Home
  •  

GPO Data Retrieval Error

GPO_Data_Retrieval_Error_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary

This error indicates that a Group Policy Object (GPO) is corrupt. Group Policy processing for the computer/user has failed and will continue to fail until this error is resolved.
 
Causes

A resource required by the GPO is not available.
 
Resolutions

To troubleshoot this problem, try one or all of the following:

  • Review the event description that caused this error to obtain additional details regarding why the GPO is corrupted.
  • Restore the GPO from the most recent backup.
 
External Knowledge Sources
 
Sample Event

Windows cannot access the file gpt.ini for GPO %1. The file must be present at the location<%2>.(%3). Group Policy processing aborted.
 
Related Events

The following Group Policy events,thrown by the UserEnv.dll, will cause this error: 1057, 1058, 1059, 1060, 1064, 1072, or 1077.
 
© 1995-2001 Microsoft Corporation, all rights reserved.

Element properties:

TargetMicrosoft.Windows.Server.GroupPolicy.2003.Windows_2003_Servers_Installation
CategoryEventCollection
EnabledTrue
Event Sourceuserenv
Alert GenerateTrue
Alert SeverityError
Alert PriorityLow
RemotableTrue
Alert Message
GPO Data Retrieval Error

$Data/EventDescription$
Event LogApplication
CommentMom2005ID='{270E79E2-47DF-4FF1-9D6C-52D3A4A14DC2}';MOM2005ComputerGroupID={5F37D1D6-F952-4B72-9CCA-6986A3B7B2E3}

Member Modules:

ID Module Type TypeId RunAs 
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Mom.BackwardCompatibility.AlertResponse Default

Source Code:

<Rule ID="GPO_Data_Retrieval_Error_1_Rule" Comment="Mom2005ID='{270E79E2-47DF-4FF1-9D6C-52D3A4A14DC2}';MOM2005ComputerGroupID={5F37D1D6-F952-4B72-9CCA-6986A3B7B2E3}" Enabled="true" Target="Microsoft.Windows.Server.GroupPolicy.2003.Windows_2003_Servers_Installation" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005BooleanRegularExpression</Operator>

              <Pattern>1057|1058|1059|1060|1064|1072|1077</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>userenv</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>40</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>GPO Data Retrieval Error</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>