Microsoft-Windows-GroupPolicy

Event	Title	Channel	Sample	Rule
1002	The processing of Group Policy failed because of a system allocation failure.	System	N	N
1006	The processing of Group Policy failed.	System	Y	N
1007	The processing of Group Policy failed.	System	N	N
1030	The processing of Group Policy failed.	System	Y	N
1052	The processing of Group Policy failed.	System	N	N
1053	The processing of Group Policy failed.	System	N	N
1054	The processing of Group Policy failed.	System	Y	N
1055	The processing of Group Policy failed.	System	Y	N
1058	The processing of Group Policy failed.	System	N	N
1065	The processing of Group Policy failed.	System	N	N
1068	The processing of Group Policy was interrupted.	System	N	N
1079	The processing of Group Policy failed.	System	N	N
1080	The processing of Group Policy failed.	System	N	N
1085	Windows failed to apply the ExtensionName settings.	System	N	N
1088	The processing of Group Policy failed.	System	N	N
1089	Windows failed to record Resultant Set of Policy (RSoP) information, which …	System	N	N
1090	Windows failed to record Resultant Set of Policy (RSoP) information, which …	System	N	N
1091	Windows could not record the Resultant Set of Policy (RSoP) information for the …	System	N	N
1095	Windows encountered an error while recording Resultant Set of Policy (RSoP) …	System	N	N
1096	The processing of Group Policy failed.	System	N	N
1097	The processing of Group Policy failed.	System	N	N
1101	The processing of Group Policy failed.	System	N	N
1104	Windows was unable to read the Windows Management Instrumentation (WMI) filter …	System	N	N
1109	The user account is in a different forest than the computer account.	System	N	N
1110	The processing of Group Policy failed.	System	N	N
1112	The Group Policy Client Side Extension ExtensionName was unable to apply one or …	System	N	N
1125	The processing of Group Policy failed because of an internal system error.	System	N	N
1126	Windows was unable to determine whether new Group Policy settings defined by a …	System	Y	N
1127	The processing of Group Policy failed due to an internal error.	System	N	N
1128	The Group Policy Client Side Extension ExtensionName may have caused the Group …	System	N	N
1129	The processing of Group Policy failed because of lack of network connectivity to …	System	Y	N
1130	SupportInfo2 failed.	System	N	N
1500	The Group Policy settings for the computer were processed successfully.	System	Y	N
1501	The Group Policy settings for the user were processed successfully.	System	Y	N
1502	The Group Policy settings for the computer were processed successfully.	System	Y	N
1503	The Group Policy settings for the user were processed successfully.	System	Y	N
4000	Starting computer boot policy processing for PrincipalSamName.	Operational	Y	N
4001	Starting user logon Policy processing for PrincipalSamName.	Operational	Y	N
4002	Starting policy processing due to network state change for computer …	Operational	N	N
4003	Starting policy processing due to network state change for user …	Operational	N	N
4004	Starting manual processing of policy for computer PrincipalSamName.	Operational	Y	N
4005	Starting manual processing of policy for user PrincipalSamName.	Operational	Y	N
4006	Starting periodic policy processing for computer PrincipalSamName.	Operational	Y	N
4007	Starting periodic policy processing for user PrincipalSamName.	Operational	Y	N
4016	Starting CSEExtensionName Extension Processing.	Operational	Y	N
4017	OperationDescription Parameter.	Operational	Y	N
4018	Starting ScriptType for PrincipalSamName.	Operational	N	N
4019	Running script name ScriptName.	Operational	N	N
4115	Group Policy Service started.	Operational	Y	N
4116	Started the Group Policy service initialization phase.	Operational	Y	N
4117	Group Policy Session started.	Operational	Y	N
4126	Group Policy receiving applicable GPOs from the domain controller.	Operational	Y	N
4216	Starting to save policies to the local datastore.	Operational	Y	N
4217	Starting to load policies from the local datastore.	Operational	N	N
4218	Starting the first WMI query for the policy.	Operational	N	N
4257	Starting to download policies.	Operational	Y	N
