Event ID 1091 Group Policy Problem :(

[NFI]

Hello,

I'm getting a bit desperate here, so any help will be much appreciated...

I noticed that the machines on my XP-Pro/Server 2003 network weren't updating from my WSUS server. I had a look in Event Viewer on some of the client machines and found that Event ID 1091 was being thrown. The actual error is just a random collection of words:

"Internet Explorer Branding failed to log RSOP (Resultant Set Of Policy) data."

I then noticed that Group Policy is failing to go down onto the client machines altogether, although there are some odd effects, for example I am using GP to set the browser Proxy settings and prevent users from altering them and, although these aren't going down successfully, users still can't modify the settings.

I read on eventid.com that this was the result of using GP to carry out folder redirection and browser connection settings at the same time. Although I'm actually using a custom template to do the folder redirection (instead of the unreliable GPO settings), this seemed pretty close to my problem. They recommended hotfix KB823565, which I eventually managed to pry out of Microsoft's grasp, but it turns out that my server is patched higher than this fix already.

So...I turned on extra-verbose logging on the client machines and started hacking my way through the userenv.txt log file in %systemroot%\debug\userenv\ and that's pretty much where I am now - this file is probably pretty helpful, but I don't really understand all of what I'm seeing...does anybody know where to start with it?

So, here are my questions, then:

1. How do I resolve Event ID 1091?
2. What should I look for in USERENV.TXT?


Any help will be extremely well received

Thanks,

Paul

 

[heyyunus]

If your client has got some sort of firewalls installed then it is most likely to prohibit the GPO from being applied, because it alters the clients registry settings upon login to domain.

Otherwise run "gpupdate /force" on both server & clients.

Using netdiag utility do the following test and ensure they all pass to verify a possible DNS issue:

netdiag /testNS



-------
Yunus

 

[NFI]

Hiya,

I tried the netdiag /test:dns and it came back fine with no errors.

gpupdate /force just produces the same RSOP error - GP is getting to the clients, they're just not accepting it properly


Thanks,

Paul

 

[NFI]

Hello again,

a quick update in the hope that somebody might be able to help me further...

I found an article in the Knowledgebase (KB888254) which said that RSOP errors may occur when Group Policy is used to set Folder Redirection and Browser Security Settings. So, I phoned Microsoft and, after 45 minutes (thanks, Microsoft!) on hold, I finally managed to get hold of the KB888254 hotfix - which is also one you have to specifically request...

So, I installed it, hacked the registry to make it work, as per their KB article and...it hasn't made th blindest bit of difference. I still get RSOP errors in the event log and my proxy settings are still not applied...

So what next? Is Group Policy fundementally flawed? Surely there must be other people out there with the same problem? I suppose I could write a registry import to set the various settings which GP can't seem to apply anymore, but I really don't want to...I've got Group Policy and it should bl**dy well work!


Again, any thoughts, ideas etc will be much appreciated,

Thanks,

Paul

 

[heyyunus]

Try Gpresult.exe, Also disable IPSEC & Login scripts and then try.

Refer the following link for some more troubleshooting steps:

http://technet2.microsoft.com/Windo...3088-44be-b270-8ee463b349861033.mspx?mfr=true

-------
Yunus

 

[NFI]

Hello,

thanks for that - I didn't realise you could look at RSOP data through the Help and Support app!

As far as I can see, everything looks as though it's working fine...but still parts of GP aren't going down - most noteably Proxy Settings.

WSUS still isn't updating my machines, either...

I'm not using IPSEC, but I'm a bit unsure as to what effect login scripts would have on all of this?


Thanks,

Paul

 

[heyyunus]

Is Automatic Updates service running?
I have seen if thats not running then WSUS server doenst update the client computers


-------
Yunus

 

[NFI]

That's set through GP, so it's running happily on all client stations...they're just not doing it

Paul