programming4us
programming4us
DESKTOP

Windows Server 2008 and Windows Vista : Using Event Logging for Troubleshooting (part 4) - Summary of Group Policy Event IDs

- How To Install Windows Server 2012 On VirtualBox
- How To Bypass Torrent Connection Blocking By Your ISP
- How To Install Actual Facebook App On Kindle Fire

3. Summary of Group Policy Event IDs

Each event recorded with the GroupPolicy source name can be categorized into one of many ranges of related events. These ranges help you determine start, end, success, failure, and so on for each event. Table 5 summarizes each event ID range.

Table 5. Group Policy Event ID Ranges

Event ID Range

Description

4000–4007

Group Policy start events: These informational events appear in the event log when an instance of Group Policy processing begins.

4016–4299

Component start events: These informational events appear in the event log when a component of Group Policy processing begins the task described in the event.

5000–5299

Component success events: These informational events appear in the event log when a component of Group Policy processing successfully completes the task described in the event.

5300–5999

Informative events: These informational events appear in the event log during the entire instance of Group Policy processing and provide additional information about the current instance.

6000–6007

Group Policy warning events: These warning events appear in the event log when an instance of Group Policy processing completes with errors.

6017–6299

Component warning events: These warning events appear in the event log when a component of Group Policy processing completes the task described in the event with errors.

6300–6999

Informative warning events: These warning events appear in the event log to provide additional information about possible error conditions with the action described in the event.

7000–7007

Group Policy error events: These error events appear in the event log when the instance of Group Policy processing does not complete.

7017–7299

Component error events: These error events appear in the event log when a component of Group Policy processing does not complete the task described in the event.

7300–7999

Informative error events: These error events appear in the event log to provide additional information about the error condition with the action described in the event.

8000–8007

Group Policy success events: These informational events appear in the event log when the instance of Group Policy completes successfully.

Tip


Most of the events related to the GroupPolicy source appear in pairs. Group Policy processing includes a start event and an end event. The Event IDs within the 4000 range are all start events. These events are followed by events that fall in the other ranges, which are all ending events: error, fail, information, or success. Pairing the events will help you identify problems more quickly when using the Event Viewer and logs.

Table 6 summarizes all event IDs that occur in the System log for Group Policy.

Table 6. System Log Event IDs for Group Policy Events

Event ID

Event Type

Explanation

1002

Error

Failed Allocation: The Group Policy service logs this event when an attempt to allocate memory fails.

1006

Error

DS Bind Failure: The Group Policy service logs this event when an attempt to authenticate to Active Directory fails.

1007

Error

Site Query Failure: The Group Policy service logs this event when, using the credentials of the user or computer, an attempt to query the Active Directory Site fails.

1030

Error

GPO Query Failure: The Group Policy service logs this event when an attempt to query a Group Policy objects fails.

1052

Error

Computer Role Failure: The Group Policy service logs this event when an attempt to determine the role of the computer (workgroup, domain member, or domain controller) fails.

1053

Error

Username Resolution Failure: The Group Policy service logs this event when an attempt to resolve a user name fails.

1054

Error

DC Resolution Failure: The Group Policy service logs this event when an attempt to obtain the name of a domain controller fails.

1055

Error

Computer Name Resolution Failure: The Group Policy service logs this event when an attempt to resolve a computer name fails.

1058

Error

Policy Read Failure: The Group Policy service logs this event when an attempt to read the GPT.ini file of a Group Policy object fails.

1065

Error

WMI Evaluation Failure: The Group Policy service logs this event when an attempt to evaluate a WMI filter fails.

1079

Error

GPO Search Failure: The Group Policy service logs this event when an attempt to obtain a list of Group Policy objects fails.

1080

Error

OU Search Failure: The Group Policy service logs this event when an attempt to search the Active Directory Organizational Unit hierarchy fails.

1085

Warning

CSE Failure Warning: The Group Policy service logs this event when a Group Policy CSE fails.

