Event id : 4098

The computer 'RpcSs' preference item in the 'Default Domain Policy {31B2F340-016D-11D2-945F-00C04FB984F9}' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied.' This error was suppressed.

Hi rafik_sh,
Firstly, this issue can be caused due to incorrect permission settings.
Please refer to the following Microsoft TechNet blog for how to correct the permission settings.
Group Policies and Access Denied
http://blogs.technet.com/b/matthewms/archive/2005/10/29/413275.aspx
In addition, if you use the replace mode, please change the policy action from "replace" mode to "update" mode.
What' s more, please refer to the following similar post to get more help:
Event ID: 4098 Source: Group Policy Drive Mappings
http://social.technet.microsoft.com/Forums/windowsserver/en-US/703cb099-8d39-4695-972f-69c27dd06563/event-id-4098-source-group-policy-drive-mappings?forum=winserverGP
Regards,
Lany Zhang

Similar Messages

Group Policy servers WARNING Event ID:4098

Hi All,
On our Domain controller we get every 5minutes the following error:
Event ID: 4098
User: NT AUTHORITY\SYSTEM
Source: Group Policy Services
Description:
The computer 'Application Updater' preference item in the 'Default Domain Policy {31B2F340-016D-11D2-945F-00C04FB984F9}' Group Policy object did not apply because it failed with error code '0x80070424 The specified service does not exist as an installed
service.' This error was suppressed.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I just can't figure out what gpo setting is causing the problem....??
Anybody an idea how to solve this?

Hi,
According to the event description: The computer "Application Updater" preference item in the default domain policy..., we should troubleshoot this issue follow the steps as below:
1. As the GPO is Default Domain Policy, so the policy should be applied to all DCs and client, if the issue only occur on one of you DC, please check all the services, and find out the differences between DC and client.
2. Open Default Domain Policy, expand Computer Configuration, Preferences, Services. If you have new a service, please delete it and then check the result.
3. If the issue still there after the above troubleshoot, I would like suggest you to do DCGPOFIX.EXE, this tool could let us set the Default Domain Controller to the default setting.
DCGPOFIX - to be used - only in the last resort
http://blogs.technet.com/b/janelewis/archive/2006/09/22/458132.aspx
Hope this helps.
Best Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Event 4098 Group Policy Printers, Printers intermittently don't deploy

Hi,
On a similar vein to this topic We also deploy printers Via the Server 2008 group policy preferences. All our PC's are Vista Business 32bit SP1. The problem we are having is that intermittently the printer will not install at logon. If you logoff and back on again it is there. On one particular PC I found this event in the Applications log.
Log Name:      Application
Source:        Group Policy Printers
Date:          13/01/2009 4:07:48 PM
Event ID:      4098
Task Category: (2)
Level:         Warning
Keywords:      Classic
User:          SYSTEM
Computer:      E-HSS.cygnet.library.uwa.edu.au
Description:
The user 'HSSClient1' preference item in the 'Client Vista Domain Policy SP1 {A85CA6F0-874B-467F-B50A-939E64932884}' Group Policy object did not apply because it failed with error code '0x80070709 The printer name is invalid.' This error was suppressed.
Event Xml:
<System>
    <Provider Name="Group Policy Printers" />
    <EventID Qualifiers="34305">4098</EventID>
    <Level>3</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-01-13T07:07:48.000Z" />
    <EventRecordID>37184</EventRecordID>
    <Channel>Application</Channel>
    <Computer>E-HSS.cygnet.library.uwa.edu.au</Computer>
    <Security UserID="S-1-5-18" />
Now if this error happened every time we would change the name of the printer to be something more "Valid" but it doesn't and we can logon again and the printer installs fine. Can someone explain to me why it thinks HSSClient1 is invalid intermittently?
From this thread I investigated the print processor of one of our printer queues and found is was not set to 'WinPrint' So on HSSClient1 I set the print processor to 'WinPrint'. Do all printers managed/deployed by Group Policy preferences need to have their processor set to WinPrint?
Regards
Jason Langoulant
UWA Library I.T.

