LocalGPO Corruption - Finding the cause

[Chaniel]

Hi,

 

We're running a mixed Windows environment (7, 8.1, 10 client PCs) and we're often finding with some of the student PCs or tablets that group policy isn't applying correctly. Initially we looked at this in Event Viewer and there is error 1096 with "The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LocalGPO. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure."

 

That's an easy fix (although annoying) and requires deleting %SystemRoot%\Windows\System32\GroupPolicy\Machine\Registry.pol, running gpupdate /force and rebooting. Now this is happening on both Windows 7 and Windows 8.1 and I'm just wondering, why is it happening? How can I find and solve the root cause?

 

We run SCCM in our school and use Endpoint Protection, I've double checked and the registry.pol file is set as an exclusion, one post I've ready said that could be one of the causes...

 

Thanks for any help!

[3s-gtech]

What type of profiles are you using?

[free780]

I've had this issue with Windows 10 and it stops SCCM software updates. Thought it was a post upgrade issue. I did a script to remediate and a configuration item to detect it.

May try procmon and seeing if defender is putting a lock on the file.

[Chaniel]

What type of profiles are you using?

 

Mandatory profiles

 

I've had this issue with Windows 10 and it stops SCCM software updates. Thought it was a post upgrade issue. I did a script to remediate and a configuration item to detect it.

May try procmon and seeing if defender is putting a lock on the file.

 

Hmm.. would be difficult to try that as it happens randomly across OS's (although, I don't think I've seen it on any of our Windows 10 computers yet).

[3s-gtech]

If your mandatory profiles aren't quite right the registry.pol within them may be causing issues on the clients. Worth re-making the profiles for these OSs, not too big a job.

[Arthur]

We run SCCM in our school

You might find the following configuration item useful since it will automatically remediate the affected PCs.

 

ConfigMgr Configuration Item (CI) to Check and Remediate Local Policy Corruption

 

Local Policy file corruption can be a Royal PITA. It can happen for many reasons - most of which are unknown!

 

If it happens - you lose the ability to apply any policies, like Windows Update for instance, so it can be serious.

 

But this handy Configuration Item can fix the issue with no fuss.

 

The detection script looks at the first 4 bytes of each Policy file (Machine and User).

 

If a corrupt file is found, the file is useless and can't be repaired, so it is nuked with extreme prejudice (if remediation is enabled). This causes Windows to re-create the policy file the next time it needs to access it.