1088

Error

Excessive GPO Failure: The Group Policy service logs this event when the scope of Group Policy objects for a computer or user exceeds 999.

1089

Warning

RSOP Session Failure: The Group Policy service logs this event when an RSoP session fails.

1090

Warning

WMI Failure: The Group Policy service logs this event when it encounters errors with the WMI service.

1091

Warning

RSOP CSE Failure: The Group Policy service logs this event when a Group Policy CSE fails to record RSoP information.

1095

Warning

RSOP Failure: The Group Policy service logs this event when an error occurs while recording RSoP information.

1096

Error

Registry.pol Failure: The Group Policy service logs this event when an attempt to read the registry.pol file fails.

1097

Error

Computer Token Failure: The Group Policy service logs this event when an attempt to read the computer’s authentication token fails.

1101

Error

Object Not Found Failure: The Group Policy service logs this event when an attempt to locate an Active Directory object fails.

1104

Warning

WMI Filter Not Found Warning: The Group Policy service logs this event when an attempt to locate an associated WMI filter fails.

1109

Warning

Cross Forest GP Disabled Warning: The Group Policy service logs this event when an attempt is disabled to process Group Policy across a forest.

1110

Error

Cross Forest Discovery Failure: The Group Policy service logs this event when an attempt fails to determine whether the user and computer belong to the same forest.

1112

Warning

CSE Synchronous Warning: The Group Policy service logs this event when a Group Policy CSE requires synchronous policy processing to apply one or more policy settings.

1126

Error

Time Skew Failure: The Group Policy service logs this event when the time on the local computer is not synchronized with the time on the domain controller.

1128

Warning

CSE Disabled Warning: The Group Policy service logs this event when it disables a Group Policy CSE to prevent unexpected termination of the Group Policy service.

1129

Error

DC Connectivity Failure: The Group Policy service logs this event when there is an absence of authenticated connectivity from the computer to the domain controller.

1130

Error

Script Failure: The Group Policy service logs this event when an attempt fails to run a script.

1500

Informational

Computer Policy Processing: The Group Policy service logs this event when an instance of computer Group Policy processing completes without encountering new policy settings.

1501

Informational

User Policy Processing: The Group Policy service logs this event when an instance of user Group Policy processing completes without encountering new policy settings.

1502

Informational

Computer Policy Processing: The Group Policy service logs this event when an instance of computer Group Policy processing completes with new or changed policy settings.

1503

Informational

User Policy Processing: The Group Policy service logs this event when an instance of user Group Policy processing completes with new or changed policy settings.

Table 7 summarizes all Event IDs that occur in the Group Policy operational log.

Table 7. Group Policy Operational Log Event IDs

Computer Start and End Events

Event ID

Event Type

Explanation

4000

Informational

The Group Policy service logs this event when an instance of computer Group Policy processing begins.

6000

Warning

The Group Policy service logs this event when an instance of computer Group Policy processing completes with one or more errors.

7000

Error

The Group Policy service logs this event when an instance of computer Group Policy processing fails to complete.

8000

Success

The Group Policy service logs this event when an instance of computer Group Policy processing completes successfully.

User Log-on Start and End Events

Event ID

Event Type

Explanation

4001

Informational

The Group Policy service logs this event when an instance of user Group Policy processing begins.

6001

Warning

The Group Policy service logs this event when an instance of user Group Policy processing completes with one or more errors.

7001

Error

The Group Policy service logs this event when an instance of user Group Policy processing fails to complete.

8001

Success

The Group Policy service logs this event when an instance of user Group Policy processing completes successfully.

Computer Network Change Start and End Events

Event ID

Event Type

Explanation

4002

Informational

The Group Policy service logs this event when a network change triggers the start of an instance of computer Group Policy processing.

6002

Warning

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a network change, completes with one or more errors.

7002

Error

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a network change, fails to complete.

8002

Success

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a network change, completes successfully.

User Network Change Start and End Events

Event ID

Event Type

Explanation

4003

Informational

The Group Policy service logs this event when a network change triggers the start of an instance of user Group Policy processing.

