The processing of Group Policy failed

Reecekellyy · May 13, 2025

Hello,

I hope this is an appropriate place for this.

We've recently got a load of new laptops and I am sporadically getting an issue where GPO is not applying. When I login to a laptop, I can tell GPO has not been applied because the desktop icons haven't loaded, which are defined in a GPO. So I run a gpupdate /force and get the following message:

Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows attempted to read the file \\[DOMAINNAME]\SysVol\[DOMAINNAME]\Policies\{ED696DE2-2DA2-4F98-BFB9-851761F2C95C}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

User Policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows attempted to read the file \\[DOMAINNAME]\SysVol\[DOMAINNAME]\Policies\{A5F281DA-B79A-41AF-80E0-48E695A8CC5D}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.

The odd thing is that this doesn't happen all the time, as it will occasionally apply GPO when I login first time. Then other times, I keep trying gpupdate /force and it eventually updates the policy, so I've no idea what is causing the inconsistency. If it was not updating at all, then I could maybe narrow down the issue, but because its sporadic, I have no clue.

This issue only started appearing with these new devices and my introduction of using Intune/Autopilot to enroll devices from out of the box. I have been experimenting with using intune because I like having it install all the required software when it first sets up windows and it auto joins our on site domain.

So our environment is hybrid. We have our onsite active directory which syncs to Microsoft 365 via Entra connect. I also have the Intune Connector for Active Directory running on our domain controller which domain joins the devices as part of the autopilot process.

I've found that this setup is the most streamline way of 'imaging' new devices because once I gather the autopilot details from the new device and import them to intune, it's just a case of installing windows and intune does the rest.

I have no idea if this is an intune issue, or a domain controller issue, or if i'm missing something completely. Apologies if this is really long to read, but I want to ensure I include as much detail as possible.

Hope I've included enough information, any questions please ask and any advice would be appreciated, thanks for reading!

NOTE: In the 15ish minutes it took me to write this post, I have gone back to the same laptop, ran gpupdate again and it's worked.

3s-gtech · May 13, 2025

How many DCs and DFS-R replicas for the sysvol? Is DFS-R replicating correctly?

Is DNS happy?

Koldov · May 13, 2025

Do you have a 'wait for network' GPO?

6Foot2 · May 13, 2025

4 hours ago, 3s-gtech said:

How many DCs ...

As it sometimes works, is it always the same server not applying the policy?

There was a way to find out which server responded to the request, but I can't remember the details.

Koldov · May 14, 2025

In CMD

GPRESULT /R

That will give you a bit more information and tell you where Group Policy was applied from.

Edited May 14, 2025 by Koldov

Reecekellyy · May 14, 2025

18 hours ago, 3s-gtech said:

How many DCs and DFS-R replicas for the sysvol? Is DFS-R replicating correctly?

Is DNS happy?

2 DC's. Replication seems to be okay from what I've checked, my knowledge doesn't span too far in replication so I've just followed some guidance online and it looks like replication is fine. But I suspect it's not, how can I check for sure?

DNS is happy for both DC's.

Reecekellyy · May 14, 2025

13 hours ago, 6Foot2 said:

As it sometimes works, is it always the same server not applying the policy?

There was a way to find out which server responded to the request, but I can't remember the details.

I've just turned on a laptop, GP wasn't applied so I did gpupdate /force and got the error I mentioned in my post. I did gpresult /r and it says policy was applied from DC01. I restarted the laptop, GP still not applied, gpupdate /force and got the same error, did gpresult /r again and this time it was applied from DC02

3s-gtech · May 14, 2025

15 minutes ago, Reecekellyy said:

2 DC's. Replication seems to be okay from what I've checked, my knowledge doesn't span too far in replication so I've just followed some guidance online and it looks like replication is fine. But I suspect it's not, how can I check for sure?

DNS is happy for both DC's.

You can check replication by opening the sysvol on both, dive into the Policies folder, and make a text file on one. Check to see if it appears on the other. Then repeat the other way round.