Hi,
Regarding print processors , third party print processors are supported but not recommended. Print processors are user-mode dynamic-link libraries that are responsible for converting the spooled data of a print job to a format that can be sent to a print monitor. Print processors are also responsible for handling program requests to pause, to resume, and to cancel print jobs. But Print processors would be started during system startup. It’s not related to this GPO issue.
This issue may occur if you create the Printer as TCP/IP printer. Please try to delete the original printer and try to create a new shared Printer in Group Policy Preferences.
However, if it’s the original printer is not TCP/IP printer, please also try to recreate it and help to run the MPS report (PFE version) on the clients to collect reports. The MPS Reporting Tool is utilized to gather detailed information regarding a systems current configuration. The data collected will assist you with fault isolation.
A . Please download MPS Reporting Tool (MPSRPT_PFE.EXE) from the following link:
(http://www.microsoft.com/downloads/details.aspx?FamilyID=00ad0eac-720f-4441-9ef6-ea9f657b5c2f&DisplayLang=en)
Please note: The link may be truncated when you read the E-mail. Be sure to include all text between '(' and ')' when navigating to the download location.
B . Right click MPSRPT_PFE.EXE and select Run as Administrator to run this tool, and you will see a Command Window start up.
C . Please type Y with the message of <Include the MSINFO32 report? (defaults to Y in 15 seconds)[Y,N]?
D . When the tool is done you will see an Explorer Window opening up the %systemroot%\MPSReports\Setup\Reports\cab folder and containing a <Computername>MPSReports.cab file. After collecting, please use Windows Live SkyDrive (http://www.skydrive.live.com/) to upload the file and then give me the download address.
Thanks.

Monitoring File History / backups in Windows 8.1

Hi,
By tracking some events I was able to monitor Windows 7 Backups. By means of of schedule task triggered by the events belows.
Image Backup successful : Event log : Microsoft/Windows/Backup/Operational. Source : Backup. Event ID : 14.
Profile Backup successful : Event Log : Application. Source : Windows Backup. Event ID 4098
(BTW, the Microsoft/Windows/Backup/Operational log not holding all backup logging is a bit disappointing, to say the least.)
How can I monitor Windows 8 "File history" ?
I we keep the default "every hour" File History, the best approach is perhaps to track failures instead of success. Also because I haven't seen any event logged for a successful backup into the log : Microsoft/Windows/FileHistory-Engine/File history
backup log/Operational.
When I disconnect the backup device I get and Event ID 203 in there, though.
What are other event IDs related to a backup failure ?
Is there a configurable Action Center notification on backup failure ?

Hi,
Log files related to File History can be found in Applications and Service Logs -> Microsoft -> Windows. We found following two interesting event files:
WHC under FileHistory-Core
File History Backup Log under FileHistory-Engine
The entries of Information level in WHC appears whenever File History runs, stops, turns off or on. On the other hand, File History Backup Log records warnings or error messages, for instance, file was not backed up due to xyz error, unusual
condition was encountered during finalization of a backup cycle for configuration, unable to scan user libraries for changes and perform backup of modified files for configuration.
For more information about file history, you can refer to this link:
Windows 8 File History Analysis
http://articles.forensicfocus.com/2013/11/24/2869/
Hope these could be helpful.
Kate Li
TechNet Community Support

Group Policy won't apply, No mapping between account names and security IDs was done.

I am using Group Policy Preferences to remove users from the local admin group and add a local admin account. This GPO is working on 90% of the Win7 machines on the network, but three laptops are not accepting the GPO. I get the following error:
Log Name:      Application
Source:        Group Policy Local Users and Groups
Date:          6/24/2014 8:49:28 AM
Event ID:      4098
Task Category: (2)
Level:         Warning
Keywords:      Classic
User:          SYSTEM
Computer:      laptop1.internal.com
Description:
The user 'Administrators' preference item in the 'Local Admin Policy - Remove Permissions {593ACD77-3663-4023-BEB8-938D83F7862E}' Group Policy object did not apply because it failed with error code '0x80070534 No mapping between account names and security
IDs was done.' This error was suppressed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Group Policy Local Users and Groups" />
    <EventID Qualifiers="34305">4098</EventID>
    <Level>3</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-24T13:49:28.000000000Z" />
    <EventRecordID>68771</EventRecordID>
    <Channel>Application</Channel>
    <Computer>laptop1.internal.com</Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data>user</Data>
    <Data>Administrators</Data>
    <Data>Local Admin Policy - Remove Permissions {593ACD77-3663-4023-BEB8-938D83F7862E}</Data>
    <Data>0x80070534 No mapping between account names and security IDs was done.</Data>
</EventData>
</Event>
I've searched high and low for an answer and nothing I find on-line seems to apply. I also notice that the option to 'Run as Administrator' does not work. If I right-click on cmd.exe and select 'run as administrator', the command box opens but
I am not prompted for credentials and the command box does not have admin rights. Not sure if this is related or not.
Any help on this would be greatly appreciated.
Thanks,
Joe