6003

Warning

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a network change, completes with one or more errors.

7003

Error

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a network change, fails to complete.

8003

Success

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a network change, completes successfully.

Computer Manual Refresh Start and End Events

Event ID

Event Type

Explanation

4004

Informational

The Group Policy service logs this event when a manual refresh triggers the start of an instance of computer Group Policy processing.

6004

Warning

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a manual refresh, completes with one or more errors.

7004

Error

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a manual refresh, fails to complete.

8004

Success

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a manual refresh, completes successfully.

User Manual Refresh Start and End Events

Event ID

Event Type

Explanation

4005

Informational

The Group Policy service logs this event when a manual refresh triggers the start of an instance of user Group Policy processing.

6005

Warning

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a manual refresh, completes with one or more errors.

7005

Error

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a manual refresh, fails to complete.

8005

Success

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a manual refresh, completes successfully.

Computer Periodic Refresh Start and End Events

Event ID

Event Type

Explanation

4006

Informational

The Group Policy service logs this event when a periodic refresh triggers the start of an instance of computer Group Policy processing.

6006

Warning

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a periodic refresh, completes with one or more errors.

7006

Error

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a periodic refresh, fails to complete.

8006

Success

The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a periodic refresh, completes successfully.

User Periodic Refresh Start and End Events

Event ID

Event Type

Explanation

4007

Informational

The Group Policy service logs this event when a periodic refresh triggers the start of an instance of user Group Policy processing.

6007

Warning

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a periodic refresh, completes with one or more errors.

7007

Error

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a periodic refresh, fails to complete.

8007

Success

The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a periodic refresh, completes successfully.

Client-Side Extension Processing

Event ID

Event Type

Explanation

4016

Informational

The Group Policy service logs this event each time a Group Policy CSE begins processing.

5016

Success

The Group Policy service logs this event when a Group Policy CSE completes its processing successfully.

6016

Warning

The Group Policy service logs this event when a Group Policy CSE completes its processing while encountering one or more errors.

7016

Error

The Group Policy service logs this event when a Group Policy CSE fails to complete its processing.

Trace Events

Event ID

Event Type

Explanation

4017

Informational

The Group Policy service logs this event to mark the beginning of the service making a system call.

5017

Success

The Group Policy service logs this event when a system call completes successfully.

6017

Warning

The Group Policy service logs this event when a system call completes while encountering one or more errors.

7017

Error

The Group Policy service logs this event when a system call fails to complete.

Scripts Processing

Event ID

Event Type

Explanation

4018

Informational

The Group Policy service logs this event when it begins to process Group Policy scripts.

5018

Success

The Group Policy service logs this event when Group Policy scripts processing completes successfully.

6018

Warning

The Group Policy service logs this event when Group Policy scripts processing completes while encountering one or more errors.

7018

Error

The Group Policy service logs this event when Group Policy scripts processing fails to complete.

Individual Script Processing

Event ID

Event Type

Explanation

4019

Informational

The Group Policy service logs this event when it begins to process an individual script during the processing of Group Policy scripts.

5019

Success

The Group Policy service logs this event when an individual script, during Group Policy script processing, completes successfully.

6019

Warning

The Group Policy service logs this event when an individual script, during Group Policy script processing, completes while encountering one or more errors.

7019

Error

The Group Policy service logs this event when an individual script, during Group Policy script processing, fails to complete.

Domain Controller Discovery

Event ID

Event Type

Explanation

4326

Informational

The Group Policy service logs this event when it begins to discover an Active Directory domain controller.

5326

Success

The Group Policy service logs this event when the discovery of an Active Directory domain controller completes successfully.

6326

Warning

The Group Policy service logs this event when the discovery of an Active Directory domain controller completes while encountering one or more errors.

7326

Error

The Group Policy service logs this event when the discovery of an Active Directory domain controller fails to complete.

