Category Archives: GPO

GPO – Event ID 1058, Group Policy gpt.ini–Solved

"The Processing of Group Policy failed. Windows attempted to read the file \\domain\sysvol\domain\policies\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\gpt.ini from a domain controller and was not successful."

 

Under \\domain\sysvol\domain\policies\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}  – there was no ini file  so I realized that GPO is probably corrupted

In order to determine which group policy is causing this problem .I used PowerShell  to find the friendly name of that specific GPO:

Get-GPO -id 9189e970-5663-4866-92a0-0eb2a22aab0b |select DisplayName

image

After recreating the gpo everything worked fine.

 

More information about  Group Policy Cmdlets in Windows PowerShell:

https://technet.microsoft.com/en-us/library/ee461027.aspx

GPO – Deny single user/Group

1. First you need to find the GPO Guid

To Find the group Guide Connect to a dc server and open Active Directory PowerShell

get-gpo -all |select-object DisplayName,id |sort name >c:\gpo.txt

image

 

2. Find in Active directory the GPO with ldap search

That guid is an attribute on an object in Active Directory, so you can query for it:

(&(objectCategory=groupPolicyContainer)(name={D45A4D0F-77BE-4116-9F5B-CF96E81D2DDC}))

image

3.Right Click On the Guid – Properties -security

4.Advanced

5.Add the user/group

6.Deny on – Apply Group Policy

clip_image001

clip_image002

Error : 1058 Group Policy

The processing of Group Policy failed. Windows attempted to read the file \\domain.local\sysvol\ac.idc\Policies\{2EDE7444-0440-4F4E-BDF7-AD38380F3897}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

a) Name Resolution/Network Connectivity to the current domain controller.

b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).

c) The Distributed File System (DFS) client has been disabled

clip_image001

In My case, the User Policy can’t apply because the user account has too many groups, which cause a too large Kerberos token size.

Solution :

You can resolve this issue by installing the hotfix and then:

1. Start Registry Editor (Regedt32.exe).

2. Locate and click the following key in the registry:
System\CurrentControlSet\Control\Lsa\Kerberos\Parameters

3. If this key is not present, create the key. To do so:

4. Click the following key in the registry:
System\CurrentControlSet\Control\Lsa\Kerberos

5. On the Edit menu, click Add Key.

6. Create a Parameters key.

7 .Click the new Parameters key.

8. On the Edit menu, click Add Value, and then add the following registry value:
Value name: MaxTokenSize
Data type: REG_DWORD
Radix: Decimal
Value data: 65535

clip_image001[4]

Or You can just remove some groups where the user belong in the old / new domain

Good luck 🙂