Hi,
Delete your remove action from the GPP and push it again, does this issue still occur?
If it still exists, let’s collect the GPP log for analysis:
Group policy Preference debug logging policy settings are located under:
Computer Configuration\Administrative Templates\System\Group Policy
Click Logging and tracing, select local users and group preference logging and trace.
Meanwhile, just a similar issue, but it is worth trying:
A user is added to the wrong group on a client computer that is running Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/2280515
If you have any feedback on our support, please click
here
Alex Zhao
TechNet Community Support

Management of printers

Current infrastructure is AD Windows Server 2008 R2
dedicated server as Print Server Windows Server 2003
workstations Windows 7
a. Task to migrate Print Server settings to a new dedicated server Print Server Windows 2008 R2.
   To retrieve currents settings from server and move to a new Print Server, it could either be done
   1. Power Shell
      Export the settings to a file from 2003 Print Server and import then from file to 2008 Print Server.
   2. Print Management features from Windows Server 2008 R2 to transfer the settings.
   which method is more reliable or permissible?
b. The second, question is about the deployment of printers in the organization
    Present time, No GP define to control or limit the amount of printers in the organization (65 and Plotter no accessible to any regular users.
c.   Also no present means to schedule a task to monitor event id 4098 or any other event id associate with jam printers
   About the second requirement I just could not persuade management to limit printers by department location.
   So user will get all 65 printers to connect too. (Shared Network). Could this present a security breach?
   In order to monitor printer problems, there should be one GPP at the Domain level and generate the task?
   Can someone clarify the best course of actions for all three bullets?
michael john ocasio

Hi Michael,
>>a. Task to migrate Print Server settings to a new dedicated server Print Server Windows 2008 R2
Before we do the migration, we must install a Windows 2008 R2 x64 compatible driver for each printer on the x32 server. Windows 32-bit printer drivers don't migrate
to Windows 64-bit editions due to the changes in the way the kernel interacts with printers.
Regarding which way is better for retrieving currents settings, for I am not too much familiar with printer migration with Powershell, here I suggest that we can
use Printer Migration Wizard to do this.
Regarding how to this, the following articles can be referred to for more information.
Migrate Print Servers
http://technet.microsoft.com/en-us/library/cc722360.aspx
Migrating Printers from Server 2003 x32 to Server 2008 R2 x64
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_Server_2008/A_3358-Migrating-Printers-from-Server-2003-x32-to-Server-2008-R2-x64.html
>>b. The second, question is about the deployment of printers in the organization
Regarding this point, the following article and blog can be referred to for information.
Deploying Printers by Using Group Policy
http://technet.microsoft.com/en-us/library/cc754699.aspx
Deploying Printers with Group Policy Preferences (Complete Guide)
http://deployhappiness.com/deploying-printers-with-group-policy-preferences/
>>c.
Also no present means to schedule a task to monitor event id 4098 or any other event id associate with jam printers
We can utilize Server Manager or Printer Management to manage and monitor printers in our network environment.
Regarding printer management and security, the following article can be referred to for more information.
Print Management Step-by-Step Guide
http://technet.microsoft.com/en-us/library/cc753109(v=ws.10).aspx
Best regards,
Frank Shen

Strange DNS, Group Policy & Active Directory Issues - Can't track down root issue!

