the file and then give me the download address.
    Thanks.

  • Strange DNS, Group Policy & Active Directory Issues - Can't track down root issue!

    For the last few weeks, we've been getting complaints, from our developers, about not being able to authenticate on various systems.  The issues were hit & miss but still problematic enough to warrant our looking into it.  It seems to be getting
    worse...  I now have new servers that aren't getting group policy updates.  They may get some, like the list of local admins but won't pick up NTFS permissions for folder-access.  Those that pick up the AD group full of local admins have trouble
    authenticating members of the group.  Some were showing event log entries regarding authentication issues due to being unable to contact an AD DC.  We reloaded that DC but many of the issues still persist.  At this point, I'm running
    out of places to look for ideas.  I've spent the last week looking up Event Log IDs and looking though their meanings and possible remedies but, again, the issues persist.  It doesn't seem to matter what the OS is.  We've been seeing
    this on 2008, 2008-R2 & 2012-R2.
    Here are some examples of events I'm seeing.  I can't figure out the root cause(s).
    Log Name: Application
    Source: Group Policy Files
    Date: 2/19/2015 2:35:12 PM
    Event ID: 4098
    Task Category: (2)
    Level: Warning
    Keywords: Classic
    User: SYSTEM
    Computer: H2T8-IOLDP1.HOMENET.local
    Description:
    The computer 'uptime.exe' preference item in the 'APPS (UpTime) {3BF05605-27C0-43AD-AC0F-873B678EB217}' Group Policy Object did not apply because it failed with error code '0x80090006 Invalid Signature.' This error was suppressed.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Group Policy Files" />
    <EventID Qualifiers="34305">4098</EventID>
    <Level>3</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-02-19T19:35:12.000000000Z" />
    <EventRecordID>1871</EventRecordID>
    <Channel>Application</Channel>
    <Computer>H2T8-IOLDP1.HOMENET.local</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    <EventData>
    <Data>computer</Data>
    <Data>uptime.exe</Data>
    <Data>APPS (UpTime) {3BF05605-27C0-43AD-AC0F-873B678EB217}</Data>
    <Data>0x80090006 Invalid Signature.</Data>
    </EventData>
    </Event>
    Log Name: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
    Source: Microsoft-Windows-TerminalServices-RemoteConnectionManager
    Date: 2/19/2015 9:38:13 AM
    Event ID: 20499
    Task Category: None
    Level: Warning
    Keywords:
    User: NETWORK SERVICE
    Computer: H2T8-IOLDP1.HOMENET.local
    Description:
    Remote Desktop Services has taken too long to load the user configuration from server \\h2s3-addc1.HOMENET.local for user RSickler
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="{C76BAA63-AE81-421C-B425-340B4B24157F}" />
    <EventID>20499</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2015-02-19T14:38:13.182363700Z" />
    <EventRecordID>4</EventRecordID>
    <Correlation />
    <Execution ProcessID="1932" ThreadID="2156" />
    <Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin</Channel>
    <Computer>H2T8-IOLDP1.HOMENET.local</Computer>
    <Security UserID="S-1-5-20" />
    </System>
    <UserData>
    <EventXML xmlns="Event_NS">
    <ServerName>\\h2s3-addc1.HOMENET.local</ServerName>
    <UserName>RSickler</UserName>
    </EventXML>
    </UserData>
    </Event>
    Note that these servers are sitting in OUs that are full of other servers that don't have these issues.  These GPOs have been in place for years.  I suspect there's a deeper issue with AD, GP or a combination thereof.  The group policy issues
    seem to only affect freshly loaded servers...

    Hello,
    assure that no firewall is blocking connection for AD required ports as listed in
    https://technet.microsoft.com/en-us/library/dd772723(WS.10).aspx
    You have error about not connect setup from AD sites and services with the used subnets in your network and linking them to the correct site, please check this in AD sites and services and also have the DCs placed correct to the site they belong to.
    "During the past 4.20 hours there have been 83 connections to this Domain Controller from client machines whose IP addresses don't map to any of the existing sites in the enterprise. Those clients, therefore, have undefined sites and may connect to
    any Domain Controller including those that are in far distant locations from the clients. A client's site is determined by the mapping of its subnet to one of the existing sites. To move the above clients to one of the sites, please consider creating subnet
    object(s) covering the above IP addresses with mapping to one of the existing sites.  The names and IP addresses of the clients in question have been logged on this computer in the following log file '%SystemRoot%\debug\netlogon.log' and, potentially,
    in the log file '%SystemRoot%\debug\netlogon.bak' created if the former log becomes full. The log(s) may contain additional unrelated debugging information. To filter out the needed information, please search for lines which contain text 'NO_CLIENT_SITE:'.
    The first word after this string is the client name and the second word is the client IP address. The maximum size of the log(s) is controlled by the following registry DWORD value 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\LogFileMaxSize';
    the default is 20000000 bytes.  The current maximum size is 20000000 bytes.  To set a different maximum size, create the above registry value and set the desired maximum size in bytes."
    This error is about a not run adprep /rodcprep:
    Starting test: NCSecDesc
             Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
                Replicating Directory Changes In Filtered Set
             access rights for the naming context:
             DC=ForestDnsZones,DC=HOMENET,DC=local
             Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
                Replicating Directory Changes In Filtered Set
             access rights for the naming context:
    So either run the command on a DC or ignore this error.
    Please provide also the following data as file:
    ipconfig /all >c:\ipconfig.log [all DCs]
    dcdiag /v /c /d /e /s:dcname >c:\dcdiag.log
    repadmin /showrepl dc* /verbose /all /intersite >c:\repl.log  ["dc* is a place holder for the starting name of the DCs if they all begin the same (if more then one DC exists)]
    dnslint /ad /s "DCipaddress" (http://support.microsoft.com/kb/321045)
    ADREPLSTATUS:
    http://www.microsoft.com/en-us/download/details.aspx?id=30005 can also be exported to file.
    As the output will become large, DON'T post them into the thread, please use Windows Sky Drive(with open access!)
    https://skydrive.live.com and add the link from it here. Also the /e in dcdiag scans the complete forest, so better run it on COB.
    Best regards
    Meinolf Weber
    MVP, MCP, MCTS
    Microsoft MVP - Directory Services
    My Blog: http://blogs.msmvps.com/MWeber
    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
    Twitter:  
    Info you requested:
    ipconfig_dcs.txt
    dcdiag.txt
    repl.log
    dnslint.htm
    ADREPLSTATUS: ADReplicationStatus.2015.2.23.9.21.16.csv ADReplicationStatusToolData.zip