4326	Group Policy is trying to discover the Domain Controller information.	Operational	Y	N
5016	Completed CSEExtensionName Extension Processing in CSEElaspedTimeInMilliSeconds …	Operational	Y	N
5017	OperationDescription Parameter The call completed in …	Operational	Y	N
5018	Completed ScriptType for PrincipalSamName in ScriptElaspedTimeInSeconds seconds.	Operational	N	N
5019	Completed ScriptName in ScriptElaspedTimeInSeconds seconds.	Operational	N	N
5115	Group Policy Service stopped.	Operational	Y	N
5116	Successfully completed the Group Policy Service initialization phase.	Operational	Y	N
5117	Group policy session completed successfully.	Operational	Y	N
5126	Group Policy successfully got applicable GPOs from the domain controller.	Operational	Y	N
5216	Successfully saved policies to the local datastore.	Operational	Y	N
5217	Successfully loaded policies from the local datastore.	Operational	N	N
5218	Successfully completed the first WMI query.	Operational	N	N
5257	Successfully completed downloading policies.	Operational	Y	N
5308	Domain Controller details.	Operational	Y	N
5309	Computer details.	Operational	Y	N
5310	Account details.	Operational	Y	N
5311	The loopback policy processing mode is PolicyProcessingMode.	Operational	Y	N
5312	List of applicable Group Policy objects.	Operational	Y	N
5313	The following Group Policy objects were not applicable because they were …	Operational	Y	N
5314	A LinkDescription link was detected.	Operational	Y	N
5315	Next policy processing for PrincipalSamName will be attempted in …	Operational	Y	N
5320	InfoDescription.	Operational	Y	N
5321	InfoDescription Parameter: OperationParameter1.	Operational	Y	N
5322	Group Policy waited for TimeWaitedAtStartup milliseconds for the network …	Operational	Y	N
5323	Invalid Error Message.	Operational	N	N
5324	Group Policy received the notification NotificationType from Winlogon for …	Operational	Y	N
5325	Group Policy received NotificationType notification from Service Control …	Operational	Y	N
5326	Group Policy successfully discovered the Domain Controller in …	Operational	Y	N
5327	Estimated network bandwidth on one of the connections: NetworkBandwidthInKbps …	Operational	Y	N
5331	Service configuration update to standalone was attempted due to the presence of …	Operational	Y	N
5332	Group Policy waited for TimeWaitedAtStartup milliseconds for the Direct Access …	Operational	N	N
5340	The Group Policy processing mode is PolicyApplicationMode.	Operational	Y	N
5351	Group policy session returned to winlogon.	Operational	Y	N
6000	Invalid Error Message.	Operational	N	N
6001	Invalid Error Message.	Operational	N	N
6002	Invalid Error Message.	Operational	N	N
6003	Invalid Error Message.	Operational	N	N
6004	Invalid Error Message.	Operational	N	N
6005	Invalid Error Message.	Operational	N	N
6006	Invalid Error Message.	Operational	N	N
6007	Invalid Error Message.	Operational	N	N
6016	Completed CSEExtensionName Extension Processing in CSEElaspedTimeInMilliSeconds …	Operational	N	N
6017	Invalid Error Message.	Operational	N	N
6018	Invalid Error Message.	Operational	N	N
6019	Invalid Error Message.	Operational	N	N
6033	Skipped CSEExtensionName Extension based on Group Policy client-side processing …	Operational	N	N
6034	Group Policy changed from synchronous foreground to asynchronous foreground …	Operational	N	N
6035	CSEExtensionName Extension deferred processing until next synchronous …	Operational	N	N
6226	Invalid Error Message.	Operational	N	N
6308	Invalid Error Message.	Operational	N	N
6309	Invalid Error Message.	Operational	N	N
6310	Invalid Error Message.	Operational	N	N
6311	Invalid Error Message.	Operational	N	N
6312	Invalid Error Message.	Operational	N	N
6313	Invalid Error Message.	Operational	N	N
6314	Group Policy bandwidth estimation failed.	Operational	Y	N
6315	Invalid Error Message.	Operational	N	N
6320	Warning: Warning Warning code WarningDescription.	Operational	N	N
6321	Warning: Warning Parameter: WarningDescription : Warning code Parameter.	Operational	N	N
6322	Invalid Error Message.	Operational	N	N
6323	Group Policy dependency (DisplayName) did not start.	Operational	N	N
6324	Invalid Error Message.	Operational	N	N
6325	Invalid Error Message.	Operational	N	N
6326	Invalid Error Message.	Operational	N	N