For the last few weeks, we've been getting complaints, from our developers, about not being able to authenticate on various systems. The issues were hit & miss but still problematic enough to warrant our looking into it. It seems to be getting
worse... I now have new servers that aren't getting group policy updates. They may get some, like the list of local admins but won't pick up NTFS permissions for folder-access. Those that pick up the AD group full of local admins have trouble
authenticating members of the group. Some were showing event log entries regarding authentication issues due to being unable to contact an AD DC. We reloaded that DC but many of the issues still persist. At this point, I'm running
out of places to look for ideas. I've spent the last week looking up Event Log IDs and looking though their meanings and possible remedies but, again, the issues persist. It doesn't seem to matter what the OS is. We've been seeing
this on 2008, 2008-R2 & 2012-R2.
Here are some examples of events I'm seeing. I can't figure out the root cause(s).
Log Name: Application
Source: Group Policy Files
Date: 2/19/2015 2:35:12 PM
Event ID: 4098
Task Category: (2)
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: H2T8-IOLDP1.HOMENET.local
Description:
The computer 'uptime.exe' preference item in the 'APPS (UpTime) {3BF05605-27C0-43AD-AC0F-873B678EB217}' Group Policy Object did not apply because it failed with error code '0x80090006 Invalid Signature.' This error was suppressed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Group Policy Files" />
<EventID Qualifiers="34305">4098</EventID>
<Level>3</Level>
<Task>2</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-02-19T19:35:12.000000000Z" />
<EventRecordID>1871</EventRecordID>
<Channel>Application</Channel>
<Computer>H2T8-IOLDP1.HOMENET.local</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>computer</Data>
<Data>uptime.exe</Data>
<Data>APPS (UpTime) {3BF05605-27C0-43AD-AC0F-873B678EB217}</Data>
<Data>0x80090006 Invalid Signature.</Data>
</EventData>
</Event>
Log Name: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
Source: Microsoft-Windows-TerminalServices-RemoteConnectionManager
Date: 2/19/2015 9:38:13 AM
Event ID: 20499
Task Category: None
Level: Warning
Keywords:
User: NETWORK SERVICE
Computer: H2T8-IOLDP1.HOMENET.local
Description:
Remote Desktop Services has taken too long to load the user configuration from server \\h2s3-addc1.HOMENET.local for user RSickler
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-TerminalServices-RemoteConnectionManager" Guid="{C76BAA63-AE81-421C-B425-340B4B24157F}" />
<EventID>20499</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2015-02-19T14:38:13.182363700Z" />
<EventRecordID>4</EventRecordID>
<Correlation />
<Execution ProcessID="1932" ThreadID="2156" />
<Channel>Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin</Channel>
<Computer>H2T8-IOLDP1.HOMENET.local</Computer>
<Security UserID="S-1-5-20" />
</System>
<UserData>
<EventXML xmlns="Event_NS">
<ServerName>\\h2s3-addc1.HOMENET.local</ServerName>
<UserName>RSickler</UserName>
</EventXML>
</UserData>
</Event>
Note that these servers are sitting in OUs that are full of other servers that don't have these issues. These GPOs have been in place for years. I suspect there's a deeper issue with AD, GP or a combination thereof. The group policy issues
seem to only affect freshly loaded servers...

Hello,
assure that no firewall is blocking connection for AD required ports as listed in
https://technet.microsoft.com/en-us/library/dd772723(WS.10).aspx
You have error about not connect setup from AD sites and services with the used subnets in your network and linking them to the correct site, please check this in AD sites and services and also have the DCs placed correct to the site they belong to.
"During the past 4.20 hours there have been 83 connections to this Domain Controller from client machines whose IP addresses don't map to any of the existing sites in the enterprise. Those clients, therefore, have undefined sites and may connect to
any Domain Controller including those that are in far distant locations from the clients. A client's site is determined by the mapping of its subnet to one of the existing sites. To move the above clients to one of the sites, please consider creating subnet
object(s) covering the above IP addresses with mapping to one of the existing sites. The names and IP addresses of the clients in question have been logged on this computer in the following log file '%SystemRoot%\debug\netlogon.log' and, potentially,
in the log file '%SystemRoot%\debug\netlogon.bak' created if the former log becomes full. The log(s) may contain additional unrelated debugging information. To filter out the needed information, please search for lines which contain text 'NO_CLIENT_SITE:'.
The first word after this string is the client name and the second word is the client IP address. The maximum size of the log(s) is controlled by the following registry DWORD value 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\LogFileMaxSize';
the default is 20000000 bytes. The current maximum size is 20000000 bytes. To set a different maximum size, create the above registry value and set the desired maximum size in bytes."
This error is about a not run adprep /rodcprep:
Starting test: NCSecDesc
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=ForestDnsZones,DC=HOMENET,DC=local
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
So either run the command on a DC or ignore this error.
Please provide also the following data as file:
ipconfig /all >c:\ipconfig.log [all DCs]
dcdiag /v /c /d /e /s:dcname >c:\dcdiag.log
repadmin /showrepl dc* /verbose /all /intersite >c:\repl.log ["dc* is a place holder for the starting name of the DCs if they all begin the same (if more then one DC exists)]
dnslint /ad /s "DCipaddress" (http://support.microsoft.com/kb/321045)
ADREPLSTATUS:
http://www.microsoft.com/en-us/download/details.aspx?id=30005 can also be exported to file.
As the output will become large, DON'T post them into the thread, please use Windows Sky Drive(with open access!)
https://skydrive.live.com and add the link from it here. Also the /e in dcdiag scans the complete forest, so better run it on COB.
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter:
Info you requested:
ipconfig_dcs.txt
dcdiag.txt
repl.log
dnslint.htm
ADREPLSTATUS: ADReplicationStatus.2015.2.23.9.21.16.csv ADReplicationStatusToolData.zip

GPO preference not applying to map network drive?