Domain Controller Information

Event ID

Event Type

Explanation

5308

Success

The Group Policy service logs this event when an attempt to display information about a discovered domain controller completes successfully.

6308

Warning

The Group Policy service logs this event when an attempt to display information about a discovered domain controller completes while encountering one or more errors.

7308

Error

The Group Policy service logs this event when an attempt to display information about a discovered domain controller fails to complete.

Computer Information

Event ID

Event Type

Explanation

5309

Success

The Group Policy service logs this event when an attempt to display information about a computer completes successfully.

6309

Warning

The Group Policy service logs this event when an attempt to display information about a computer completes while encountering one or more errors.

7309

Error

The Group Policy service logs this event when an attempt to display information about a computer fails to complete.

Security Principal Information

Event ID

Event Type

Explanation

5310

Success

The Group Policy service logs this event when an attempt to display security principal information about a user completes successfully.

6310

Warning

The Group Policy service logs this event when an attempt to display security principal information about a user completes while encountering one or more errors.

7310

Error

The Group Policy service logs this event when an attempt to display security principal information about a user fails to complete.

Loopback Processing Mode

Event ID

Event Type

Explanation

5311

Success

The Group Policy service logs this event when an attempt to display information about loopback processing mode completes successfully.

6311

Warning

The Group Policy service logs this event when an attempt to display information about loopback processing mode completes while encountering one or more errors.

7311

Error

The Group Policy service logs this event when an attempt to display information about loopback processing mode fails to complete.

Applied GPO List

Event ID

Event Type

Explanation

5312

Success

The Group Policy service logs this event when an attempt to display a list of applied Group Policy objects completes successfully.

6312

Warning

The Group Policy service logs this event when an attempt to display a list of applied Group Policy objects completes while encountering one or more errors.

7312

Error

The Group Policy service logs this event when an attempt to display a list of applied Group Policy objects fails to complete.

Filtered GPO List

Event ID

Event Type

Explanation

5313

Success

The Group Policy service logs this event when an attempt to display a list of filtered Group Policy objects completes successfully.

6313

Warning

The Group Policy service logs this event when an attempt to display a list of filtered Group Policy objects completes while encountering one or more errors.

7313

Error

The Group Policy service logs this event when an attempt to display a list of filtered Group Policy objects fails to complete.

Network Information

Event ID

Event Type

Explanation

5314

Success

The Group Policy service logs this event when an attempt to display network information completes successfully.

6314

Warning

The Group Policy service logs this event when an attempt to display network information completes while encountering one or more errors.

7314

Error

The Group Policy service logs this event when an attempt to display network information fails to complete.

Next Policy Processing Information

Event ID

Event Type

Explanation

5315

Success

The Group Policy service logs this event when an attempt to display information about the next instance of Group Policy processing completes successfully.

6315

Warning

The Group Policy service logs this event when an attempt to display information about the next instance of Group Policy processing completes while encountering one or more errors.

7315

Error

The Group Policy service logs this event when an attempt to display information about the next instance of Group Policy processing fails to complete.

Successful or Informational Interaction

Event ID

Event Type

Explanation

5320

Success

The Group Policy service logs this event to display successful information about the current instance of Group Policy processing.

6320

Warning

The Group Policy service logs this event to display warning information about the current instance of Group Policy processing.

7320

Error

The Group Policy service logs this event to display failure information about the current instance of Group Policy processing.

5321

Success

The Group Policy service logs this event to display successful information about the current instance of Group Policy processing.

6321

Warning

The Group Policy service logs this event to display warning information about the current instance of Group Policy processing.

7321

Error

The Group Policy service logs this event to display failure information about the current instance of Group Policy processing.

Note

The events that end in 1 in these criteria typically have more verbose information in the log, but the information is similar to those events that end in 0.

Computer Start-up Wait Information

Event ID

Event Type

Explanation

5322

Success

The Group Policy service logs this event to display successful information about the service waiting for the network.

6322

Warning

The Group Policy service logs this event to display warning information about the service waiting for the network.