  • GPP Scheduled Task Fails in Group Policy Modeling depending on DC

    We have multiple domain controllers running at a 2003 functional level.
    We have 1 DC running Server 2003 x86 SP2 and the rest run Server 2008 (maybe R2)
    I created a GPO that includes a Scheduled Task Group Policy Preference under Computer Configuration.
    In order to test this I used Group Policy Modeling in the GPMC on a 2008 R2 Machine where I am editing Group Policy.
    If I run the modeling (perform the simulation on the 2003 DC it fails. (Note I am modeling the GPO for a different computer, not the 2003 SP2 DC, I am running the modeling for a Workstation)
    Information from the Component Status on the Summary Tab of the Modeling Report
    Component Name Status 
    Group Policy Infrastructure Success 
    EFS recovery Success (no data) 
    Group Policy Scheduled Tasks Failed 
    Group Policy Scheduled Tasks failed due to the error listed below and failed to log resultant set of policy information.
    Additional information may have been logged. Review the application event log on the domain controller on which the simulation was run for events between 2/28/2014 10:07:36 AM and 2/28/2014 10:07:36 AM. 
    Registry Success 
    Security Success 
    Info on the Settings Tab of the Modeling Report below.
    An error has occurred while collecting data for Scheduled Tasks.
    The following errors were encountered: 
    An unknown error occurred while data was gathered for this extension. Details: Invalid class  
    If I run the modeling using a 2008 DC to perform the simulation it works fine.
    Per the instructions on the Summary Tab regarding the scheduled task failure I look at the event log on the 2003 domain controller and this is what i find.
    The event I get on the 2003 DC is 8196 and I will place the details below.
    Event Type:   Error
    Event Source:           Group Policy Scheduled Tasks
    Event Category:        Disk
    Event ID:       8196
    Date:              2/27/2014
    Time:             4:48:47 PM
    User:              NT AUTHORITY\SYSTEM
    Computer:     <computername>
    Description:
    The client-side extension caught the unhandled exception '0xC0000005' inside: 'threadEntry : client main' See trace file for more details. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    So, should I be concerned that this is failing on the 2003 DC, does this mean that if my workstations authenticate to my 2003 DC that the preference will not process?
    I was reading that in 2003 client side extensions were not there and can be installed, would this make the modeling succeed?
    How do I get verified, I tried to post screenshots, but I could not. :(

    Hi Jonathan,
    As you have found the reason, I want to confirm whether the issue has been fixed.
    In fact, for Windows Server 2003 to apply or process Group Policy Preferences settings, we must install client-side extensions of GPP for Windows Server 2003.
    Although this is not related to this case, for your information, if our clients are Windows XP or Windows Vista, to use GPP, we must install client-side extensions for these
    workstations respectively.
    Regarding GPP, the following article can be referred to for more information.
    Group Policy Preferences Getting Started Guide
    http://technet.microsoft.com/en-us/library/cc731892(v=WS.10).aspx
    Best regards,
    Frank Shen

  • To get some errors about group policy due to disabled an account

    Hello
    I have an active directory on windows 2012 datacenter. there is a domain on it. it works well.
    Also there is a another AD on another location.  there is another  domain on it. also it works too. 
    there is a trust relationship between 2 domains.
    I disabled an account on first AD server 4 days ago. and then my colleague who manages second AD, notified that started to recieve some errors from eventviewer and have an issue about their group policy.
    the issue event as below;
    The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller
    (LDAP Bind function call failed). Look in the details tab for error code and description.
    Event ID 1006
    Event Source Group Policy
    I think the concerning account was built on the second AD for a service. But we don't know how we can find the account on the second AD server in order to change it.
    How can I fix the issue?
    Thanks

    Hi Yavuz,
    >>But we don't know how we can find the account on the second AD server in order to change it.
    What account did we disable? We can check the error code (displayed as a decimal) and error description fields of Event ID 1006 to see if more information can be found.
    Regarding Event ID 1006, the following article can be referred to for more information.
    Event ID 1006 — Group Policy Preprocessing (Active Directory)
    https://technet.microsoft.com/en-us/library/cc727283(v=ws.10).aspx
    Best regards,
    Frank Shen
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Event 4098, Group Policy Local Users and Groups

    Hello,
    A few of our computers on the network are not replacing the local "Administrator (built-in)"account with our administrator account we set up through Group Policy. I recieve the follow error message from the Applicaiton Logs. I'm
    not sure if this error is a PC issue instead of a Group Policy issue, because Group Policy seems to be working fine on our other PCs. Any suggestions/ideas would be helpful. Thank you.
    Error message: The computer "Administrators (built-in) preference item in the "Security Policies {CD8199AF-99A8-41F8-8D28-C92DD9C57A51}" Group Policy object did not apply because it failed with error code '0x80070526 The specified group policy
    already exists.' This error was suppressed.

