Event ID 1065 — Group Policy Preprocessing (WMI)

  • Article

Applies To: Windows Server 2008

Group Policy processing depends on the Windows Management Instrumetation (WMI) service. During preprocessing, the Group Policy service evaluates WMI filters to determine if a Group Policy object is within scope of the computer or users. Failures with WMI can prevent Group Policy settings from applying as well as cause inaccurate reporting results.

Event Details

Product: Windows Operating System
ID: 1065
Source: Microsoft-Windows-GroupPolicy
Version: 6.0
Symbolic Name: gpEvent_FAILED_FILTER_CHECK
Message: The processing of Group Policy failed. Windows could not evaluate the Windows Management Instrumentation (WMI) filter for the Group Policy object (GPO) %8. This could be caused by RSoP being disabled or Windows Management Instrumentation (WMI) service being disabled or stopped, or other WMI errors. Make sure the WMI service is started and the startup type is set to Automatic. New GPOs or settings will not be processed until this event has been resolved.

Resolve

Correct a failed WMI filter

Group Policy relies on Windows Management Instrumentation (WMI) to evaluate filters that determine if a Group Policy object is applied to a computer or user. Windows cannot apply Group Policy objects to users or computer if it cannot evaluate WMI filters.

Possible resolutions include:

  • Ensure the Windows Management Instrumentation (WMI) service is enabled and configured for automatic startup.
  • Ensure the path, %Systemroot%\System32\Wbem, is included in the PATH system environment variable.
  • Ensure the computer can evaluate WMI queries. To start the Windows Management Instrumentation Tester utility:
    1. Open the Start menu and then click All Programs. Click Accessories and then click Run.
    2. Type wbemtest.exe in the box and then click OK.
    3. Click Connect. In the namespace box type root\cimv2. Click Connect.
    4. Click Query. Type Select * from WIN32_OperatingSystem in the Enter Query box.
    5. Click Apply. A successful query returns one object.
  • Use the WMIDiag utility to diagnose the problem further (https://go.microsoft.com/fwlink/?LinkId=92714).

Verify

Group Policy applies during computer startup and user logon. Afterward, Group Policy applies every 90 to 120 minutes. Events appearing in the event log may not reflect the most current state of Group Policy. Therefore, you should always refresh Group Policy to determine if Group Policy is working correctly.

To refresh Group Policy on a specific computer:

  1. Open the Start menu. Click All Programs and then click Accessories.
  2. Click Command Prompt.
  3. In the command prompt window, type gpupdate and then press ENTER.
  4. When the gpupdate command completes, open the Event Viewer.

Group Policy is working correctly if the last Group Policy event to appear in the System event log has one of the following event IDs:

  • 1500
  • 1501
  • 1502
  • 1503

Group Policy Preprocessing (WMI)

Group Policy Infrastructure