More than 1,000 Group Policy Objects Are Present and Group Policy Fails

  • Article

More than 1000 Group Policy objects are stored in a domain, and Group Policy fails. This failure can affect any extension of Group Policy

Possible Causes:

The API that gathers the list of readable Group Policy objects can only return 1000 Group Policy objects at one time. If a user or computer has Read access to more than 1000 Group Policy objects, Group Policy fails. This failure occurs regardless of whether Apply Group Policy is enabled on the readable Group Policy objects. If both Read and Apply Group Policy are enabled on dozens or hundreds of Group Policy objects, Group Policy processing is very slow.

note-iconNote

If you make sure no user or computer has Read access to that many Group Policy objects, the problem does not occur. It is recommended that you always turn off (sometimes explicitly Deny, but in most cases don't Allow) Read access whenever Apply Group Policy is turned off.

Diagnostic Tests:

This failure disables Group Policy from applying to the intended recipients until it is resolved.

The event log should contain entries similar to the following:

Event Type: Error

Event Source: Userenv

Event Category: None

Event ID: 1000

Date: 10/13/1999

Time: 2:17:33 PM

User: JEFFSMITH

Computer: RESKIT1

Description:

Windows cannot search for Group Policy objects with (3).

Event Type: Error

Event Source: Userenv

Event Category: None

Event ID: 1000

Date: 10/13/1999

Time: 2:19:37 PM

User: JEFFSMITH

Computer: RESKIT1

Description:

Windows cannot search for Group Policy objects with (4).

When you observe the %systemroot%\debug\usermode\userenv.log you should find entries similar to the following:

USERENV(ac.2d0) 14:17:33:272 EvaluteDeferredGPOs: Failed to search with error 0x3

USERENV(ac.2d0) 14:17:33:602 GetGPOInfo: EvaluateDeferredGPOs failed. Exiting

USERENV(ac.2d0) 14:17:33:632 ProcessGPOs: GetGPOInfo failed.

USERENV(ac.13c) 14:19:37:143 EvaluteDeferredGPOs: Failed to search with error 0x4

USERENV(ac.13c) 14:19:37:313 GetGPOInfo: EvaluateDeferredGPOs failed. Exiting

USERENV(ac.13c) 14:19:37:343 ProcessGPOs: GetGPOInfo failed.