    Hi,
    It seems that you have configured this security policy already, you can try run GPupdate /force command and then check if all security policies are applied in your computer:
    Resultant Set of Policy
    http://technet.microsoft.com/en-us/library/cc772175.aspx
    you can use this command to retrieve the specific group policy:
    http://technet.microsoft.com/en-us/library/ee461059.aspx
    If you have any feedback on our support, please click
    here
    Alex Zhao
    TechNet Community Support

  • Group Policy Preferences Shortcut issues ( event ID 1085 )

    I am hoping someone will be able to help me with a problem that is causing our users a headache
    We have a Windows 2008 SP2 terminal server farm ( 1 gateway, 2 Terminal servers TS1 and TS2 ), we also use Group Policy Preferences to deliver app shortcuts to different AD user groups.
    TS1 and TS2 were built from the same image.  On TS1 users logon and get all the icons they are entitled to, on TS2 it is random to whether they get their shortcuts or not.   
    Both TS are rebooted daily and I have scripted removing any local profiles incase it was something left behind.
    Checking the event Logs on TS2 I see several errors that appear to relate to Group Policy and correspond to when users have connected in.
    any help with this issue would be appreciated.
    Here is the information from the System log:
    Log Name:      System
    Source:        Microsoft-Windows-GroupPolicy
    Date:          05/12/2014 15:32:26
    Event ID:      1085
    Task Category: None
    Level:         Warning
    Keywords:      
    User:          Username
    Computer:      TerminalServer
    Description:
    Windows failed to apply the Group Policy Shortcuts settings. Group Policy Shortcuts settings might have its own log file. Please click on the "More information" link.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" />
     <EventID>1085</EventID>
        <Version>0</Version>
        <Level>3</Level>
        <Task>0</Task>
        <Opcode>1</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2014-12-05T15:32:26.450Z" />
        <EventRecordID>478778</EventRecordID>
        <Correlation ActivityID="{CCB45268-E6F8-4127-97C8-A8544829F2DE}" />
        <Execution ProcessID="344" ThreadID="11212" />
        <Channel>System</Channel>
        <Computer>TerminalServer</Computer>
        <Security UserID="S-1-5-21" />
      </System>
      <EventData>
        <Data Name="SupportInfo1">1</Data>
        <Data Name="SupportInfo2">3892</Data>
        <Data Name="ProcessingMode">1</Data>
        <Data Name="ProcessingTimeInMilliseconds">6047</Data>
        <Data Name="ErrorCode">2147942413</Data>
        <Data Name="ErrorDescription">The data is invalid. </Data>
        <Data Name="DCName”>\\OurDomain</Data>
        <Data Name="ExtensionName">Group Policy Shortcuts</Data>
        <Data Name="ExtensionId">{C418DD9D-0D14-4efb-8FBF-CFE535C8FAC7}</Data>
      </EventData>
    </Event>

    >      <Data Name="ErrorDescription">The data is invalid. </Data>
    Delete the history XML.
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • Servers take an endless time at applying group policy settings

