question

ct2326 avatar image
0 Votes"
ct2326 asked DaisyZhou-MSFT answered

Unable to perform a gpupdate, User Policy update failed

Hi,

I have just took over some workstations and just patched them. I am required to perform a gpupdate but the user policy update sometimes fails. When it fails, it does not show any other information.

When I go to the AD GPO, it shows that there is an error in Policies>Windows Settings>Security Settings. The error shows "The Auditing configuration file is not in a valid format. There is invalid data in the file \\XX....\XX\Microsoft\Windows NT\Audit\audit.csv".

May I know what is the next step for me in order to rectify this?

Thank you.

Regards,

Terence

windows-active-directory
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered ct2326 edited

Hello @TerenceChan-0162,

Thank you for posting here.

To better understand your question, would you please confirm the following information at your convenience:

1.Based on the description "I have just took over some workstations and just patched them. I am required to perform a gpupdate but the user policy update sometimes fails. When it fails, it does not show any other information.", would you please run gpupdate /force on one problematic workstation and provide the screenshot with failed result if possible?

2.Based on "When it fails, it does not show any other information.", how did you check the user policy update sometimes fails without showing any other information?

3.Do you mean the user policy update sometimes fails, not always fail, right?

4.Based on the description "it shows that there is an error in Policies>Windows Settings>Security Settings. The error shows "The Auditing configuration file is not in a valid format. There is invalid data in the file \\XX....\XX\Microsoft\Windows NT\Audit\audit.csv".", where did you see the error above?
Did you see the error above on one Domain Controller?
Would you please provide the screenshot with the error message above if possible?


The error message you provide is related to Computer Configuration instead of User Configuration, so user policy update failure may do not matter with error message in AD GPO.

Hope the information above is also helpful.

Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered ct2326 commented

Hello @TerenceChan-0162,

Thank you for your confirmation.

What domain user account did you use to log on this machine?

Please use the same domain user account to log on this machine and export the user GPO policy report when running gpupdate /force failed.

1.Create a new folder in C drive (such as C:\folder).
2.Open CMD (do not run as Administrator).
3.Type gpresult /h C:\folder\gpo.html and click Enter.
4.Check if there is any GPO error message under "User Details".


Tip: The gpo report file may contain private information, please do not upload it on public forums.

Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi Daisy,

There isn't any error in the generate GPO policy report.

Also, is there a possibility of this issue happening if there is no changes made to the user policy?

Thank you.

Regards,
Terence

0 Votes 0 ·
DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered ct2326 edited

Hello @TerenceChan-0162,

Thank you for your reply.

Please use the same domain user account to log on this machine and export the user GPO policy report when running gpupdate /force failed.

1.Create a new folder in C drive (such as C:\folder).
2.Open CMD (do not run as Administrator).
3.Type gpresult /h C:\folder\gpo.html and click Enter.
4.Check if there is any GPO error message under "User Details".

And you can upload it to us if possible (I means if it does not contain private information).

And you can enable GPsvc Logging ​on this machine.

A log file can be written by the service when implementing the following registry value:​
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics]​
"GPSvcDebugLevel"=dword:00030002​
The resulting log file will be %WINDIR%\debug\usermode\gpsvc.log

After enabling GPsvc Logging, please run gpupdate /force on this machine, if the result is failed, and you can check if there is any error message or failure in the log file.

(Tip: The gpsvc log may contain private information, please do not upload it on public forums.)


Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DaisyZhou-MSFT avatar image
0 Votes"
DaisyZhou-MSFT answered

Hello @TerenceChan-0162,

Thank you for your reply.

Q: Just wanted to clarify what I meant was for the "User policy failed" only. Not relating to the audit.csv file.
A: Yes, the user policy failure is not related to audit.csv file in Computer Policy.

Q: Also, would it be possible that the KB5001330 update is a reason for this issue?
A: If other machines also have KB5001330 update and the same user logs on these machines, but there is always no "User policy update failed" when running gpupdate /force command, it may not related to KB5001330 update.

Why you mentioned "would it be possible that the KB5001330 update is a reason for this issue?".

Maybe you need to check it on your related machines with KB5001330 update .



Should you have any question or concern, please feel free to let us know.


Best Regards,
Daisy Zhou

============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.