asked on

Windows 2012 R2 Event ID 1085

Windows 2012 R2 Servers Domain Controllers and Member Servers.

I get this event from time to time and on my DC's for that last week everyday.

Log Name: System
Source: Microsoft-Windows-GroupPolicy
Date: 6/14/2020 05:17:19
Event ID: 1085
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: SERV012.network.com
Description:
Windows failed to apply the Group Policy Registry settings. Group Policy Registry settings might have its own log file. Please click on the "More information" link.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
<EventID>1085</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>1</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2020-06-14T09:17:19.347491800Z" />
<EventRecordID>869404</EventRecordID>
<Correlation ActivityID="{28E728A6-1C4F-40AE-AABB-E7A507F65CEF}" />
<Execution ProcessID="860" ThreadID="3580" />
<Channel>System</Channel>
<Computer>SERV012..network.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SupportInfo1">1</Data>
<Data Name="SupportInfo2">4950</Data>
<Data Name="ProcessingMode">0</Data>
<Data Name="ProcessingTimeInMilliseconds">6156</Data>
<Data Name="ErrorCode">183</Data>
<Data Name="ErrorDescription">Cannot create a file when that file already exists. </Data>
<Data Name="DCName">\\TGCS012.our.network.tgcsnet.com</Data>
<Data Name="ExtensionName">Group Policy Registry</Data>
<Data Name="ExtensionId">{B087BE9D-ED37-454f-AF9C-04291E351182}</Data>
</EventData>
</Event>

I have seen this error "Cannot create a file when that file already exists" and in the past the error would indicate which GPO was the problem.

But now I do not event see the GUID of the GPO in the error message.

Does anyone know how I can determine which GPO is causing this error?

Thank you

Tom

Michael Pfister

Enable GPP Debug logging: http://www.virtuallyimpossible.co.uk/enable-group-policy-preference-logging-and-tracing/

zalazar

You could try to run the following command from a Command Prompt (cmd.exe), assuming directory C:\Temp does exist:

gpresult /H C:\Temp\GPResult_20200615.htm

Open in new window

Open file "GPResult_20200615.htm"
and search if you can find the ExtensionId from the eventlog record:

 <Data Name="ExtensionId">{B087BE9D-ED37-454f-AF9C-04291E351182}</Data>

Open in new window

Member_2_6492660_1

ASKER

zalazar,

Ran the command and then did a search of the extensionID and search results NOT FOUND

Still looking to figure out which GPO is causing this error.

Thanks

Tom

Mike,

I turned on debugging waiting for the event to occur again

Thanks
Tom

zalazar

That's a pity. Thanks.
It seems that this {B087BE9D-ED37-454f-AF9C-04291E351182} is a generic GUID for Group Policy Registry.
So it could be that this Event 1085 is just a generic message.
You could try to open a registry editor via "regedit" and search for this GUID: B087BE9D-ED37-454f-AF9C-04291E351182

Hello There

AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9

Windows failed to apply the Group Policy Registry settings. Group Policy Registry settings might have its own log file.

Anything related to this?

Member_2_6492660_1

ASKER

Hello There

I checked my Sysvol policies folder and the GUID of each folder is a group policy and I have none that have that ID

Very strange

Hello There

Run this command in Powershell on a DC and locally on the machine for both GUIDs.

Get-gpo -guid <GUID>

Open in new window

Member_2_6492660_1

ASKER

Hello There

PS C:\util> Get-gpo -guid AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9
Get-gpo : A GPO with ID {aea1b4fa-97d1-45f2-a64c-4d69fffd92c9} was not found in the our.network.tgcsnet.com domain.
Parameter name: gpoId
At line:1 char:1
+ Get-gpo -guid AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Microsoft.Group...s.GetGpoCommand:GetGpoCommand) [Get-GPO], ArgumentExc
   eption
    + FullyQualifiedErrorId : GpoWithIdNotFound,Microsoft.GroupPolicy.Commands.GetGpoCommand

ASKER CERTIFIED SOLUTION

zalazar

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Member_2_6492660_1

ASKER

Ran the script and no results returned

PS C:\util> .\Get-GPEventByCorrelationID.ps1 -CorrelationID "28E728A6-1C4F-40AE-AABB-E7A507F65CEF"
PS C:\util>

zalazar

It could be that the event information is already recycled.
Could you try to look for the latest error in the eventlog and try with this "Correlation ActivityID"
In the event viewer you could also check "Microsoft\Windows\GroupPolicy\Operational"
and then open a processing event, Details, XML View
and lookup the "Correlation ActivityID" and try with this one.

Member_2_6492660_1

ASKER

ok will check it out later tonight