    We have some Windows 2008R2 RDS servers that have been given a syspreped image. After a few day in production, and several nightly reboots, the servers start to hang at applying group policy setting. I have created a gpsvc.log file. What can be wrong with
    these servers?
    When i reboot the server without network connection, the reboot time is fine. The user login still takes forever.
    GPSVC(fc.4ec) 08:38:21:227 MachinePolicyCallback: Setting status UI to Beleid Group Policy Services toepassen...
    GPSVC(fc.4ec) 08:38:21:227 ProcessGPOList: No changes. CSE will not be passed in the IwbemServices intf ptr
    GPSVC(fc.1a4) 08:38:21:227 Message Status = <Beleid Group Policy Services toepassen...>
    GPSVC(fc.1a4) 08:38:21:227 Setting GPsession state = 1
    GPSVC(fc.5b4) 08:38:21:820 ProcessGroupPolicyCompletedExInternal: Entering. Extension = {827D319E-6EAC-11D2-A4EA-00C04F79F83A}, dwStatus = 0x0
    GPSVC(fc.5b4) 08:38:21:867 GetWbemServices: CoCreateInstance succeeded
    GPSVC(fc.4ec) 08:38:22:475 ProcessGroupPolicyCompletedExInternal: Entering. Extension = {91FBB303-0CD5-4055-BF42-E512A681B325}, dwStatus = 0x0
    GPSVC(fc.4ec) 08:38:22:491 GetWbemServices: CoCreateInstance succeeded
    GPSVC(5dc.5e0) 08:38:24:285 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x2a0
    GPSVC(5dc.5e0) 08:38:24:285 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.1b0) 08:38:24:285 Target = Machine
    GPSVC(5dc.5e0) 08:38:24:285 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(5dc.5e0) 08:38:24:285 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(fc.1b0) 08:38:24:285 Target = Machine, ChangeNumber 0
    GPSVC(5dc.5e0) 08:38:24:285 CGPNotify::RegisterForNotification: Entering with target S-1-5-18 and event 0x3d4
    GPSVC(5dc.5e0) 08:38:24:285 Client_InitialRegisterForNotification: User = S-1-5-18, changenumber = 0
    GPSVC(fc.1b0) 08:38:24:285 Target = S-1-5-18
    GPSVC(fc.1b0) 08:38:24:285 Could not find user by sid, finding user by session id
    GPSVC(fc.1b0) 08:38:24:285 Caller requesting for user notification/lock is from session 0
    GPSVC(5dc.5e0) 08:38:24:285 Client_RegisterForNotification: User = S-1-5-18, changenumber = 0
    GPSVC(5dc.5e0) 08:38:24:285 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(fc.1b0) 08:38:24:285 Could not find user by sid, finding user by session id
    GPSVC(fc.1b0) 08:38:24:285 Caller requesting for user notification/lock is from session 0
    GPSVC(62c.64c) 08:38:25:330 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x1d4
    GPSVC(62c.64c) 08:38:25:330 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.1b0) 08:38:25:330 Target = Machine
    GPSVC(62c.64c) 08:38:25:330 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(62c.64c) 08:38:25:330 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(298.2c0) 08:38:28:310 CGPNotify::RegisterForNotification: Entering with target Machine and event 0xab0
    GPSVC(298.2c0) 08:38:28:310 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.1b0) 08:38:28:310 Target = Machine
    GPSVC(298.2c0) 08:38:28:310 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(298.2c0) 08:38:28:310 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(fc.1b0) 08:38:28:310 Target = Machine, ChangeNumber 0
    GPSVC(fc.7c0) 08:38:39:401 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x93c
    GPSVC(fc.7c0) 08:38:39:401 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.95c) 08:38:39:401 Target = Machine
    GPSVC(fc.7c0) 08:38:39:401 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.7c0) 08:38:39:401 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(fc.95c) 08:38:39:401 Target = Machine, ChangeNumber 0
    GPSVC(53c.580) 08:40:20:755 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x608
    GPSVC(53c.580) 08:40:20:755 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.1c4) 08:40:20:755 Target = Machine
    GPSVC(53c.580) 08:40:20:755 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(53c.580) 08:40:20:755 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(53c.580) 08:40:21:098 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x64c
    GPSVC(53c.580) 08:40:21:098 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.1c4) 08:40:21:113 Target = Machine
    GPSVC(53c.580) 08:40:21:113 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(53c.580) 08:40:21:113 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(53c.564) 08:40:21:238 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x67c
    GPSVC(53c.564) 08:40:21:238 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.1c4) 08:40:21:238 Target = Machine
    GPSVC(53c.564) 08:40:21:238 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(53c.564) 08:40:21:238 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(200.f6c) 08:41:11:501 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x350
    GPSVC(200.f6c) 08:41:11:501 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.1c4) 08:41:11:501 Target = Machine
    GPSVC(200.f6c) 08:41:11:501 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(200.f6c) 08:41:11:501 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(fc.1c4) 08:41:11:891 Target = Machine
    GPSVC(fc.1c4) 08:41:11:891 Target = Machine, ChangeNumber 0
    GPSVC(fc.7d0) 08:41:11:985 Target = Machine
    GPSVC(fc.7d0) 08:41:11:985 Target = Machine, ChangeNumber 0
    GPSVC(fc.7d0) 08:41:11:985 Sid = (null), dwTimeout = 600000, dwFlags = 268435456
    GPSVC(fc.7d0) 08:41:11:985 LockPolicySection called for user <Machine>
    GPSVC(fc.7d0) 08:41:11:985 Async Lock called
    GPSVC(fc.7d0) 08:41:11:985 Reader has to wait for lock. ReaderID : 1.
    GPSVC(fc.7d0) 08:41:11:985 Registering wait for lock notification
    GPSVC(fc.9d8) 08:41:13:015 CGPNotify::RegisterForNotification: Entering with target Machine and event 0xcbc
    GPSVC(fc.9d8) 08:41:13:015 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.7d0) 08:41:13:015 Target = Machine
    GPSVC(fc.9d8) 08:41:13:015 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.9d8) 08:41:13:015 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(fc.9d8) 08:41:13:015 CGPNotify::RegisterForNotification: Entering with target Machine and event 0xd24
    GPSVC(fc.9d8) 08:41:13:015 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.7d0) 08:41:13:015 Target = Machine
    GPSVC(fc.9d8) 08:41:13:015 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.9d8) 08:41:13:015 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(200.1060) 08:43:10:223 CGPNotify::UnregisterNotification: Entering with event 0x350
    GPSVC(200.1060) 08:43:10:223 CGPNotify::AbortAsyncRegistration: No asyn registration is pending
    GPSVC(200.1060) 08:43:10:223 CGPNotify::UnregisterNotification: Canceling pending calls
    GPSVC(200.1060) 08:43:10:223 Client_CompleteNotificationCall: failed with 0x71a
    GPSVC(200.1060) 08:43:10:223 CGPNotify::UnregisterNotification: Cancelled pending calls
    GPSVC(200.1060) 08:43:10:223 CGPNotify::UnregisterNotification: Exiting with dwStatus = 0x0
    GPSVC(fc.1054) 08:43:16:252 Target = Machine
    GPSVC(fc.1054) 08:43:16:252 Target = Machine, ChangeNumber 0
    GPSVC(fc.1138) 08:43:24:188 CGPNotify::RegisterForNotification: Entering with target Machine and event 0xeac
    GPSVC(fc.1138) 08:43:24:188 Client_InitialRegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.7d0) 08:43:24:188 Target = Machine
    GPSVC(fc.1138) 08:43:24:188 Client_RegisterForNotification: User = machine, changenumber = 0
    GPSVC(fc.1138) 08:43:24:188 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(fc.1054) 08:43:29:418 Target = Machine
    GPSVC(fc.1054) 08:43:29:418 Target = Machine, ChangeNumber 0
    GPSVC(fc.1054) 08:43:50:304 Target = Machine
    GPSVC(fc.1054) 08:43:50:304 Target = Machine, ChangeNumber 0
    GPSVC(fc.1374) 08:51:06:327 Found the Waiting Rpc Reader in the waiting list. Removing it...
    GPSVC(fc.1374) 08:51:06:327 Lock timeout
    Gert MCITP SA, EA & VA