6327	Invalid Error Message.	Operational	N	N
6330	An unfinished invocation of the Group Policy Client Side Extension …	Operational	N	N
6331	Invalid Error Message.	Operational	N	N
6332	Invalid Error Message.	Operational	N	N
6337	Group Policy network connection is via Direct Access.	Operational	N	N
6338	Group Policy Winlogon status reporting has completed.	Operational	Y	N
6339	Group Policy Winlogon Start Shell handling completed.	Operational	Y	N
6341	A Group Policy setting was used to override the fast/slow link detection.	Operational	N	N
6342	The network connection is using a WWAN device for connectivity.	Operational	N	N
6344	Group Policy detected a slow link during sync mode processing.	Operational	N	N
6345	The connection to DC timed out during the Group Policy sync mode process.	Operational	N	N
6346	Group Policy switched the sync mode process to async mode.	Operational	N	N
7000	Computer boot policy processing failed for PrincipalSamName in …	Operational	N	N
7001	User logon policy processing failed for PrincipalSamName in …	Operational	N	N
7002	Policy processing due to network state change failed for computer …	Operational	N	N
7003	Policy processing due to network state change failed for user PrincipalSamName …	Operational	N	N
7004	Manual processing of policy failed for computer PrincipalSamName in …	Operational	N	N
7005	Manual processing of policy failed for user PrincipalSamName in …	Operational	N	N
7006	Periodic policy processing failed for computer PrincipalSamName in …	Operational	N	N
7007	Periodic policy processing failed for user PrincipalSamName in …	Operational	N	N
7016	Completed CSEExtensionName Extension Processing in CSEElaspedTimeInMilliSeconds …	Operational	Y	N
7017	OperationDescription Parameter The call failed after …	Operational	Y	N
7018	Script for PrincipalSamName failed in ScriptElaspedTimeInSeconds seconds.	Operational	N	N
7019	Invalid Error Message.	Operational	N	N
7117	Group policy session completed with error.	Operational	N	N
7126	Group Policy could not get applicable GPOs from the domain controller.	Operational	N	N
7216	Saved policies to the local datastore with error.	Operational	N	N
7217	Loaded policies from the local datastore with error.	Operational	N	N
7257	Downloaded policies with error.	Operational	N	N
7308	Invalid Error Message.	Operational	N	N
7309	Invalid Error Message.	Operational	N	N
7310	Invalid Error Message.	Operational	N	N
7311	Invalid Error Message.	Operational	N	N
7312	Invalid Error Message.	Operational	N	N
7313	Invalid Error Message.	Operational	N	N
7314	Invalid Error Message.	Operational	N	N
7315	Invalid Error Message.	Operational	N	N
7320	Error: ErrorDescription Error code ErrorCode.	Operational	Y	N
7321	Error: Error Parameter: ErrorDescription : Error code Parameter.	Operational	N	N
7322	Invalid Error Message.	Operational	N	N
7323	Invalid Error Message.	Operational	N	N
7324	Invalid Error Message.	Operational	N	N
7325	Invalid Error Message.	Operational	N	N
7326	Group Policy failed to discover the Domain Controller details in …	Operational	Y	N
7327	Invalid Error Message.	Operational	N	N
7331	Service configuration update to standalone was attempted due to the presence of …	Operational	N	N
7332	Invalid Error Message.	Operational	N	N
8000	Completed computer boot policy processing for PrincipalSamName in …	Operational	Y	N
8001	Completed user logon policy processing for PrincipalSamName in …	Operational	Y	N
8002	Completed policy processing due to network state change for computer …	Operational	N	N
8003	Completed policy processing due to network state change for user …	Operational	N	N
8004	Completed manual processing of policy for computer PrincipalSamName in …	Operational	Y	N
8005	Completed manual processing of policy for user PrincipalSamName in …	Operational	Y	N
8006	Completed periodic policy processing for computer PrincipalSamName in …	Operational	Y	N
8007	Completed periodic policy processing for user PrincipalSamName in …	Operational	Y	N
8016	CSEExtensionName Extension (CSEExtensionId) requests a sync mode process.	Operational	N	N
9001	This machine is configured to retrieve Group Policy files from a file share in …	Operational	Y	N