Hello,
Server 2008 r2 GPO preference not applying to users to map network drive? When I see errors on client pc, here is the error I found?
Log Name: Application
Source: Group Policy Drive Maps
Date: 1/7/2014 1:47:33 PM
Event ID: 4098
Task Category: (2)
Level: Warning
Keywords: Classic
User: SYSTEM
Description:
The user 'S:' preference item in the 'GPO {C990F58F-E8B2-41BF-B6FD-E1BAC389C4F1}' Group Policy object did not apply because it failed with error code '0x80070037 The specified network resource or device is no longer available.' This error was suppressed.
GPresult shows following message on client pc:
The following settings have applied to this object. Within this category, settings nearest the top of the report are the prevailing settings when resolving conflicts.
Winning GPO Name GPO
Result: Failure (Error Code: 0x80070037)
I also have tried using full server name in the share, IP address but no success. :(
I'm using variable %username% in share location: \\servername\share\%username%
Any idea? Please help. Thanks

Just a control question, can you actually access the users homefolder manually from the client?
Drive maps for GP Preferences is used to map drives only. It cannot create folder on the server and that’s why we see the error “0x80070037 The specified network resource or device is no longer available.”. If you'd like to use share location
with Variable, please ensure that these folders exist on the file server.
Hope this helps you!
Microsoft Certified Trainer
MCSE: Desktop, Server, Private Cloud, Messaging
Blog: http://365lab.net

Group Policy Shortcut Fails to Get Created

I get the following error in the Event Log.
Log Name: Application
Source: Group Policy Shortcuts
Date: 2/28/2014 4:55:55 PM
Event ID: 4098
Task Category: (2)
Level: Warning
Keywords: Classic
User: SYSTEM
Description:
The user 'Receiver' preference item in the 'Startup Items {48A48B27-F3CE-464F-AE8F-E303263707B9}' Group Policy object did not apply because it failed with error code '0x80070002 The system cannot find the file specified.' This error was suppressed.
I was trying to put "C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfService.exe" into the startup folder for members of a specific group. That file exists, it's there, I've put the short cut to it manually into Startup and it works. This
makes no rational sense at all. The file is most certainly there, why doesn't it see the file?
All other shortcuts from GPP work fine. Here are the properties below:
Target type
File system object
Shortcut path
%StartUpDir%\Citrix Receiver
Target path
"C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfService.exe"
Start in
"C:\Program Files (x86)\Citrix\SelfServicePlugin\"
Shortcut key
None
Run
Normal window
Arguments --showAppPicker
Options
Stop processing items on this extension if an error occurs on this item
No
Run in logged-on user's security context (user policy option)
Yes
Remove this item when it is no longer applied
Yes

Hi,
Based on my knowledge, this event is most likely related to permissions. We need to make sure that users can access the shortcut file.
Besides, which startup folder do we use?
As stated in the following thread by Darien, Windows has two Startup folders:
Windows has two Startup folders.
One located in
c:\users\xxxx\appdata\roaming\microsoft\windows\start menu\programs\startup. This one is owned and controlled by the interactive user; therefore, he or she can write to this folder.
The other one is located at
c:\programdata\microsoft\windows\start menu\programs\startup. This folder is a system folder in which interactive users must provided elevated credentials.
Startup Folder
http://social.technet.microsoft.com/Forums/windows/en-US/76520783-6667-4f38-8ab9-cdefab3bd4aa/startup-folder?forum=w7itproui
Hope it helps.
Best regards,
Frank Shen

