question

47451047 avatar image
0 Votes"
47451047 asked 47451047 commented

How do I find the name of the GPO policy?

Hi. I have warning in logs:

GroupPolicy ( Microsoft-Windows-GroupPolicy ) 1085

  • <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">;

  • <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" />
    <EventID>1085</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-06-15T12:03:37.754016600Z" />
    <EventRecordID>34148</EventRecordID>
    <Correlation ActivityID="{cd5a87f3-8843-4ddc-9be7-c48712ce8cfc}" />
    <Execution ProcessID="1744" ThreadID="6548" />
    <Channel>System</Channel>
    <Computer>Dattum-rdp-13.resoleasing.com</Computer>
    <Security UserID="S-1-5-18" />
    </System>

  • <EventData>
    <Data Name="SupportInfo1">1</Data>
    <Data Name="SupportInfo2">5079</Data>
    <Data Name="ProcessingMode">0</Data>
    <Data Name="ProcessingTimeInMilliseconds">7656</Data>
    <Data Name="ErrorCode">183</Data>
    <Data Name="ErrorDescription">The file cannot be created because it already exists.</Data>
    <Data Name="DCName">\\DC-01.daomain.local</Data>
    <Data Name="ExtensionName">Group Policy Files</Data>
    <Data Name="ExtensionId">{7150F9BF-48AD-4da4-A49C-29EF4A8369BA}</Data>
    </EventData>
    </Event>


How can I find out what this policy is?


How can I fix this? Do I have to apply the policy once?

windows-server-2019windows-group-policy
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello @47451047,
How are things going on your end? Please keep me posted on this issue.
If you have any further questions or concerns about this question, please let us know.
I appreciate your time and efforts.

Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

0 Votes 0 ·

I couldn't find this policy.

0 Votes 0 ·
DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered

Hello @47451047,

Thank you for your update.

After my further research, here is my finding.

From the original post, we can see:

<Data Name="ErrorCode">183</Data>
<Data Name="ErrorDescription">The file cannot be created because it already exists.


Here is the gpo you want to find.
108720-gpo2.png

It is under "User Configuration".
108811-gpo3.png

Why I said, it is GPO named "RDS_User_NotepadNativeLang", because the gpo setting is used to create a new file with the same name as the existing file name, but the file is already existing, the file with the same name can not be created.

You can edit GPO named "RDS_User_NotepadNativeLang" and navigate to User Configuration\Preference\Windows Setting and find the setting and change the name.

Or you can delete the file on Dattum-rdp-13.resoleasing.com and run gpupdate /force on this machine to reapply the GPO on this machine (logon the machine with user that applid user configuration within GPO "RDS_User_NotepadNativeLang").


Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.



gpo2.png (34.7 KiB)
gpo3.png (2.3 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

LeonLaude avatar image
0 Votes"
LeonLaude answered LeonLaude commented

Hi @47451047,

You have the GUID of the Group Policy in your event log, you can use the Get-GPO PowerShell cmdlet to find which GPO it is.

For example:

 Get-GPO -Guid aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 -Domain "your.domain.com"


If the reply was helpful please don't forget to upvote and/or accept as answer, thank you!


Best regards,
Leon


· 8
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

PS C:\Windows\system32>Get-GPO -Guid aea1b4fa-97d1-45f2-a64c-4d69fffd92c9 -Domain "mydomain.local"

The specified domain does not exist or cannot be connected to. (Exception from HRESULT: 0x8007054B)



PS C:\Windows\system32>Get-GPO -Guid aea1b4fa-97d1-45f2-a64c-4d69fffd92c9

Get-GPO : A GPO with ID {aea1b4fa-97d1-45f2-a64c-4d69fffd92c9} was not found in the mydomain.local domain.

0 Votes 0 ·

You can also find the Group Policy name from Group Policy Management console as well.


1. Open Group Policy Management console (GPMC.msc)
2. Right click on domain name and click on Search, it will open a search box.
3. Select “GUID” from the Dropdown and copy the GP GUID including {}. Click on Add
4. Click on Search to search in Domain. You will see the GP name in search results. Below is one example.