Event ID 1002: The processing of Group Policy failed because of a system allocation failure.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed because of a system allocation failure. Please ensure the computer is not running low on resources (memory, available disk space). Group Policy processing will be attempted at the next refresh cycle.

Message #

The processing of Group Policy failed because of a system allocation failure. Please ensure the computer is not running low on resources (memory, available disk space). Group Policy processing will be attempted at the next refresh cycle.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1006: The processing of Group Policy failed.

Channel: System
Level: Error
Opcode: Start

Description

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

Message #

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 1006,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-18T05:29:01.333607+00:00",
    "event_record_id": 1666,
    "correlation": {
      "ActivityID": "29E96F9C-8911-49C3-99BC-065B1FD48E8E"
    },
    "execution": {
      "process_id": 3396,
      "thread_id": 2868
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SupportInfo1": 1,
    "SupportInfo2": 6168,
    "ProcessingMode": 0,
    "ProcessingTimeInMilliseconds": 156,
    "ErrorCode": 82,
    "ErrorDescription": "Local Error",
    "DCName": ""
  },
  "message": ""
}

Event ID 1007: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not determine the site associated for this computer, which is required for Group Policy processing.

Message #

The processing of Group Policy failed. Windows could not determine the site associated for this computer, which is required for Group Policy processing.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1030: The processing of Group Policy failed.

Channel: System
Level: Error
Opcode: Start

Description

The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.

Message #

The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 1030,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-12T18:17:33.749779+00:00",
    "event_record_id": 1267,
    "correlation": {
      "ActivityID": "B725C8D9-F151-4EBC-ADFE-2827DEDA46D8"
    },
    "execution": {
      "process_id": 4092,
      "thread_id": 12968
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "SupportInfo1": 1,
    "SupportInfo2": 3018,
    "ProcessingMode": 0,
    "ProcessingTimeInMilliseconds": 31,
    "ErrorCode": 8341,
    "ErrorDescription": "A directory service error has occurred. ",
    "DCName": "\\\\LAB-DC01.ludus.domain"
  },
  "message": ""
}

Event ID 1052: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not determine the role of this computer. Role information (Workgroup, Member Server, or Domain Controller) is required to process Group Policy.

Message #

The processing of Group Policy failed. Windows could not determine the role of this computer. Role information (Workgroup, Member Server, or Domain Controller) is required to process Group Policy.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString

Event ID 1053: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following.

Message #

The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following: 
a) Name Resolution failure on the current domain controller. 
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString

Event ID 1054: The processing of Group Policy failed.

Channel: System
Level: Error
Opcode: Start

Description

The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.

Message #

The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "event_id": 1054,
    "level": 2,
    "task": 0,
    "opcode": 1,
    "time_created": "2026-04-28T02:27:58.4398646+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "ErrorDescription": "The specified domain either does not exist or could not be contacted. ",
    "ProcessingTimeInMilliseconds": "23063",
    "SupportInfo1": "1",
    "ErrorCode": "1355",
    "SupportInfo2": "3051",
    "ProcessingMode": "0"
  }
}

Event ID 1055: The processing of Group Policy failed.

Channel: System
Level: Error
Opcode: Start

Description

The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following.

Message #

The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
a) Name Resolution failure on the current domain controller. 
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 1055,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 1,
    "keywords": -9223372036854775808,
    "time_created": "2026-04-16T03:50:58.0913473+00:00",
    "event_record_id": 5355,
    "correlation": {
      "ActivityID": "{A59FF81D-34E6-4364-A733-8CF28EBB6D64}"
    },
    "execution": {
      "process_id": 11488,
      "thread_id": 13396
    },
    "channel": "System",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SupportInfo1": "1",
    "SupportInfo2": "2616",
    "ProcessingMode": "0",
    "ProcessingTimeInMilliseconds": "1844",
    "ErrorCode": "1398",
    "ErrorDescription": "There is a time and/or date difference between the client and server. "
  },
  "message": "The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: \r\na) Name Resolution failure on the current domain controller. \r\nb) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller)."
}

Event ID 1058: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows attempted to read the file FilePath from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: a) Name Resolution/Network Connectivity to the current domain controller. b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). c) The Distributed File System (DFS) client has been disabled.

Message #

The processing of Group Policy failed. Windows attempted to read the file %9 from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: 
a) Name Resolution/Network Connectivity to the current domain controller. 
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). 
c) The Distributed File System (DFS) client has been disabled.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString
`GPOCNName` UnicodeString
`FilePath` UnicodeString

Event ID 1065: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not evaluate the Windows Management Instrumentation (WMI) filter for the Group Policy object GPOCNName. This could be caused by RSOP being disabled or Windows Management Instrumentation (WMI) service being disabled, stopped, or other WMI errors. Make sure the WMI service is started and the startup type is set to automatic. New Group Policy objects or settings will not process until this event has been resolved.

Message #

The processing of Group Policy failed. Windows could not evaluate the Windows Management Instrumentation (WMI) filter for the Group Policy object %8. This could be caused by RSOP being disabled  or Windows Management Instrumentation (WMI) service being disabled, stopped, or other WMI errors. Make sure the WMI service is started and the startup type is set to automatic. New Group Policy objects or settings will not process until this event has been resolved.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString
`GPOCNName` UnicodeString

Event ID 1068: The processing of Group Policy was interrupted.

Channel: System
Opcode: Start

Description

The processing of Group Policy was interrupted. Windows prematurely ended the discovery and enforcement of Group Policy settings because the computer was requested to shutdown or the user logged off. Group Policy processing will be attempted next refresh cycle, on the next computer reboot, or the next user logon.

Message #

The processing of Group Policy was interrupted. Windows prematurely ended the discovery and enforcement of Group Policy settings because the computer was requested to shutdown or the user logged off. Group Policy processing will be attempted next refresh cycle, on the next computer reboot, or the next user logon.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`DCName` UnicodeString

Event ID 1079: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not obtain the list of Group Policy objects applicable for this computer or user. View the event details for more information.