Group Policy Error on WS 2012 Standard R2

Hi,
Is there anybody experiencing below given error messages ? Its coming to some of the terminal users and is not consistent. At that point of time they cant open mapped drives from the RDWEB session.
There are no known DNS issues, UAC is disabled.
The user 'P:' preference item in the 'Drive Maps Policy {94C23C7F-2EF8-4CA1-B3DF-C0CAF937EDE2}' Group Policy Object did not apply because it failed with error code '0x800704b8 An extended error has occurred.' This error was suppressed.
Log Name: Application
Source: Group Policy Drive maps
Event ID: 4098
Level: Warning
--------ANOTHER ERROR MESSAGE ------------
The user 'X:' preference item in the 'Drive Maps Policy {94C23C7F-2EF8-4CA1-B3DF-C0CAF937EDE2}' Group Policy Object did not apply because it failed with error code '0x80070008 Not enough storage is available to process this command.' This error was suppressed.
Log Name: Application
Source: Group Policy Drive maps
Event ID: 4098
Level: Warning
I can't find any error message related to DNS in event viewer, all records look good to me.

Hi，
As I go through the .xml logs, nothing special was detected.
Would you please let me the file server's hardware configuration and how is the server's performance?
Besides that, could you please ask user to try on another pc and check if the problem still occurs.
Then we may able to narrow down the scope for troubleshooting.
Thanks and regards,
Elaine
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Group Policy Preference Power Plan "Blocked By Group Policy"

I noticed this error in the application event log of a Windows 7 PC:
Log Name: Application
Source: Group Policy Power Options
Date: 3/21/2013 3:19:42 AM
Event ID: 4098
Task Category: (2)
Level: Warning
Keywords: Classic
User: SYSTEM
Computer: xxx
Description:
The computer 'Power Plan (Windows Vista and later)' preference item in the 'Windows 7 Desktop Power Plan {A078F08F-45CC-4209-A264-FE0CB5635A99}' Group Policy object did not apply because it failed with error code '0x800704ec This program is blocked by group
policy. For more information, contact your system administrator.' This error was suppressed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Group Policy Power Options" />
<EventID Qualifiers="34305">4098</EventID>
<Level>3</Level>
<Task>2</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-03-21T10:19:42.000000000Z" />
<EventRecordID>7687</EventRecordID>
<Channel>Application</Channel>
<Computer>xx</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data>computer</Data>
<Data>Power Plan (Windows Vista and later)</Data>
<Data>Windows 7 Desktop Power Plan {A078F08F-45CC-4209-A264-FE0CB5635A99}</Data>
<Data>0x800704ec This program is blocked by group policy. For more information, contact your system administrator.</Data>
</EventData>
</Event>
How can I find out exactly why it is not working? "Blocked by group policy" is not specific enough.

Hi,
You can also enable GPP tracing and logging for more information:
Computer Configuration\Policies\Administrative Templates\System\Group Policy\Configure Power Options preference logging and tracing
http://blogs.technet.com/b/askds/archive/2008/07/18/enabling-group-policy-preferences-debug-logging-using-the-rsat.aspx
Regards,
Cicely
There is no such option "Configure Power Options preference logging and tracing" at Computer
Configuration\Policies\Administrative Templates\System\Group Policy\.
It alphabetical order Always use local ADM files ... is followed by Disallow interactive users from generating ... Not

Printer GPOs fail on some computers but work on others - error code 0x80070034

Hello, I have a couple of GPOs that roll our printers. They have been running smoothly for quite some time, then suddenly started giving our errors on our newer machines. Meaning, the GPOs will work fine on some clients but will not work on others. Also
all other GPOs work fine on all clients. The clients are similar Lenovo Windows 7 64-bit machines.
This is the error: Event ID: 4098, Group Policy Printers. The computer '123.123.123.123' preference item in the 'Deploy printers - {3F6DE6D0-86DC-4D1F-AB99-81BC07F23F3C}' Group Policy object did not apply because it failed with error code '0x80070034 You
were not connected because a duplicate name exists on the network. If joining a domain, go to System in Control Panel to change the computer name and try again. If joining a workgroup, choose another workgroup name.' This error was suppressed.
I turned every stone I could think of on the problematic machines but cannot find out a reason. I disabled anti-virus/firewall, I logged in as domain admin and I tried both user & computer GPOs. No luck. Notice that I can successfully connect manually
to the Printer shares (the ones used to distribute the drivers).
Domain is Win2008 R2. The printers "live" on a Win2012 machine and the drivers come from there. I am using Group Policy Preferences. Ideas are welcome.
Thanks
Christos