Reecekellyy · May 14, 2025

4 minutes ago, 3s-gtech said:

You can check replication by opening the sysvol on both, dive into the Policies folder, and make a text file on one. Check to see if it appears on the other. Then repeat the other way round.

Thanks for that! Just done that and it appears replication is working fine. Created a file on DC01 which appeared on DC02, Created a file on DC02 which appeared on DC01.

chazzy2501 · May 14, 2025

system,login,wait...

Reecekellyy · May 14, 2025

2 minutes ago, chazzy2501 said:

system,login,wait...

Thanks for this, we do have this policy already applied.

Reecekellyy · May 14, 2025

19 hours ago, Koldov said:

Do you have a 'wait for network' GPO?

Yeah we do have this GPO

Koldov · May 14, 2025

Are you saying no Group Policies apply or just a specific one? I thought other policies would still apply...

"If one Group Policy setting fails to apply on a client computer, the rest of the settings in that Group Policy (GPO) and potentially other GPOs may still be applied. The client will attempt to reapply the failed setting at the next scheduled refresh, and the other settings are likely to be applied without issue. "

What was the output of GPRESULT /R (or RSOP.msc) does it list other policies applying. Also run GPRESULT /H GPReport.html as indicated in the error text.

The error text specifies one GUID of a policy.

If the issue is just one GPO, have you seen these?

https://learn.microsoft.com/en-us/answers/questions/1184338/hoe-to-fix-the-processing-of-group-policy-failed

https://learn.microsoft.com/en-us/answers/questions/733852/the-processing-of-group-policy-failed-windows-atte

Basically, check this file exists for the policy:

Edit the policy, see if it changes.

Edited May 14, 2025 by Koldov

Koldov · May 14, 2025

Can't remember where I got this, but I occasionally run this on my DCs:

#Query Role Holders

Netdom Query FSMO

#Query Domain

Get-ADDomain

#Query Forest

Get-ADForest

#Make sure that domain controllers are in sync and that replication is ongoing

Repadmin /replsummary

#Make sure that all the dependency services are running

$Services='DNS','DFS Replication','Intersite Messaging','Kerberos Key Distribution Center','NetLogon',’Active Directory Domain Services’
ForEach ($Service in $Services) {Get-Service $Service | Select-Object Name, Status}

#Domain Controller Diagnostic tool (DCDiag)

DCDiag /Test:DNS /e /v

#Detect unsecure LDAP binds

Get-WinEvent -FilterHashtable @{
                LogName = 'Security'
                    ID = 2889
                }

You need to press enter at the last one and it should return an error if it finds no unsecure LDAP binds.

Edited May 14, 2025 by Koldov

machy · May 14, 2025

If you go into GPO And find the policy with the guid of

A5F281DA-B79A-41AF-80E0-48E695A8CC5D (you can find this under "Settings in gpo")

And they try changing something in the policy

I normally get it to try add a junk reg key or temp file when i have had the issue before.

Once GPUpdate is working you can remove what you added

i have had it before where a policy just decides to break, and making it so the user / computer policy version gets bumped sometimes fixes it

Reecekellyy · May 14, 2025

2 hours ago, machy said:

If you go into GPO And find the policy with the guid of

A5F281DA-B79A-41AF-80E0-48E695A8CC5D (you can find this under "Settings in gpo")

And they try changing something in the policy

I normally get it to try add a junk reg key or temp file when i have had the issue before.

Once GPUpdate is working you can remove what you added

i have had it before where a policy just decides to break, and making it so the user / computer policy version gets bumped sometimes fixes it

Thanks, your message made me realise that the error message was literally telling me which policy wasn't being applied. So the policy GUID beginning with A5F2 was a policy related to Google Chrome and the policy GUID beginning with ED69 was a policy with locale settings. I unlinked both policies and restarted the laptop and did gpupdate /force and got 2 different GUIDs that failed to apply. This time, the always wait for network policy & a policy which sets some general taskbar settings. So I unlink those 2 policies, restart the laptop, do another gpupdate /force and now I am getting another GUID which can't apply and this one relates to a default internet browser.