Message #

The processing of Group Policy failed. Windows could not obtain the list of Group Policy objects applicable for this computer or user. View the event details for more information.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1080: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not search the Active Directory organization unit hierarchy. View the event details for more information.

Message #

The processing of Group Policy failed. Windows could not search the Active Directory organization unit hierarchy. View the event details for more information.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1085: Windows failed to apply the ExtensionName settings.

Channel: System
Opcode: Start

Description

Windows failed to apply the ExtensionName settings. ExtensionName settings might have its own log file. Please click on the "More information" link.

Message #

Windows failed to apply the %8 settings. %8 settings might have its own log file. Please click on the "More information" link.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString
`ExtensionName` UnicodeString
`ExtensionId` UnicodeString

References #

Microsoft Learn

Event ID 1088: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows attempted to query the list of Group Policy objects and exceeded the maximum limit (999).

Message #

The processing of Group Policy failed. Windows attempted to query the list of Group Policy objects and exceeded the maximum limit (999).

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1089: Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or u...

Channel: System
Opcode: Start

Description

Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or user. This could be caused by RSOP being disabled or Windows Management Instrumentation (WMI) service being disabled, stopped, or other WMI errors. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Message #

Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or user. This could be caused by RSOP being disabled or Windows Management Instrumentation (WMI) service being disabled, stopped, or other WMI errors. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1090: Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or u...

Channel: System
Opcode: Start

Description

Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or user. This could be caused by Windows Management Instrumentation (WMI) service being disabled, stopped, or other WMI errors. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Message #

Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or user. This could be caused by Windows Management Instrumentation (WMI) service being disabled, stopped, or other WMI errors. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`DCName` UnicodeString

Event ID 1091: Windows could not record the Resultant Set of Policy (RSoP) information for the Group Policy extension <.

Channel: System
Opcode: Start

Description

Windows could not record the Resultant Set of Policy (RSoP) information for the Group Policy extension <ExtensionName>. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Message #

Windows could not record  the Resultant Set of Policy (RSoP) information for the Group Policy extension <%8>. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString
`ExtensionName` UnicodeString
`ExtensionId` UnicodeString

Event ID 1095: Windows encountered an error while recording Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied ...

Channel: System
Opcode: Start

Description

Windows encountered an error while recording Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or user. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Message #

Windows encountered an error while recording Resultant Set of Policy (RSoP) information, which describes the scope of Group Policy objects applied to the computer or user. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1096: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object GPOCNName. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

Message #

The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object %8. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString
`GPOCNName` UnicodeString
`FilePath` UnicodeString

Event ID 1097: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not determine the computer account to enforce Group Policy settings. This may be transient. Group Policy settings, including computer configuration, will not be enforced for this computer.

Message #

The processing of Group Policy failed. Windows could not determine the computer account to enforce Group Policy settings. This may be transient. Group Policy settings, including computer configuration, will not be enforced for this computer.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1101: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not locate the directory object DSObjectName. Group Policy settings will not be enforced until this event is resolved. View the event details for more information on this error.

Message #

The processing of Group Policy failed. Windows could not locate the directory object %8. Group Policy settings will not be enforced until this event is resolved. View the event details for more information on this error.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString
`DSObjectName` UnicodeString

Event ID 1104: Windows was unable to read the Windows Management Instrumentation (WMI) filter information associated with the Group Policy object GPOCNName.

Channel: System
Opcode: Start

Description

Windows was unable to read the Windows Management Instrumentation (WMI) filter information associated with the Group Policy object GPOCNName.This may be caused by a deleted WMI Filter defined in the domain that is still in use by Group Policy objects. Group Policy settings for this Group Policy object will not be enforced. Other Group Policy objects may still apply. Windows will attempt to retrieve this information at the next policy cycle. This specific problem may be resolved by identifying all GPOs that reference the WMI filter and removing the references. Contact an administrator if this event recurs for several hours.

Message #

Windows was unable to read the Windows Management Instrumentation (WMI) filter information associated with the Group Policy object %8.This may be caused by a deleted WMI Filter defined in the domain that is still in use by Group Policy objects. Group Policy settings for this Group Policy object will not be enforced. Other Group Policy objects may still apply. Windows will attempt to retrieve this information at the next policy cycle. This specific problem may be resolved by identifying all GPOs that reference the WMI filter and removing the references. Contact an administrator if this event recurs for several hours.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString
`GPOCNName` UnicodeString

Event ID 1109: The user account is in a different forest than the computer account.

