A Group Policy Object has not been processed because the filter check could not be performed

A_Group_Policy_Object_has_not_been_processed_because_the_filter_check_could_not_be_performed_5_Rule (Rule)

Knowledge Base article:

Summary

Windows cannot find a Group Policy object (GPO) in the Active Directory® directory service. The GPO may not exist, or access to the GPO may be denied.

Sample Event:

Windows cannot perform filter check for Group Policy object %1. The associated filter cannot be found. This Group Policy Object will be skipped.

Causes

A GPO has not been processed because the filter check could not be performed.

Resolutions

To enable UserEnv logging, see Knowledge Base article 221833, "How to Enable User Environment Debug Logging in Retail Builds of Windows," at http://go.microsoft.com/fwlink/?LinkId=25636. The log file will detail the specific error.

External

Element properties:

Target

Microsoft.Windows.Server.2003.AD.DomainControllerRole

Category

EventCollection

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

A Group Policy Object has not been processed because the filter check could not be performed

{0}

Event Log

Application

Comment

Mom2005ID='{E3E4AA6A-C7EE-457D-8E34-EC4AD2035B25}';MOM2005GroupID=

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="A_Group_Policy_Object_has_not_been_processed_because_the_filter_check_could_not_be_performed_5_Rule" Comment="Mom2005ID='{E3E4AA6A-C7EE-457D-8E34-EC4AD2035B25}';MOM2005GroupID=" Enabled="onEssentialMonitoring" Target="AD2003Core!Microsoft.Windows.Server.2003.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>1104</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>UserEnv</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>UserName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>System</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner>$Data/PublisherName$</AlertOwner>

      <AlertMessageId>$MPElement[Name="A_Group_Policy_Object_has_not_been_processed_because_the_filter_check_could_not_be_performed_5_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>