    Hi,
    From the log you submit, I found the following error:
    GPSVC(f0.13fc) 03:00:18:665 Client_CompleteNotificationCall: failed with 0x525
    GPSVC(2f0.baf4) 03:00:18:665 CGPNotify::OnNotificationTriggered: Completenotification failed with 1317
    GPSVC(518.e980) 03:00:18:665 Client_CompleteNotificationCall: failed with 0x6ba
    GPSVC(f0.13fc) 03:00:18:665 CGPNotify::OnNotificationTriggered: Trying to recover from error 1722
    GPSVC(518.e980) 03:00:18:665 CGPNotify::RegisterNotificationAsynchronously: Starting async registration
    GPSVC(3b8.3e0) 03:04:19:034 Client_RegisterForNotification: CheckRegisterForNotification returned error 0x6d9
    GPSVC(3b8.3e0) 03:04:19:034 CGPNotify::RegisterForNotification: Service not RUNNING. waiting
    GPSVC(3b8.3e0) 03:04:19:034 CGPNotify::RegisterForNotification: Trying to recover from error 1753
    GPSVC(3b8.3e0) 03:04:19:034 CGPNotify::RegisterNotificationAsynchronously: Starting async registration
    GPSVC(100.4c8) 03:05:07:753 ProcessGPOs: OpenThreadToken failed with error 1008, assuming thread is not impersonating
    GPSVC(100.13f4) 07:54:09:864 GetOldSidString:  Failed to open profile profile guid key with error 2
    GPSVC(658.2354) 09:52:41:726 Client_ProcessRefresh: ProcessRefresh returned error 0x5b4
    GPSVC(658.2354) 09:52:41:726 GetGPOList: Client_ProcessRefresh failed with 0x5b4.
    GPSVC(658.2354) 09:52:41:726 Exiting RefreshPolicyForPrincipal with status = 1460
    GPSVC(100.1a7c) 10:48:26:711 CGPAdminEventInitFailure::Initialize(): FormatMessage failed to look up error code (0x4005) due to error 317. Can not log error description.
    GPSVC(100.219c) 10:48:26:711 ProcessGPOList: Extension Internet Explorer Branding was not able to log data. Error = 0x80004005, dwRet = 1252,leaving the log dirty
    GPSVC(100.19b4) 10:48:27:491 ProcessGPOList: Extension Internet Explorer Branding was not able to log data. Error = 0x80004005, dwRet = 1252,leaving the log dirty
    1. Please try to renamed the files on the folder  c:\windows\system32\GroupPolicy to .old and ran Gpupdate /force. 
    2. Please verify the DNS set correctly and DNS Client Service is enabled. Restart the DNS Client Service.
    Hope this helps!
    Best Regards
    Elytis Cheng
    TechNetSubscriber
    Support
    If
    you are TechNetSubscription user
    and have any feedback on our support quality, please send your feedback here.
    Elytis Cheng
    TechNet Community Support

  • Event ID 1053 - Group Policy

    Recently encountered this error, following some FRS issues with SYSVOL and our NETLOGON folders (event id 13508, if anyone's interested). These replication issues have been resolved, but there is an issue with clients applying group policies. The computer side
    of the policy applies every time, no problem. The issue is to do with user policies.
    If a user logs on to a machine they were using prior to our replication issues, they receive all the relevant policies and the machine is locked down, as expected. If they log on to a machine they've never logged on to before, they don't receive any user group
    policy settings and the event viewer lists error 1053 (with the machine being wide open to their assault).
    Event 1053: The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following: 
    a) Name Resolution failure on the current domain controller. 
    b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
    Running a gpupdate /force doesn't apply these policies, only presenting this error...
    The processing of group policy. Windows could not resolve the user name.
    This could be caused by one of the following:
    a) Name Resolution failure on the current domain controller - We're quite confident this isn't the problem.
    b) Active Directory Replication Latency (An account created on another domain controller has no replicated to the current domain controller) - Checked this, all accounts have been replicated. 
    Upon producing a GPreport I receive this error:
    Group Policy Infrastructure failed due to the error listed below.
    The specified account does not exist. 
    Note: Due to the GP Core failure, none of the other Group Policy components processed their policy. Consequently, status information for the other components is not available.
    Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between 13/11/2014 14:06:30 and 13/11/2014 14:06:32.
    System
    Provider
    [ Name]
    Microsoft-Windows-GroupPolicy
    [ Guid]
    {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
    EventID
    1053
    Version
    0
    Level
    2
    Task
    0
    Opcode
    1
    Keywords
    0x8000000000000000
    TimeCreated
    [ SystemTime]
    2014-11-14T08:18:32.372783400Z
    EventRecordID
    59591
    Correlation
    [ ActivityID]
    {C3B036F5-272A-42A7-8AB1-2C2C2DCA0448}
    Execution
    [ ProcessID]
    1100
    [ ThreadID]
    3000
    Channel
    System
    Computer
    XX-XXXX-XX.XXXXXXX.local
    Security
    [ UserID]
    S-1-5-21-4153847986-3925515210-898707684-6794
    EventData
    SupportInfo1
    1
    SupportInfo2
    1632
    ProcessingMode
    1
    ProcessingTimeInMilliseconds
    1544
    ErrorCode
    1317
    ErrorDescription
    The specified account does not exist. 
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
      <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}"
    />
      <EventID>1053</EventID>
      <Version>0</Version>
      <Level>2</Level>
      <Task>0</Task>
      <Opcode>1</Opcode>
      <Keywords>0x8000000000000000</Keywords>
      <TimeCreated
    SystemTime="2014-11-14T08:18:32.372783400Z" />
      <EventRecordID>59591</EventRecordID>
      <Correlation
    ActivityID="{C3B036F5-272A-42A7-8AB1-2C2C2DCA0448}" />
      <Execution ProcessID="1100" ThreadID="3000" />
      <Channel>System</Channel>
      <Computer>XX-XXXX-XX.XXXXXXX.local</Computer>
      <Security UserID="S-1-5-21-4153847986-3925515210-898707684-6794" />
      </System>
    <EventData>
      <Data Name="SupportInfo1">1</Data>
      <Data Name="SupportInfo2">1632</Data>
      <Data Name="ProcessingMode">1</Data>
      <Data Name="ProcessingTimeInMilliseconds">1544</Data>
      <Data Name="ErrorCode">1317</Data>
      <Data Name="ErrorDescription">The specified account does not exist.</Data>
      </EventData>
      </Event>
    Any help would be much appreciated. 
    Thanks,
    J.