So it seems that when I unlink the 'problem' GPO's, something else becomes a problem. But like I've said, there's loads of devices that have these policies applied with no problems so I don't think the GPOs are the problem.

Reecekellyy · May 14, 2025

3 hours ago, Koldov said:

Can't remember where I got this, but I occasionally run this on my DCs:

#Query Role Holders

Netdom Query FSMO

#Query Domain

Get-ADDomain

#Query Forest

Get-ADForest

#Make sure that domain controllers are in sync and that replication is ongoing

Repadmin /replsummary

#Make sure that all the dependency services are running

$Services='DNS','DFS Replication','Intersite Messaging','Kerberos Key Distribution Center','NetLogon',’Active Directory Domain Services’
ForEach ($Service in $Services) {Get-Service $Service | Select-Object Name, Status}

#Domain Controller Diagnostic tool (DCDiag)

DCDiag /Test:DNS /e /v

#Detect unsecure LDAP binds

Get-WinEvent -FilterHashtable @{
                LogName = 'Security'
                    ID = 2889
                }

You need to press enter at the last one and it should return an error if it finds no unsecure LDAP binds.

Thanks, I've ran these commands and everything looks normal apart from the 'Repadmin /replsummary' which returned:

Source DSA largest delta fails/total %% error
DC01 25m:35s 0 / 5 0
DC02 55d.03h:53m:18s 1 / 5 20 (8606) Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected.

Destination DSA largest delta fails/total %% error
DC01 55d.03h:53m:18s 1 / 5 20 (8606) Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected.
DC02 25m:35s 0 / 5 0

I must be honest, this could be completely normal but my knowledge doesn't stretch this far, I just saw error and assume that's bad.

Koldov · May 14, 2025

~~Can you put the laptop into an empty test OU, then link just one policy and see if it always processes it and then work up from there?~~

~~I get that sometimes they get the GPOs applied and sometimes don't, but is it completely random machines or do the same laptops always have the issue?~~

EDIT: FORGET THE ABOVE...

I don't normally see any errors and I don't think I've ever seen 55 days! There's something sticky going on there I think, they should be fairly similar, like within a minute or so (well mine usually are).

Source DSA largest delta fails/total %% error
DC01 38m:58s 0 / 5 0
DC02 39m:06s 0 / 5 0

Destination DSA largest delta fails/total %% error
DC01 39m:06s 0 / 5 0
DC02 38m:58s 0 / 5 0

Everything else passed OK though?

Edited May 14, 2025 by Koldov

Reecekellyy · May 14, 2025

47 minutes ago, Koldov said:

~~Can you put the laptop into an empty test OU, then link just one policy and see if it always processes it and then work up from there?~~

~~I get that sometimes they get the GPOs applied and sometimes don't, but is it completely random machines or do the same laptops always have the issue?~~

EDIT: FORGET THE ABOVE...

I don't normally see any errors and I don't think I've ever seen 55 days! There's something sticky going on there I think, they should be fairly similar, like within a minute or so (well mine usually are).

Source DSA largest delta fails/total %% error
DC01 38m:58s 0 / 5 0
DC02 39m:06s 0 / 5 0

Destination DSA largest delta fails/total %% error
DC01 39m:06s 0 / 5 0
DC02 38m:58s 0 / 5 0

Everything else passed OK though?

Yeah I thought 55 days was a bit high.

Everything else seems okay (from what I can tell):

I've **'d any identifying information, no idea if that was necessary or not just thought it'd be safe.

