Troubleshooting Change and Configuration Management
Troubleshooting Change and Configuration Management |
|
More than 1000 Group Policy objects are stored in a domain, and Group Policy fails. This failure can affect any extension of Group Policy
The API that gathers the list of readable Group Policy objects can only return 1000 Group Policy objects at one time. If a user or computer has Read access to more than 1000 Group Policy objects, Group Policy fails. This failure occurs regardless of whether Apply Group Policy is enabled on the readable Group Policy objects. If both Read and Apply Group Policy are enabled on dozens or hundreds of Group Policy objects, Group Policy processing is very slow.
Note
If you make sure no user or computer has Read access to that many Group Policy objects, the problem does not occur. It is recommended that you always turn off (sometimes explicitly Deny, but in most cases don't Allow) Read access whenever Apply Group Policy is turned off.
This failure disables Group Policy from applying to the intended recipients until it is resolved.
The event log should contain entries similar to the following:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 10/13/1999
Time: 2:17:33 PM
User: JEFFSMITH
Computer: RESKIT1
Description:
Windows cannot search for Group Policy objects with (3).
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 10/13/1999
Time: 2:19:37 PM
User: JEFFSMITH
Computer: RESKIT1
Description:
Windows cannot search for Group Policy objects with (4).
When you observe the
USERENV(ac.2d0) 14:17:33:272 EvaluteDeferredGPOs: Failed to search with error 0x3
USERENV(ac.2d0) 14:17:33:602 GetGPOInfo: EvaluateDeferredGPOs failed. Exiting
USERENV(ac.2d0) 14:17:33:632 ProcessGPOs: GetGPOInfo failed.
USERENV(ac.13c) 14:19:37:143 EvaluteDeferredGPOs: Failed to search with error 0x4
USERENV(ac.13c) 14:19:37:313 GetGPOInfo: EvaluateDeferredGPOs failed. Exiting
USERENV(ac.13c) 14:19:37:343 ProcessGPOs: GetGPOInfo failed.