    Hi J,
    Looks like this could be an access/permissons issue. Could you just confirm a couple of things though:
    Use nslookup to
    confirm you can resolve addresses of the domain controllers
    Use ipconfig /all on a user PC to make sure you are hitting the correct DNS servers
    Assuming this is all okay (which I'm sure it is), take a look at
    this thread with a similar issue. In the end it was determined that several necessary ports were not open on the DC, which resulted in errors with group policy.
    Have a read of that and let us know how you get on. Sorry I can't be of more help at the moment, it feels like this might be a "trial and error" problem!
    Regards,
    James Henderson
    MTA: Windows Server Admin Essentials
    MTA: Networking Fundamentals

  • Slow logins to domain, several event ID errors (group policy, netlogon, NTP errors)

    We have a laptop user who was experiencing slow logons in a remote office.   (Remote office has 100 users, only 1 is reporting the issue).  Helpdesk swapped computers to give the user brand new hardware.   The new laptop worked
    fine while in the IT department in the main office, the user returned to their desk in their remote office after replacing the laptop and logged in and experienced the same slow logon issues as the older laptop.
    Logons take up to 45 mins to process.  (Login script hangs and does not process).  During the process, you can check IPConfig and it received the proper DNS settings.  you can ping the authenticating server by name.  We have scanning
    on our local copiers setup to scan to the users desktop, and this errors out.  DNS on the AD controller shows the proper IP address for the machine and you can ping the machine by name.
    System Event log is loaded with errors:
    Event ID 5719 - Netlogon, computer not able to setup a secure session with a domain controller in the domain
    Event ID 1129 - Group Policy, processing of Group Policy failed because of lack of network connectivity
    Event ID 129 - Time Service, NTP Client was unable to set a domain peer to use as a time source
    Event ID 5783 - NetLogon, The session setup to the WIndows NT or 2000 domain controller (xxx) for the domain is not responsive.  RPC call cancelled.   (NOTE - you can ping this domain controller by name and by IP with no issues)
    Event ID 130 - Time-Service, NTP client unable to set a domain peer
    All these seem to point to RPC errors timing out because they cannot communicate to the network resources.  The problem happens on wired or wireless connections.  We had the user move to a different network connection (one we know is working for
    another user) the problem persists.   The problem was on the original computer and continues to happen even after replacing the hardware with a brand new laptop.
    I have tried running the following hotfix.  Which does not resolve the issue: 
    http://support2.microsoft.com/kb/2459530 which technically this shouldn't be an issue because we use DHCP off the 2003 AD domain controller.
    I have checked the domain controller, AD Replication is processing with no issues.  DNS is working.  The local DHCP server has no issues or events related to this account and neither does the local DNS server or the authenticating server (which
    is in another remote office). 
     

    Hi,
    As we know, most of the time error event 5719 is caused by network connectivity issues or name resolution issue, I suggest you refer to this link to make a further analysis
    http://blogs.technet.com/b/instan/archive/2008/09/18/netlogon-5719-and-the-disappearing-domain.aspx
    And this link:
    Root Causes for Slow Boots and Logons
    http://social.technet.microsoft.com/wiki/contents/articles/10130.root-causes-for-slow-boots-and-logons-sbsl.aspx
    Yolanda Zhu
    TechNet Community Support

  • Event ID 1058 Group Policy Preprocessing Error Code 3

    You will see this in the event logs, the processing of group policy failed. It is trying to process a policy that doesn't exist. After reading http://technet.microsoft.c the
    first resolution Error code 3 (The system cannot find the path specified) lead me to this --> http://support.microsoft.c
    4. In the right details pane, double-click DisableDFS.  
    This entry doesn't exist but if I add it, it works. Problem is solved on machine 1. 
    Machine 2. This is a brand new Windows 7 setup to investigate this problem because it appears on a lot of the workstations and I have no idea why. Applying this fix did NOT solve the problem. I am a bit stuck. I have new GPs to roll out but they
    won't apply with this error in place.
    I can ping the logon server just fine and I can get to \\FQDN\sysvol as well. gpupdate /force shows the same error in the event log.

    Hi,
    Have you tried all steps in the link:
    http://support.microsoft.com/kb/314494?
    Verify you can read gpt.ini using the full network path, full network path to the gpt.ini as \\<dcName>\SYSVOL\<domain>\Policies\<guid>\gpt.ini where <dcName> is the name of the domain controller,
    <domain> is the name of the domain, and <guid> is the GUID of the policy folder.
    Please post the full event message for further analysis. In addition, we need to know that what policy did you set that could not be applied.
    Regards,
    Yan Li 
    Regards, Yan Li

  • Event ID 1085 on DC - Failed to Apply the Group Policy Local Users and Groups Settings

    I have a domain with 2 DCs.  The primary DC is running Server 2012 and is raising Event ID 1085 every 10 minutes and 20 seconds.
    Windows failed to apply the Group Policy Local Users and Groups settings. Group Policy Local Users and Groups settings might have its own log file. Please click on the "More information" link.
    System
    - Provider
    [ Name] Microsoft-Windows-GroupPolicy
    [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
    EventID 1085
    Version 0
    Level 3
    Task 0
    Opcode 1
    Keywords 0x8000000000000000
    - TimeCreated
    [ SystemTime] 2014-10-20T20:09:03.706992400Z
    EventRecordID 130087
    - Correlation
    [ ActivityID] {FDDFB8C5-9ECF-41B9-B2B4-3AD0B345A37A}
    - Execution
    [ ProcessID] 1000
    [ ThreadID] 3280
    Channel System
    Computer SERVER.DOMAIN.NAME
    - Security
    [ UserID] S-1-5-18
    - EventData
    SupportInfo1 1
    SupportInfo2 4404
    ProcessingMode 0
    ProcessingTimeInMilliseconds 10343
    ErrorCode 183
    ErrorDescription Cannot create a file when that file already exists.
    DCName \\SERVER.DOMAIN.name
    ExtensionName Group Policy Local Users and Groups
    ExtensionId {17D89FEC-5C44-4972-B12D-241CAEF74509}
    Everything I look up for Event ID 1085 seems to be about a different cause.
    Any ideas?

