Event ID 1104 — Group Policy Preprocessing (WMI)

  • Article

Applies To: Windows Server 2008 R2

Group Policy processing depends on the Windows Management Instrumetation (WMI) service. During preprocessing, the Group Policy service evaluates WMI filters to determine if a Group Policy object is within scope of the computer or users. Failures with WMI can prevent Group Policy settings from applying as well as cause inaccurate reporting results.

Event Details

Product: Windows Operating System
ID: 1104
Source: Microsoft-Windows-GroupPolicy
Version: 6.1
Symbolic Name: gpEvent_WMIFILTER_NOTFOUND
Message: Windows was unable to read the Windows Management Instrumentation (WMI) filter information associated with the Group Policy object (GPO) %8.This may be caused by a deleted WMI Filter defined in the domain that is still in use by GPOs. Group Policy settings for this GPO will not be enforced. Other GPOs may still apply. Windows will attempt to retrieve this information at the next policy cycle. This specific problem may be resolved by identifying all GPOs that reference the WMI filter and removing the references. Contact an administrator if this event recurs for several hours.

Resolve

Correct a missing WMI filter

Possible resolutions include:

  1. Ensure the associated WMI filter exists in the domain by clicking the WMI Filters node in the Group Policy Management Console. If it does not exist, remove the link from the associated Group Policy object (GPO) by selecting None from the WMI filter list on the selected Group Policy object in the Group Policy Management Console. Or recreate the WMI filter and associate it with the selected GPO using the Group Policy Management Console.
  2. Use the WMIDiag utility to diagnose the problem further (https://go.microsoft.com/fwlink/?LinkId=92714).

Verify

Group Policy applies during computer startup and user logon. Afterward, Group Policy applies every 90 to 120 minutes. Events appearing in the event log may not reflect the most current state of Group Policy. Therefore, you should always refresh Group Policy to determine if Group Policy is working correctly.

To refresh Group Policy on a specific computer:

  1. Open the Start menu. Click All Programs and then click Accessories.
  2. Click Command Prompt.
  3. In the command prompt window, type gpupdate and then press ENTER.
  4. When the gpupdate command completes, open the Event Viewer.

Group Policy is working correctly if the last Group Policy event to appear in the System event log has one of the following event IDs:

  • 1500
  • 1501
  • 1502
  • 1503

Group Policy Preprocessing (WMI)

Group Policy Infrastructure