C:\WINDOWS\system32> Netdom Query FSMO
Schema master DC01.local
Domain naming master DC01.local
PDC DC01.local
RID pool manager DC01.local
Infrastructure master DC01.local
The command completed successfully.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> Get-ADDomain

AllowedDNSSuffixes : {}
ChildDomains : {}
ComputersContainer : CN=Computers,DC=**,DC=local
DeletedObjectsContainer : CN=Deleted Objects,DC=**,DC=local
DistinguishedName : DC=**,DC=local
DNSRoot : **
DomainControllersContainer : OU=Domain Controllers,DC=**,DC=local
DomainMode : Windows2012R2Domain
DomainSID : S-1-5-21-2670031880-**
ForeignSecurityPrincipalsContainer : CN=ForeignSecurityPrincipals,DC=**,DC=local
Forest : **
InfrastructureMaster : DC01.local
LastLogonReplicationInterval :
LinkedGroupPolicyObjects : {cn={1184592F-CAFD-4B39-9793-FAF35FFAC059},cn=policies,cn=system,DC=CHS,DC=local,
cn={D7862049-B621-4BE7-A475-09E1F72BFA16},cn=policies,cn=system,DC=CHS,DC=local,
cn={61BAB1FD-8C01-4D7B-B1C3-C5F28688E552},cn=policies,cn=system,DC=CHS,DC=local, c
n={AE0AD057-A353-4738-846F-EFE53471919B},cn=policies,cn=system,DC=CHS,DC=local...}
LostAndFoundContainer : CN=LostAndFound,DC=**,DC=local
ManagedBy :
Name : **
NetBIOSName : **
ObjectClass : domainDNS
ObjectGUID : abffd92a-7a97-421e-b720-**
ParentDomain :
PDCEmulator : DC01.local
PublicKeyRequiredPasswordRolling :
QuotasContainer : CN=NTDS Quotas,DC=**,DC=local
ReadOnlyReplicaDirectoryServers : {}
ReplicaDirectoryServers : {DC02.local, DC01.local}
RIDMaster : DC01.local
SubordinateReferences : {DC=DomainDnsZones,DC=**,DC=local, DC=ForestDnsZones,DC=**,DC=local,
CN=Configuration,DC=**,DC=local}
SystemsContainer : CN=System,DC=**,DC=local
UsersContainer : CN=Users,DC=**,DC=local

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> Get-ADForest

ApplicationPartitions : {DC=DomainDnsZones,DC=**,DC=local, DC=ForestDnsZones,DC=**,DC=local}
CrossForestReferences : {}
DomainNamingMaster : DC01.local
Domains : {**.local}
ForestMode : Windows2012Forest
GlobalCatalogs : {DC02.local, DC01.local}
Name : **.local
PartitionsContainer : CN=Partitions,CN=Configuration,DC=**,DC=local
RootDomain : **.local
SchemaMaster : DC01.local
Sites : {**}
SPNSuffixes : {}
UPNSuffixes : {**}

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> $Services='DNS','DFS Replication','Intersite Messaging','Kerberos Key Distribution Center','NetLogon','Active Directory Domain Services'
>> ForEach ($Service in $Services) {Get-Service $Service | Select-Object Name, Status}

Name Status
---- ------
DNS Running
DFSR Running
IsmServ Running
Kdc Running
Netlogon Running
NTDS Running

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> DCDiag /Test:DNS /e /v

Summary of DNS test results:

Auth Basc Forw Del Dyn RReg Ext
_________________________________________________________________
Domain: **.local
DC02 PASS PASS PASS PASS PASS PASS n/a
DC01 PASS PASS PASS PASS PASS PASS n/a

......................... **.local passed test DNS

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> Get-WinEvent -FilterHashtable @{
>> LogName = 'Security'
>> ID = 2889
>> }
Get-WinEvent : No events were found that match the specified selection criteria.

Edited May 14, 2025 by Reecekellyy

psydii · May 14, 2025

Some avenues to dig into / fix that error here: Troubleshoot replication error 8606 - Windows Server | Microsoft Learn

Some of the more concerning causes are reverting a dc snapshot or introducing an improperly restored one from backup? (it can take months before that comes back to bite you)

and this one caused by a *default* setting in Windows Server:

Secure Time Seeding Recommendations for Windows Server - Windows Server | Microsoft Learn

Koldov · May 14, 2025

Did you run that code on both DCs?

I have trouble remembering yesterday, but did anything happen 55 days ago that might have changed the replication?

Also, didn't really see anything in that output, only the Domain/Forest level of 2012R2. What Server OS are you running?