    I enabled tracing on a domain gpo and I still get the error when running gpupdate /force .
    I'm also still getting Event 1085.  Here's the trace file.  I've anonymized the site/domain and the GUIDs.
    2014-10-21 11:16:54.003 [pid=0x3e8,tid=0xcd0] Entering ProcessGroupPolicyExLocUsAndGroups()
    2014-10-21 11:16:54.018 [pid=0x3e8,tid=0xcd0] SOFTWARE\Policies\Microsoft\Windows\Group Policy\{GUID-1}
    2014-10-21 11:16:54.018 [pid=0x3e8,tid=0xcd0] BackgroundPriorityLevel ( 0 )
    2014-10-21 11:16:54.018 [pid=0x3e8,tid=0xcd0] DisableRSoP ( 0 )
    2014-10-21 11:16:54.018 [pid=0x3e8,tid=0xcd0] LogLevel ( 2 )
    2014-10-21 11:16:54.018 [pid=0x3e8,tid=0xcd0] Command subsystem initialized. [SUCCEEDED(S_FALSE)]
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] Background priority set to 0 (Idle).
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] ----- Parameters
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] CSE GUID : {GUID-1}
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] Flags : ( X ) GPO_INFO_FLAG_MACHINE - Apply machine policy rather than user policy
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] ( X ) GPO_INFO_FLAG_BACKGROUND - Background refresh of policy (ok to do slow stuff)
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] ( ) GPO_INFO_FLAG_SLOWLINK - Policy is being applied across a slow link
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] ( ) GPO_INFO_FLAG_VERBOSE - Verbose output to the eventlog
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] ( ) GPO_INFO_FLAG_NOCHANGES - No changes were detected to the Group Policy Objects
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] ( ) GPO_INFO_FLAG_LINKTRANSITION - A change in link speed was detected between previous policy application and current policy application
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] ( ) GPO_INFO_FLAG_LOGRSOP_TRANSITION - A change in RSoP logging was detected between the application of the previous policy and the application of the current policy.
    2014-10-21 11:16:54.065 [pid=0x3e8,tid=0xcd0] ( X ) GPO_INFO_FLAG_FORCED_REFRESH - Forced Refresh is being applied. redo policies.
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ( ) GPO_INFO_FLAG_SAFEMODE_BOOT - windows safe mode boot flag
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ( ) GPO_INFO_FLAG_ASYNC_FOREGROUND - Asynchronous foreground refresh of policy
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Token (computer or user SID): S-1-5-18
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Abort Flag : Yes (0x313be090)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] HKey Root : Yes (0x80000002)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Deleted GPO List : No
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Changed GPO List : Yes
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Asynchronous Processing : Yes
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Status Callback : No (0x00000000)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] WMI namespace : Yes (0x32273740)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] RSoP Status : Yes (0x320cc7f4)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Planning Mode Site : (none)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Computer Target : No (0x00000000)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] User Target : No (0x00000000)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Calculated list relevance. [SUCCEEDED(S_FALSE)]
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ----- Changed - 0
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Options : ( ) GPO_FLAG_DISABLE - This GPO is disabled.
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ( ) GPO_FLAG_FORCE - Do not override the settings in this GPO with settings in a subsequent GPO.
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Options (raw) : 0x00000000
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] Version : 19267878 (0x01260126)
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] GPC : LDAP://CN=Machine,CN={GUID-2},CN=Policies,CN=System,DC=SITE,DC=DOMAIN
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] GPT : \\SITE.DOMAIN\sysvol\SITE.DOMAIN\Policies\{GUID-2}\Machine
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] GPO Display Name : Default Domain Policy
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] GPO Name : {GUID-2}
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] GPO Link : ( ) GPLinkUnknown - No link information is available.
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ( ) GPLinkMachine - The GPO is linked to a computer (local or remote).
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ( ) GPLinkSite - The GPO is linked to a site.
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ( X ) GPLinkDomain - The GPO is linked to a domain.
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ( ) GPLinkOrganizationalUnit - The GPO is linked to an organizational unit.
    2014-10-21 11:16:54.081 [pid=0x3e8,tid=0xcd0] ( ) GP Link Error
    2014-10-21 11:16:54.096 [pid=0x3e8,tid=0xcd0] lParam : 0x00000000
    2014-10-21 11:16:54.096 [pid=0x3e8,tid=0xcd0] Prev GPO : No
    2014-10-21 11:16:54.096 [pid=0x3e8,tid=0xcd0] Next GPO : Yes
    2014-10-21 11:16:54.096 [pid=0x3e8,tid=0xcd0] Extensions : [{00000000-0000-0000-0000-000000000000}{GUID-3}][{GUID-1}{GUID-3}][{GUID-4}{GUID-5}{GUID-6}{GUID-7}{GUID-8}][{GUID-9}{GUID-10}][{GUID-11}{GUID-5}{GUID-6}]
    2014-10-21 11:16:54.096 [pid=0x3e8,tid=0xcd0] lParam2 : 0x3146f978
    2014-10-21 11:16:54.096 [pid=0x3e8,tid=0xcd0] Link : LDAP://DC=SITE,DC=DOMAIN
    2014-10-21 11:16:54.096 [pid=0x3e8,tid=0xcd0] Purge GPH : C:\ProgramData\Microsoft\Group Policy\History\{GUID-2}\Machine\Preferences\Groups\Groups.xml
    2014-10-21 11:16:54.096 [pid=0x3e8,tid=0xcd0] Read GPE XML data file (592 bytes total).
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] ----- Changed - 1
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] Options : ( ) GPO_FLAG_DISABLE - This GPO is disabled.
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] ( ) GPO_FLAG_FORCE - Do not override the settings in this GPO with settings in a subsequent GPO.
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] Options (raw) : 0x00000000
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] Version : 1245203 (0x00130013)
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] GPC : LDAP://CN=Machine,CN={GUID-12},CN=Policies,CN=System,DC=SITE,DC=DOMAIN
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] GPT : \\SITE.DOMAIN\sysvol\SITE.DOMAIN\Policies\{GUID-12}\Machine
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] GPO Display Name : Default Domain Controllers Policy
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] GPO Name : {GUID-12}
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] GPO Link : ( ) GPLinkUnknown - No link information is available.
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] ( ) GPLinkMachine - The GPO is linked to a computer (local or remote).
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] ( ) GPLinkSite - The GPO is linked to a site.
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] ( ) GPLinkDomain - The GPO is linked to a domain.
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] ( X ) GPLinkOrganizationalUnit - The GPO is linked to an organizational unit.
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] ( ) GP Link Error
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] lParam : 0x00000000
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] Prev GPO : Yes
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] Next GPO : No
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] Extensions : [{00000000-0000-0000-0000-000000000000}{GUID-3}][{GUID-1}{GUID-3}][{GUID-9}{GUID-10}]
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] lParam2 : 0x324e8198
    2014-10-21 11:16:54.112 [pid=0x3e8,tid=0xcd0] Link : LDAP://OU=Domain Controllers,DC=SITE,DC=DOMAIN
    2014-10-21 11:16:54.127 [pid=0x3e8,tid=0xcd0] Purge GPH : C:\ProgramData\Microsoft\Group Policy\History\{GUID-12}\Machine\Preferences\Groups\Groups.xml
    2014-10-21 11:16:54.127 [pid=0x3e8,tid=0xcd0] Read GPE XML data file (592 bytes total).
    2014-10-21 11:16:54.143 [pid=0x3e8,tid=0xcd0] Completed get next GPO. [SUCCEEDED(S_FALSE)]
    2014-10-21 11:16:54.143 [pid=0x3e8,tid=0xcd0] WQL : SELECT * FROM RSOP_PolmkrSetting WHERE polmkrBaseCseGuid = "{GUID-1}"
    2014-10-21 11:16:54.143 [pid=0x3e8,tid=0xcd0] Purged 2 old RSoP entries.
    2014-10-21 11:16:54.143 [pid=0x3e8,tid=0xcd0] Logging 2 new RSoP entries.
    2014-10-21 11:16:54.159 [pid=0x3e8,tid=0xcd0] RSoP Entry 0
    2014-10-21 11:16:54.174 [pid=0x3e8,tid=0xcd0] RSoP Entry 1
    2014-10-21 11:16:54.174 [pid=0x3e8,tid=0xcd0] Completed get GPO list. [SUCCEEDED(S_FALSE)]
    2014-10-21 11:16:54.174 [pid=0x3e8,tid=0xcd0] IsRsopPlanningMode() [SUCCEEDED(S_FALSE)]
    2014-10-21 11:17:04.252 [pid=0x3e8,tid=0xcd0] Completed settings update (csePostProcess). [ hr = 0x800700b7 "Cannot create a file when that file already exists." ]
    2014-10-21 11:17:04.252 [pid=0x3e8,tid=0xcd0] Completed CSE post-processing. [ hr = 0x800700b7 "Cannot create a file when that file already exists." ]
    2014-10-21 11:17:04.267 [pid=0x3e8,tid=0xcd0] Leaving ProcessGroupPolicyExLocUsAndGroups() returned 0x000000b7

