Event ID 1126 — Application of Group Policy

  • Article

Applies To: Windows Server 2008 R2

Group Policy uses the information collected during preprocessing to apply settings to the computer or user. The Group Policy service cycles through each client-side extension, sharing the previous collected information. Each client-side extension then applies its specific policy settings to the computer or users. During this process, one or more client-side extensions may report problems when attempting to apply policy settings.

Event Details

Product: Windows Operating System
ID: 1126
Source: Microsoft-Windows-GroupPolicy
Version: 6.1
Symbolic Name: gpEvent_TIME_SKEW
Message: Windows was unable to determine whether new Group Policy settings defined by a network administrator should be enforced for this user or computer because this computer's clock is not synchronized with the clock of one of the domain controllers for the domain. Because of this issue, this computer system may not be in compliance with the network administrator’s requirements, and users of this system may not be able to use some functionality on the network. Windows will periodically attempt to retry this operation, and it is possible that either this system or the domain controller will correct the time settings without intervention by an administrator, so the problem will be corrected.

If this issue persists for more than an hour, checking the local system's clock settings to ensure they are accurate and are synchronized with the clocks on the network's domain controllers is one way to resolve this problem. A network administrator may be required to resolve the issue if correcting the local time settings does not address the problem.

Resolve

Correct time differential

To correct time differential from the client:

  1. Verify that the time and time zone information on the computer are correct. A time difference greater than five minutes between the computer and the domain controller may lead to the computer failing to authenticate with the domain.
  2. Force the time service on the computer to synchronize time with a domain controller by running w32tm /resync as an administrator.
  3. Check the Event Viewer for other events related to time synchronization.
  4. Use Kerberos troubleshooting procedures to further diagnose the problem (https://go.microsoft.com/fwlink/?LinkId=92709).

To correct time differential from the domain controller:

  • Verify the time and time zone information on the computer are correct. A time difference greater than five minutes between the computer and the domain controller may lead to the computer failing to authenticate with the domain.

Verify

Group Policy applies during computer startup and user logon. Afterward, Group Policy applies every 90 to 120 minutes. Events appearing in the event log may not reflect the most current state of Group Policy. Therefore, you should always refresh Group Policy to determine if Group Policy is working correctly.

To refresh Group Policy on a specific computer:

  1. Open the Start menu. Click All Programs and then click Accessories.
  2. Click Command Prompt.
  3. In the command prompt window, type gpupdate and then press ENTER.
  4. When the gpupdate command completes, open the Event Viewer.

Group Policy is working correctly if the last Group Policy event to appear in the System event log has one of the following event IDs:

  • 1500
  • 1501
  • 1502
  • 1503

Application of Group Policy

Group Policy Infrastructure