*I cannot condone/advise you do any of the following*

A couple of internet search results seem to suggest running full DCDIAG:

dcdiag /c /v

This will be large as it is all tests and verbose output.

It showed there was a machine that was identified. The solution in one was to edit the registry to change the Strict Replication Consistency key to enable loose replication consistency. Obviously that comes with the usual warnings and doesn't actually fix the problem...

https://community.spiceworks.com/t/error-8606-ad-replication/768737/14#:~:text=Jul 2020-,Okay%2C I’m not sure if I fixed the problem or just temporarily got rid of it and it will appear again. After running,-the command dcdiag

This is from the same link as the above post from @psydii I believe, as it's MS it's a tough read and way over my head, but talks more about loose replication and it's issues... tombstone life and using LoL (Lingering Object Liquidator).

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/replication-error-8606#:~:text=If the destination domain controller was configured to use loose replication consistency%2C the object would have been "reanimated" on the destination domain controller's copy of the directory

As does this article:

https://techcommunity.microsoft.com/discussions/microsoft-entra/resolution-of-active-directory-replication-error-8606-1988/2754291#:~:text=intentionally deleted. Resolution-,Resolution,-For our need

And this:

https://akhpark.wordpress.com/2014/07/03/active-directory-server-wont-replicate-if-one-of-the-server-was-offline-for-a-long-time/

Again, a warning of using any of this without proper research and understanding (and good backups).

Edited May 14, 2025 by Koldov

machy · May 14, 2025

55 Days could (ish) have been feb half term?

some sort of update?

Reecekellyy · May 14, 2025

We've recently consolidated our servers and got all the main virtual machines onto 1 host. DC02 was migrated to the new host 103 days ago and DC01 was migrated (drumroll please...) 55 days ago. So clearly this is part of the issue.

I am fairly inexperienced with servers and networks in general so we hire a consultant to do all the server heavy lifting. He dealt with getting things moved over to the new host. I did raise this problem with him but he couldn't work out what the issue was. We're planning on rebuilding the entire domain during the summer holidays, which will be great for me to learn what goes into it. I inherited this domain which was created 15+ yrs ago so I'm trying to get my head around all the intricacies. I guess I was just hoping I'd get this problem resolved before we rebuild the domain since we're due to get a load more new devices before the rebuild in the summer.

I'll show him what I've found from you very helpful folk on here and see if he can piece it together.

psydii · May 14, 2025

Given the info relating to your migration 55 days ago, you might well have a USN rollback. Take a look at this article

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/detect-and-recover-from-usn-rollback

Are you really standing up a new forest in 2025 when the cloud is just there **waves arms in the direction of 365** ? If so, you might be able to limp along until the summer rebuild without addressing it.

If, on the other hand, your plan was in fact to just start again with the OU/GPOs but keep the computer and user accounts, you will need to fix this problem; I’d be looking to open a £300 support ticket with Microsoft to troubleshoot the issue before changing anyhing, some of the steps in these articles are one-way changes that cannot be undone, and having a product expert on the phone is invaluable for learning and managing stress and providing assurance upwards for senior management.

Edited May 14, 2025 by psydii

Reecekellyy · May 15, 2025

15 hours ago, psydii said:

Given the info relating to your migration 55 days ago, you might well have a USN rollback. Take a look at this article

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/detect-and-recover-from-usn-rollback

Are you really standing up a new forest in 2025 when the cloud is just there **waves arms in the direction of 365** ? If so, you might be able to limp along until the summer rebuild without addressing it.

If, on the other hand, your plan was in fact to just start again with the OU/GPOs but keep the computer and user accounts, you will need to fix this problem; I’d be looking to open a £300 support ticket with Microsoft to troubleshoot the issue before changing anyhing, some of the steps in these articles are one-way changes that cannot be undone, and having a product expert on the phone is invaluable for learning and managing stress and providing assurance upwards for senior management.

Thanks for this info. I do really want to go full cloud, I'll do my research and find out the best way to proceed!

The processing of Group Policy failed

Recommended Posts

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

Popular Now