  • Group Policy failing intermittently on one of my servers

    Have you checked the event logs to see if a specific thing is triggering it?
    CMOS battery been changed (if the date/time is being reset this can be the cause)?
    Or GPResult to check that what should be applied is being applied?

    I have a server-2008 R2 box where Group Policy fails intermittently. The result is the server looses it's domain trust connection, exact error message is: Remote Desktop cannot verify the ID of the remote computer because there is a time or date difference....
    I can reboot the server and it's fixed, but a month later it will have the same issue.
    What can I look for to troubleshoot resolve, and what can I monitor to fix this? GP service? If the service is running & the interface, port, or bad cable, I will not be alerted. Can I configure some type of alert that tells me when GP replication with the domain controller has succeeded/failed?
    This topic first appeared in the Spiceworks Community

  • Event ID 5002/5014 Group Policy DFSR problem

    I have 4 domain controllers all are running on windows server 2012. RPC always disconnects/fails having error event Ids 5002 and 5014. AD objects are replicated across DCs but on Group policy DCs are either inaccessible or differ in GPO Version.
    thanks for the help.

    Good.  Okay, then it's just the 5014's & 5002's. 
    Here's a wiki on 5002:
    http://social.technet.microsoft.com/wiki/contents/articles/1207.dfsr-event-5002-dfs-replication.aspx
    On the 5014, there should be a corresponding error number. Can you please respond with that and the specific error messaged (edited for privacy, of course.)?

Maybe you are looking for

  • If RuneScape uses Java 3D why don't you need to install it?

    I was just wondering if RuneScape uses Java 3D, why doesn't anyone need to install it? Is it because the game is intirely server side and all the graphics and stuff is done over on their servers and not on your own computer? Thanks.

  • JasperReports in Oracle 10g?

    Hi I have seen this small java sample there show how to use JasperReports. http://www.cise.ufl.edu/~otopsaka/CIS4301/ReportDemo/ReportFromJava.html Is it possibel to store a littel java program like the samle as stored procedure and run the stored pr

  • Production mode startup failure for 8.1SP2

    I'm running BEA WL 8.1 on Windows 2000 and have created a new server configuration in production mode with JRocket using the Configuration Wizard through Express Setup. I am unable to successfully start the server manually or through the Workshop int

  • Error Message when running first java program

    Hi, I am reading "Sams Teach Yourself Java 6 in 21 Days" by Rogers Cadenhead. I am having a problem with compiling the sample program in the first part of the book, "HelloUser" which is supposed to print out "Hello (my name - Matt)" when run in the c

  • 'Auto resize image' 'Settings' dialog box controls

    I have a signature that contains an avatar image (size 120px by 120px) Every time I 'Send' an 'Auto Resize Image' > 'Settings' dialogue box pops up How can I bypass this as its becoming annoying. Most emails (98%) do not contain any other embedded or