Channel: System
Opcode: Start

Description

The user account is in a different forest than the computer account. The processing of Group Policy from another forest is not allowed. Group Policy will be processed using Loopback Replace mode. The scope of the user policy settings will be determined by the location of the computer object in Active Directory. The settings will be acquired from the User Configuration of these policies.

Message #

The user account is in a different forest than the computer account. The processing of Group Policy from another forest is not allowed. Group Policy will be processed using Loopback Replace mode. The scope of the user policy settings will be determined by the location of the computer object in Active Directory. The settings will be acquired from the User Configuration of these policies.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`DCName` UnicodeString

Event ID 1110: The processing of Group Policy failed.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed. Windows could not determine if the user and computer accounts are in the same forest. Ensure the user domain name matches the name of a trusted domain that resides in the same forest as the computer account.

Message #

The processing of Group Policy failed. Windows could not determine if the user and computer accounts are in the same forest. Ensure the user domain name matches the name of a trusted domain that resides in the same forest as the computer account.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString

Event ID 1112: The Group Policy Client Side Extension ExtensionName was unable to apply one or more settings because the changes must be processed before system startup or u...

Channel: System
Opcode: Start

Description

The Group Policy Client Side Extension ExtensionName was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

Message #

The Group Policy Client Side Extension %8 was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString
`ExtensionName` UnicodeString
`ExtensionId` UnicodeString

Event ID 1125: The processing of Group Policy failed because of an internal system error.

Channel: System
Collection Priority: Recommended (NSA)
Opcode: Start

Description

The processing of Group Policy failed because of an internal system error. Please see the Group Policy operational log for the specific error message. An attempt will be made to process Group Policy again at the next refresh cycle.

Message #

The processing of Group Policy failed because of an internal system error. Please see the Group Policy operational log for the specific error message. An attempt will be made to process Group Policy again at the next refresh cycle.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString

References #

Microsoft Learn

Event ID 1126: Windows was unable to determine whether new Group Policy settings defined by a network administrator should be enforced for this user or computer b...

Channel: System
Level: Error
Collection Priority: Recommended (NSA)
Opcode: Start

Description

Windows was unable to determine whether new Group Policy settings defined by a network administrator should be enforced for this user or computer because this computer's clock is not synchronized with the clock of one of the domain controllers for the domain. Because of this issue, this computer system may not be in compliance with the network administrator’s requirements, and users of this system may not be able to use some functionality on the network. Windows will periodically attempt to retry this operation, and it is possible that either this system or the domain controller will correct the time settings without intervention by an administrator, so the problem will be corrected. If this issue persists for more than an hour, checking the local system's clock settings to ensure they are accurate and are synchronized with the clocks on the network's domain controllers is one way to resolve this problem. A network administrator may be required to resolve the issue if correcting the local time settings does not address the problem.

Message #

Windows was unable to determine whether new Group Policy settings defined by a network administrator should be enforced for this user or computer because this computer's clock is not synchronized with the clock of one of the domain controllers for the domain. Because of this issue, this computer system may not be in compliance with the network administrator?s requirements, and users of this system may not be able to use some functionality on the network. Windows will periodically attempt to retry this operation, and it is possible that either this system or the domain controller will correct the time settings without intervention by an administrator, so the problem will be corrected. 

If this issue persists for more than an hour, checking the local system's clock settings to ensure they are accurate and are synchronized with the clocks on the network's domain controllers is one way to resolve this problem. A network administrator may be required to resolve the issue if correcting the local time settings does not address the problem.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 1126,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-02-15T19:48:55.427011+00:00",
    "event_record_id": 1406,
    "correlation": {
      "ActivityID": "D02B1188-929A-4E97-B63D-48B93E963B5B"
    },
    "execution": {
      "process_id": 6076,
      "thread_id": 10716
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SupportInfo1": 5,
    "SupportInfo2": 347,
    "ProcessingMode": 0,
    "ProcessingTimeInMilliseconds": 47,
    "ErrorCode": 2148074276,
    "ErrorDescription": "The clocks on the client and server machines are skewed. ",
    "DCName": "\\\\LAB-DC01.ludus.domain"
  },
  "message": ""
}

Event ID 1127: The processing of Group Policy failed due to an internal error.

Channel: System
Opcode: Start

Description

The processing of Group Policy failed due to an internal error. Please look into the Group Policy operational log for the specific error message. An attempt will be made to process Group Policy again at the next refresh cycle.

Message #

The processing of Group Policy failed due to an internal error. Please look into the Group Policy operational log for the specific error message. An attempt will be made to process Group Policy again at the next refresh cycle.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`DCName` UnicodeString

Event ID 1128: The Group Policy Client Side Extension ExtensionName may have caused the Group Policy Service to terminate unexpectedly.

