Home
  •  

User Name Resolution Monitor

Microsoft.Windows.GroupPolicy.2008.Runtime.GroupPolicyPreprocessingSecurity.System.Determineusername.EventBased.UnitMonitor (UnitMonitor)

Knowledge Base article:

Summary

User Name Resolution Problem

Group Policy preprocessing uses security to act on behalf of the computer or user. Incorrect permissions or security failures can prevent Group Policy from applying to the computer or user.

Resolutions

Determine user name

The Group Policy service logs the name of the domain controller and the error code. This information appears on the Details tab of the error message in Event Viewer. The error code (displayed as a decimal) and error description fields further identify the reason for the failure. Evaluate the error code with the list below:

Error code 5 (Access is denied)

Error code 14 (Not enough storage is available to complete this operation)

This error code might indicate that Windows does not have enough memory to complete the task. Investigate the system event log for any other memory-specific issues.

Error code 525 (The specified user does not exist)

This error code might indicate incorrect permissions on the organizational unit. The user requires read access to the organizational unit that contains the user object. Similarly, computers require read access to the organizational unit that contains the computer object.

Error code 1355 (The specified domain either does not exist or could not be contacted)

This error code might indicate a fault or improper configuration with name resolution (DNS). Use nslookup to confirm you can resolve addresses of the domain controllers in the user domain. Use Networking troubleshooting procedures to further diagnose the problem

Error code 1727 (The remote procedure call failed and did not execute)

This error code might indicate that firewall rules are preventing communication with a domain controller. If you have third-party firewall software installed, check the configuration of the firewall or try temporarily disabling it and verifying that Group Policy processes successfully. Use Networking troubleshooting procedures or procedures from your third-party firewall software to further diagnose the problem.

All others errors

Use Security troubleshooting procedures to further diagnose the problem.

Element properties:

TargetMicrosoft.Windows.GroupPolicy.2008.Runtime
Parent MonitorSystem.Health.AvailabilityState
CategoryStateCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.SingleEventLogManualReset2StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Group Policy Preprocessing (Security) Alert
{0}
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.Windows.GroupPolicy.2008.Runtime.GroupPolicyPreprocessingSecurity.System.Determineusername.EventBased.UnitMonitor" Accessibility="Public" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.GroupPolicy.2008.Runtime" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.GroupPolicy.2008.Runtime.GroupPolicyPreprocessingSecurity.System.Determineusername.EventBased.UnitMonitor.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="ManualReset" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>

    <OperationalState ID="NegativeHealthState" MonitorTypeStateID="EventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>System</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>Microsoft-Windows-GroupPolicy</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>1053</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

  </Configuration>

</UnitMonitor>