[23h2] Work out what this policy is?

[kennysarmy]

This seems to stay on the screen for a while when my Windows laptops boot.

 

 

Is there anyway to find out what this is?

 

Nothing in SYSVOL\curriculum.local\Policies seems to relate to the name :/

[kennysarmy]

Running ‘gpresult /R / SCOPE COMPUTER’ does not show anything untoward...

[Olliedawg]

This seems to stay on the screen for a while when my Windows laptops boot.

 

[ATTACH=CONFIG]71996[/ATTACH]

 

Is there anyway to find out what this is?

 

Nothing in SYSVOL\curriculum.local\Policies seems to relate to the name :/

 

Have you checked this folder on all DC's? Would rule out a replication issue

[Steve21]

It's something linked to Device Guard by the looks of it (Linked to virtualisation requirements, have you enabled/disabled it on a VM or anything?)

 

Steve

[kennysarmy]

It's something linked to Device Guard by the looks of it (Linked to virtualisation requirements, have you enabled/disabled it on a VM or anything?)

 

Steve

 

Thanks.

 

Will dig a bit deeper...

[MrDsIT]

I typed this "what policy is {F312195E-3D9D-447A-A3FS-08DFFA24735E}" into Google to see what generative AI would give me.

..it is a GPO error message that can appear when applying settings for virtualization-based security. This error could mean secure boot is not enabled - which could be due to a number of reasons including:

Virtualisation- based security is not enabled

Platform security level is not set to secure boot

The platform security level is not configured to Secure Boot or Secure Boot with DMA Protection

 

With a useful link to EventSentry

Hope that contributes..

 

Howard

[3s-gtech]

Can you find a folder in your sysvol with that name? You can open the files inside and it’ll tell you the name of the GPO that links to it.

[dapaulio]

In powershell. Run as admin

 

Type get-gpo (Sid)

This will give you the friendly name of the group policy then run a group policy wizard on the workstation it is hanging on and it look at the results pane for any errors

Edited August 4, 2024 by dapaulio

[kennysarmy]

In powershell. Run as admin

 

Type get-gpo (Sid)

This will give you the friendly name of the group policy then run a group policy wizard on the workstation it is hanging on and it look at the results pane for any errors

 

PS C:\windows\system32> get-gpo -Guid F312195E-3D9D-447A-A3F5-08DFFA24735E

get-gpo : A GPO with ID {f312195e-3d9d-447a-a3f5-08dffa24735e} was not found in the curriculum.local domain.

Parameter name: gpoId

At line:1 char:1

+ get-gpo -Guid F312195E-3D9D-447A-A3F5-08DFFA24735E

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo : ObjectNotFound: (Microsoft.Group...s.GetGpoCommand:GetGpoCommand) [Get-GPO], ArgumentExc

eption

+ FullyQualifiedErrorId : GpoWithIdNotFound,Microsoft.GroupPolicy.Commands.GetGpoCommand

 

PS C:\windows\system32>

 

 

If I search for other known GPO's I get a good result back, eg.

 

PS C:\windows\system32> get-gpo -Guid FB62F727-D3B2-499C-974F-C096B7F86A82

 

 

DisplayName : C - AllowPrinterSpoolertoRestart

DomainName : curriculum.local

Owner : CURRICULUM\Domain Admins

Id : fb62f727-d3b2-499c-974f-c096b7f86a82

GpoStatus : UserSettingsDisabled

Description :

CreationTime : 10/05/2016 12:19:49

ModificationTime : 22/01/2020 12:25:25

UserVersion : AD Version: 0, SysVol Version: 0

ComputerVersion : AD Version: 1, SysVol Version: 1

WmiFilter :

[Steve21]

It's not a GPO guid, despite it's looks. It's a sub-setting linked to the Device Guard settings mentioned earlier.

 

Did you check if you've set it on any VMs etc or have anything clashing like disabling virutalisation?

 

Steve

[DavR]

Evening folks, I came on here tonight to ask the question about the exact same message at startup! I'm seeing it on all my Windows 11 devices.

 

From what I've learnt so far, the GUID {F312195E-3D9D-447A-A3FS-08DFFA24735E} doesn't link to any policy. It relates back to a Device Guard reference, as others have said.

 

I started seeing this behaviour on startup today, after I played with the policy setting Computer | Policies | Admin Templates | System | Device Guard > "Turn on Virtualisation Based Security". I was trying to get the Memory Integrity setting to turn ON for all devices and clear the nag in Windows Security, but it wasn't behaving, so I removed that setting in the end.

 

Now, I have the "applying {F312195E-3D9D-447A-A3FS-08DFFA24735E}" message on my devices at startup, including devices that weren't even on when I was testing that policy. Have I permanently added some junk to my Group Policies? Is it something I can get rid of?

 

Thinking about it, I also updated my admx files today, so it's possible that doing that has introduced this applying {F312195E-3D9D-447A-A3FS-08DFFA24735E} "feature" in policy. I suppose I could revert my Policy Definitions folder back to one from backup, see if that makes a difference.

 

Any ideas?

[DavR]

Update - reverting Policy Definitions to before today's update hasn't fixed the issue, so it seems unlikely that updating the ADMX with latest caused it.

 

I suppose I could revert my entire SYSVOL Policies folder back to one from backup, but that feels a bit excessive....