Channel: System

Description

The Group Policy Client Side Extension ExtensionName may have caused the Group Policy Service to terminate unexpectedly. To prevent further failures in the Group Policy Service, this extension has been temporarily disabled until after the next system restart. Group Policy settings managed by this extension may no longer be enforced until the system is restarted. The vendor of this extension should be contacted if this issue recurs.

Message #

The Group Policy Client Side Extension %3 may have caused the Group Policy Service to terminate unexpectedly. To prevent further failures in the Group Policy Service, this extension has been temporarily disabled until after the next system restart. Group Policy settings managed by this extension may no longer be enforced until the system is restarted. The vendor of this extension should be contacted if this issue recurs.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ExtensionName` UnicodeString
`ExtensionId` UnicodeString

Event ID 1129: The processing of Group Policy failed because of lack of network connectivity to a domain controller.

Channel: System
Level: Error
Collection Priority: Recommended (NSA)

Description

The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has successfully processed. If you do not see a success message for several hours, then contact your administrator.

Message #

The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has successfully processed. If you do not see a success message for several hours, then contact your administrator.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 1129,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-16T11:45:42.9987787+00:00",
    "event_record_id": 1391,
    "correlation": {
      "ActivityID": "{1A907B63-A93F-4756-9C4B-CDD8832FF748}"
    },
    "execution": {
      "process_id": 1616,
      "thread_id": 6188
    },
    "channel": "System",
    "computer": "telemetry-W11-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "SupportInfo1": "1",
    "SupportInfo2": "2266",
    "ProcessingMode": "2",
    "ProcessingTimeInMilliseconds": "16",
    "ErrorCode": "1222",
    "ErrorDescription": "The network is not present or not started. "
  },
  "message": "The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has successfully processed. If you do not see a success message for several hours, then contact your administrator."
}

References #

Microsoft Learn

Event ID 1130: SupportInfo2 failed.

Channel: System

Description

ScriptType failed. GPO Name : GPODisplayName GPO File System Path : GPOFileSystemPath Script Name: GPOScriptCommandString

Message #

%5 failed. 
	GPO Name : %6
	GPO File System Path : %7
	Script Name: %8

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ErrorCode` UInt32
`ErrorDescription` UnicodeString
`ScriptType` UInt32
`GPODisplayName` UnicodeString
`GPOFileSystemPath` UnicodeString
`GPOScriptCommandString` UnicodeString

Event ID 1500: The Group Policy settings for the computer were processed successfully.

Channel: System
Level: Informational
Opcode: Start

Description

The Group Policy settings for the computer were processed successfully. There were no changes detected since the last successful processing of Group Policy.

Message #

The Group Policy settings for the computer were processed successfully. There were no changes detected since the last successful processing of Group Policy.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`DCName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 1500,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:33:21.4898521+00:00",
    "event_record_id": 4565,
    "correlation": {
      "ActivityID": "{4CB8FB96-1506-4D59-85DF-9B915C7A0B40}"
    },
    "execution": {
      "process_id": 1736,
      "thread_id": 6400
    },
    "channel": "System",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SupportInfo1": "1",
    "SupportInfo2": "4214",
    "ProcessingMode": "0",
    "ProcessingTimeInMilliseconds": "156",
    "DCName": "\\\\telemetry-DC-d.cell-d.ludus.domain"
  },
  "message": "The Group Policy settings for the computer were processed successfully. There were no changes detected since the last successful processing of Group Policy."
}

Event ID 1501: The Group Policy settings for the user were processed successfully.

Channel: System
Level: Informational
Opcode: Start

Description

The Group Policy settings for the user were processed successfully. There were no changes detected since the last successful processing of Group Policy.

Message #

The Group Policy settings for the user were processed successfully. There were no changes detected since the last successful processing of Group Policy.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`DCName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 1501,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-28T11:12:52.8111344+00:00",
    "event_record_id": 1856,
    "correlation": {
      "ActivityID": "{8301D29C-202F-48E8-BD0C-278810E5742D}"
    },
    "execution": {
      "process_id": 1376,
      "thread_id": 948
    },
    "channel": "System",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "SupportInfo1": "1",
    "SupportInfo2": "4214",
    "ProcessingMode": "1",
    "ProcessingTimeInMilliseconds": "1672",
    "DCName": "\\\\telemetry-DC-d.cell-d.ludus.domain"
  },
  "message": "The Group Policy settings for the user were processed successfully. There were no changes detected since the last successful processing of Group Policy."
}

Event ID 1502: The Group Policy settings for the computer were processed successfully.