Hello and thanks for the suggestion. Yes the drivers are okay, all clients (working and not) run the same Win 7 x64. Let me summarize the situation:
- The GPO runs because the printer IP ports are created
- The Printer Shares (that distribute the drivers) are accessible because the printer is installed without any problems/warnings if I manually double click on them (the shares)
- Security prompts for driver installs are disabled
I also noticed the following. The error says "The computer '123.123.123.123' preference item in the Group Policy object ... etc" The IP mentioned in that error is NOT the computer/client running the GPO but the IP address of the target printer.
So the client thinks the Printer already exists or the IP is already taken (or something of that sort).
Here is the GPresult XML for this
<GPO>
<Name>Printers - deploy - user</Name>
<Path>
<Identifier xmlns="http://www.microsoft.com/GroupPolicy/Types">{5C21
1010-F5E0-445C-99F3-0B8A9D9CB680}</Identifier>
<Domain xmlns="http://www.microsoft.com/GroupPolicy/Types">mydomain.com</Domain>
</Path>
<VersionDirectory>34</VersionDirectory>
<VersionSysvol>34</VersionSysvol>
<Enabled>true</Enabled>
<FilterId>MSFT_SomFilter.ID="{6272C5C1-9C4E-40B7-BD5A-277ED70B337D}",Domain="mydomain.com"</FilterId>
<FilterName>Any Win Desktop OS</FilterName>
<IsValid>true</IsValid>
<FilterAllowed>true</FilterAllowed>
<AccessDenied>false</AccessDenied>
<Link>
<SOMPath>mydomain.com/Configuration/Sites/MainOffice</SOMPath>
<SOMOrder>3</SOMOrder>
<AppliedOrder>1</AppliedOrder>
<LinkOrder>4</LinkOrder>
<Enabled>true</Enabled>
<NoOverride>false</NoOverride>
</Link>
</GPO>

Group Policy Preferences File Copy - Access is Denied on 2003 but not 2008 R2

Hello,
I have created a GPO which copies a file from a network share into a new folder under Program Files. This policy works just fine on a Windows 2008 box, but not on 2003. I've used "psexec -i -s cmd.exe" to verify system account permission to the
share. I am able to successfully browse and copy files from the share as the system account on both boxes.
However, when the GPO attempts to perform the file copy, it does not work, and generates the following error message:
Event Type: Warning
Event Source: Group Policy Files
Event Category: (2)
Event ID: 4098
Date: 8/28/2013
Time: 3:32:12 PM
User: NT AUTHORITY\SYSTEM
Computer: Server01
Description:
The computer 'file.txt' preference item in the 'TXT File Copy {9176122B-1A50-4AB8-91D9-6E8553727E18}' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied.' This error was suppressed.
I am trying to avoid writing a login script, so I am hoping someone will be able to help me figure out why this works fine on Windows 2008 but not Windows 2003. Please note file names and paths are modified here for security reasons, but the principle is
the same.
My GPO is:
Computer Configuration\Preferences\Windows Settings\Files
File (Target Path: c:\Program Files\path\to\file\file.txt)
Source file: \\share\path\to\file\file.txt
Destination File: c:\program files\path\to\file\file.txt
Action: Update
Suppress errors on individual file actions: Disabled
Read-Only: Enabled
Hidden: Disabled
Archive: Enabled
Stop Processing items on this extension if an error occurrs on this item: No
Remove this item when it is no longer applied: No
Apply once and do not reapply: No
Item-level Targeting: None
Thanks

As a user, I am able to browse the share just fine using the alias. It is only when I try to access the share using the system account that I encounter a problem.
experiencing the exact same symptoms. in the tests below, server, client1, and client2 are all are native instances of microsoft windows server.
server: windows server 2008 R2 standard SP1
client1: windows server 2003 standard SP2
client2: windows server 2008 R2 standard SP1
registry setting "DisableLoopbackCheck": unconfigured on server; unconfigured on client1; unconfigured on client2
registry setting "DisableStrictNameChecking": configured as "1" on server; unconfigured on client1; unconfigured on client2
domain user on client1 attempt to access server by name: success
domain user on client1 attempt to access server by alias: success
domain user on client2 attempt to access server by name: success
domain user on client2 attempt to access server by alias: success
local system on client1 attempt to access server by name: success
local system on client1 attempt to access server by alias: failed (system error 5 has occurred. access is denied.)
local system on client2 attempt to access server by name: success
local system on client2 attempt to access server by alias: success
all tests done using "net view \\target", but similar results were seen when using "dir \\target\share" which the domain user and local system account have access to.
the differing behavior between client1 and client 2 suggests that server 2003 requires additional configuration to allow its local system account to access an SMB share by alias.
this problem prevents group policy features (such as software installation) from an aliased file server.