105852-gpo-search.png


0 Votes 0 ·
gpo-search.png (47.2 KiB)

I cant find {cd5a87f3-8843-4ddc-9be7-c48712ce8cfc} or {7150F9BF-48AD-4da4-A49C-29EF4A8369BA} :(

0 Votes 0 ·

It might be an old GPO which may have been deleted/disabled, check a similar thread over here:
https://community.spiceworks.com/topic/2005815-cannot-find-failing-gpo

0 Votes 0 ·

I suppose you also manually checked your Group Policies in the Group Policy Management, unless it actually causes any problems, I would simply ignore it as it cannot be found anywhere.

0 Votes 0 ·

Are you talking about local gpedit? I don't use them. But where does the warning come from ..?

0 Votes 0 ·
Show more comments
DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered 47451047 commented

Hello @47451047,

Thank you for posting here.

Based on the information above, you saw the information on machine named "Dattum-rdp-13.resoleasing.com", is it right?

And {cd5a87f3-8843-4ddc-9be7-c48712ce8cfc} is <Correlation ActivityID> not GPO GUID.

{7150F9BF-48AD-4da4-A49C-29EF4A8369BA} is <Data Name="ExtensionId">not GPO GUID.

We can try to look for 7150F9BF-48AD-4da4-A49C-29EF4A8369BA through gpresult report or running gpupdate /force.

1.On machine Dattum-rdp-13.resoleasing.com:
log on using Domain Administrator account,
open CMD (run as Administrator),
run gpupdate /force to check if both user policy and computer policy updates successfully.

2.On machine Dattum-rdp-13.resoleasing.com:
log on using Domain Administrator account,
open CMD(run as Administrator),
Type gpresult /h C:\gpo.html and click Enter.
Open gpo.html and search the ExtensionId 7150F9BF-48AD-4da4-A49C-29EF4A8369BA to see if you can find it.

And then if you find out 7150F9BF-48AD-4da4-A49C-29EF4A8369BA, maybe we will find the corresponding GPO name and the corresponding GPO GUID.

Here is a similar case for your reference.

Cannot Find Failing GPO
https://community.spiceworks.com/topic/2005815-cannot-find-failing-gpo


If it does not work above, please refer to the following two threads to see if it helps.

Group Policy always gives an error with Event ID 1101 and GUID on it as AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9. How do i get rid of this error please.
https://social.technet.microsoft.com/Forums/office/en-US/925f8a6c-71d7-4e5e-9764-ff264eee165f/group-policy-always-gives-an-error-with-event-id-1101-and-guid-on-it-as?forum=winserverGP

GPO Error 1125 and 7016
https://docs.microsoft.com/en-us/answers/questions/84851/gpo-error-1125-and-7016.html


Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.

Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

· 6
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

I can't find.



I can't seem to find the GUID from this warning. It turns out that this log cannot help to find the source of the problem.

0 Votes 0 ·

Hello @47451047,
1.Can you run gpupdate /force successfully on machine Dattum-rdp-13.resoleasing.com?

2.Can you open gpo.html and search the Extensions Configured named "Group Policy Files"?

For example:
106915-gpo.png


Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

0 Votes 0 ·
gpo.png (8.4 KiB)

Thank you. That sounds about right. It turns out I can not find in the logs what is the policy, only by experimentation ?

0 Votes 0 ·
DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered 47451047 commented

Hello @47451047,

Thank you for your update and accepting my reply as answer.

"ExtensionName">Group Policy Files means it is the configuration Under Preferences.

And I can see there is Preferences Group Policy Files setting under both User Configuration\Preferences and Computer Configuration\Preferences.

Why I think it is the Preferences Group Policy Files setting under User Configuration\Preferences, because from the gpresult file, I can see the Action is Create under User Configuration\Preferences.

Create will create a new file, but if the file with the same name existing, it will report the error message below:

<Data Name="ErrorDescription">The file cannot be created because it already exists.


But from the gpresult file, I can see the Action is Replcae or Update under Computer Configuration\Preferences.

Replace or Update will “replace” the existing file, even if the file name is the same.

108909-rep.png

Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.




rep.png (68.4 KiB)
· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you !

0 Votes 0 ·

Hi. I change Replace to Update. Now the file that exists is not updated.

0 Votes 0 ·