7322

Error

The Group Policy service logs this event to display failure information about the service waiting for the network.

Winlogon Notification Information

Event ID

Event Type

Explanation

5324

Success

The Group Policy service logs this event to display successful information about a notification received from Winlogon.

6324

Warning

The Group Policy service logs this event to display warning information about a notification received from Winlogon.

7324

Error

The Group Policy service logs this event to display failure information about a notification received from Winlogon.

Service Control Manager Notification Information

Event ID

Event Type

Explanation

5325

Success

The Group Policy service logs this event to display successful information about a notification received from the Service Control Manager.

6325

Warning

The Group Policy service logs this event to display warning information about a notification received from the Service Control Manager.

7325

Error

The Group Policy service logs this event to display failure information about a notification received from the Service Control Manager.

Network Bandwidth Information

Event ID

Event Type

Explanation

5327

Success

The Group Policy service logs this event to display successful information about network bandwidth.

6327

Warning

The Group Policy service logs this event to display warning information about network bandwidth.

7327

Error

The Group Policy service logs this event to display failure information about network bandwidth.

Service Configuration Information

Event ID

Event Type

Explanation

5331

Success

The Group Policy service logs this event to display successful information about the Group Policy service’s configuration.

6331

Warning

The Group Policy service logs this event to display warning information about the Group Policy service’s configuration.

7331

Error

The Group Policy service logs this event to display failure information about the Group Policy service’s configuration.

Network Location Awareness Service Warning

Event ID

Event Type

Explanation

6323

Warning

The Group Policy service logs this event to display warning information about the operability of the NLA service.

7323

Error

The Group Policy service logs this event to display failure information about the operability of the NLA service.

Client-Side Failure Information

Event ID

Event Type

Explanation

6330

Warning

The Group Policy service logs this event to display warning information about a Group Policy CSE that failed in an earlier instance of Group Policy processing.

Other  
  •  Windows 8 : Managing Windows Update (part 4) - Viewing update history, Rolling back updates
  •  Windows 8 : Managing Windows Update (part 3) - Managing Windows Update in Windows 8 native interface
  •  Windows 8 : Managing Windows Update (part 2) - Configuring update settings
  •  Windows 8 : Managing Windows Update (part 1) - Accessing Windows Update settings by using Control Panel
  •  Windows 8 : Working with location-based settings and connection methods
  •  Windows Server 2008 R2 : Active Directory lightweight directory services
  •  Windows Server 2008 R2 : Active Directory federation services (part 4) - Complete ADFS server configuration
  •  Windows Server 2008 R2 : Active Directory federation services (part 3) - Install Web agent for claims aware Web application, Configure ADFS certificates
  •  Windows Server 2008 R2 : Active Directory federation services (part 2) - Set up the ADFS role for the internal and external Active Directory forests
  •  Windows Server 2008 R2 : Active Directory federation services (part 1) - Planning for Active Directory Federation Services
  •  
    Youtube channel
    Top 10
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 2) - Wireframes,Legends
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 1) - Swimlanes
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Formatting and sizing lists
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Adding shapes to lists
    - Microsoft Visio 2013 : Adding Structure to Your Diagrams - Sizing containers
    - Microsoft Access 2010 : Control Properties and Why to Use Them (part 3) - The Other Properties of a Control
    - Microsoft Access 2010 : Control Properties and Why to Use Them (part 2) - The Data Properties of a Control
    - Microsoft Access 2010 : Control Properties and Why to Use Them (part 1) - The Format Properties of a Control
    - Microsoft Access 2010 : Form Properties and Why Should You Use Them - Working with the Properties Window
    - Microsoft Visio 2013 : Using the Organization Chart Wizard with new data
    REVIEW
    - First look: Apple Watch

    - 3 Tips for Maintaining Your Cell Phone Battery (part 1)

    - 3 Tips for Maintaining Your Cell Phone Battery (part 2)
    programming4us programming4us
    programming4us
     
     
    programming4us