How to use Skydrive in Surface RT, with Windows 8.1 and a local account?

Hi,
I have a Surface 1.0 (RT) with Windows RT 8.1.
I want to use Skydrive but I still want to keep using my local account.
How can I do that?
Thanks in advance,
With the best regards,
dmsousa

Hi Maurice,
Based on your description, can you access the shortcut files from your Surface tablets?
Regarding this error, the following threads can be referred to for more information.
Event ID: 4098 Source: Group Policy Shortcuts
http://www.eventid.net/display-eventid-4098-source-Group%20Policy%20Shortcuts-eventno-11305-phase-1.htm
Event 4098 (Warning)
http://community.spiceworks.com/windows_event/show/1676-group-policy-files-4098
Best regards,
Frank Shen

GPP Shortcuts using Mapped Drive Paths

I have been using Group Policy Preferences to map drives to a network share. I then have a number of shorcuts created to items on that network share using the fixed drive letter.
So for example Shortcut1 points to L:\program\program.exe. Mapped drives were used rather than unc paths for a number of reasons.
This works correctly with XP SP3.
On a Win7 client the shorcuts are not created and event log shows:-
'0x80070002 The system cannot find the file specified.'
I'm guessing the order in which the preferences are applied may of changed in Win7?

I'm having the same issue here. Win 7 SP1 Ent Workstations, Windows Svr 2008 R2 AD And tested successfully ONLY under a domain admin account. It appears the Policy and the GPP Shortcut functionality does work at least in a very specfic
scenario. Anyone still working on this or monitoring this thread? If no, I'll start my own new one.
Policy looks like this:
Action: Update:
Name: C:\Users\Public\Desktop\<Shortcut Name>
Target type: File System Object
Location: <Specify full parth>
Target path: Z:\<Path to desired folder>
Arguments: <Blank>
Start in: Z:\<same path as target>
Shortcut key: None
Run: Normal Window
Commment: <Blank>
Icon file path: Z:\<same path again>\Library.ico
Icon index: 0
Common tab has only "Run in logged-on user's security context (user policy option) checked.
Drive Mappings are done by login script .bat file containing simple Net use commands. And drive is confirmed connected on login. Users have a mix of modify and read\execute only rights to the target folder. The GPO is security filtered to
limited test users, specfically identified here, not by group membership.  Regardless, the two of those accounts are my own, one a standard, and the other my domain admin account which has full control of the folder. The only user
for which this policy implements correctly, is my Domain Admin account.
For all others I have the following in the event viewer:
Log Name:      Application
Source:        Group Policy Shortcuts
Date:          5/14/2012 3:08:26 PM
Event ID:      4098
Task Category: (2)
Level:         Warning
Keywords:      Classic
User:          SYSTEM
Computer:      <Omitted>
Description:
The user '<GPO Policy Name>' preference item in the '<GPO Policy Name> {6ABB0D0E-20BB-4B24-944C-7AD442E75262}' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied.' This error was suppressed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Group Policy Shortcuts" />
    <EventID Qualifiers="34305">4098</EventID>
    <Level>3</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-14T19:08:26.000000000Z" />
    <EventRecordID>465937</EventRecordID>
    <Channel>Application</Channel>
    <Computer><computername></Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data>user</Data>
    <Data>Caspian Compliance Manual</Data>
    <Data>Caspian Compliance Manual {6ABB0D0E-20BB-4B24-944C-7AD442E75262}</Data>
    <Data>0x80070005 Access is denied.</Data>
</EventData>
</Event>
and
Log Name:      Application
Source:        Group Policy Shortcuts
Date:          5/14/2012 3:08:26 PM
Event ID:      4099
Task Category: (2)
Level:         Warning
Keywords:      Classic
User:          SYSTEM
Computer:      <Omitted>
Description:
The client-side extension could not log RSoP data because it failed with error code '0x80041002 Not found'.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Group Policy Shortcuts" />
    <EventID Qualifiers="34305">4099</EventID>
    <Level>3</Level>
    <Task>2</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-05-14T19:08:26.000000000Z" />
    <EventRecordID>465938</EventRecordID>
    <Channel>Application</Channel>
    <Computer><computername></Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data>0x80041002 Not found</Data>
</EventData>
</Event>

Event id : 4098

Similar Messages

Maybe you are looking for