Channel: System
Level: Informational
Opcode: Start

Description

The Group Policy settings for the computer were processed successfully. New settings from NumberOfGroupPolicyObjects Group Policy objects were detected and applied.

Message #

The Group Policy settings for the computer were processed successfully. New settings from %6 Group Policy objects were detected and applied.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`DCName` UnicodeString
`NumberOfGroupPolicyObjects` UInt32	Number of Group Policy objects that were processed

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 1502,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-29T06:21:48.6031327+00:00",
    "event_record_id": 6403,
    "correlation": {
      "ActivityID": "{77469AD0-7D18-41C0-B45D-4A830B44DB6F}"
    },
    "execution": {
      "process_id": 1872,
      "thread_id": 5536
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SupportInfo1": "1",
    "SupportInfo2": "4195",
    "ProcessingMode": "0",
    "ProcessingTimeInMilliseconds": "954",
    "DCName": "\\\\telemetry-DC-a.cell-a.ludus.domain",
    "NumberOfGroupPolicyObjects": "2"
  },
  "message": "The Group Policy settings for the computer were processed successfully. New settings from 2 Group Policy objects were detected and applied."
}

References #

Windows Forensic Artifacts

Event ID 1503: The Group Policy settings for the user were processed successfully.

Channel: System
Level: Informational
Opcode: Start

Description

The Group Policy settings for the user were processed successfully. New settings from NumberOfGroupPolicyObjects Group Policy objects were detected and applied.

Message #

The Group Policy settings for the user were processed successfully. New settings from %6 Group Policy objects were detected and applied.

Fields #

Name	Description
`SupportInfo1` UInt32
`SupportInfo2` UInt32
`ProcessingMode` UInt32
`ProcessingTimeInMilliseconds` UInt32
`DCName` UnicodeString
`NumberOfGroupPolicyObjects` UInt32	Number of Group Policy objects that were processed

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 1503,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T17:34:38.149825+00:00",
    "event_record_id": 1319,
    "correlation": {
      "ActivityID": "DCA9073D-A053-4D86-A71A-A22443FB751F"
    },
    "execution": {
      "process_id": 1352,
      "thread_id": 1684
    },
    "channel": "System",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "SupportInfo1": 1,
    "SupportInfo2": 4195,
    "ProcessingMode": 0,
    "ProcessingTimeInMilliseconds": 671,
    "DCName": "\\\\WIN-FPV0DSIC9O6.lab.local",
    "NumberOfGroupPolicyObjects": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline
Windows Forensic Artifacts

Event ID 4000: Starting computer boot policy processing for PrincipalSamName.

Channel: Operational
Level: Informational
Opcode: Start

Message #

Starting computer boot policy processing for %2. 
Activity id: %1

Fields #

Name	Description
`PolicyActivityId` GUID	Activity id.
`PrincipalSamName` UnicodeString	SAM name of the computer account for which GPO processing was started
`IsMachine` UInt32
`IsDomainJoined` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`IsServiceRestart` Boolean
`ReasonForSyncProcessing` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4000,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:58.0801723+00:00",
    "event_record_id": 31550,
    "correlation": {
      "ActivityID": "{A841B46F-F932-4765-A57F-C992AEC87CA4}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyActivityId": "{a841b46f-f932-4765-a57f-c992aec87ca4}",
    "PrincipalSamName": "cell-c\\TELEMETRY-DC-C$",
    "IsMachine": "1",
    "IsDomainJoined": "true",
    "IsBackgroundProcessing": "false",
    "IsAsyncProcessing": "false",
    "IsServiceRestart": "false",
    "ReasonForSyncProcessing": "5"
  },
  "message": "Starting computer boot policy processing for cell-c\\TELEMETRY-DC-C$. \r\nActivity id: {a841b46f-f932-4765-a57f-c992aec87ca4}"
}

References #

Windows Forensic Artifacts

Event ID 4001: Starting user logon Policy processing for PrincipalSamName.

Channel: Operational
Level: Informational
Opcode: Start

Message #

Starting user logon Policy processing for %2. 
Activity id: %1

Fields #

Name	Description
`PolicyActivityId` GUID	Activity id.
`PrincipalSamName` UnicodeString	SAM name of the user account for which GPO processing was started
`IsMachine` UInt32
`IsDomainJoined` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`IsServiceRestart` Boolean
`ReasonForSyncProcessing` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4001,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:59.5469576+00:00",
    "event_record_id": 31589,
    "correlation": {
      "ActivityID": "{DC96B6CB-CED9-4463-8C28-581ADFFD8E96}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 2780
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyActivityId": "{dc96b6cb-ced9-4463-8c28-581adffd8e96}",
    "PrincipalSamName": "cell-c\\domainadmin",
    "IsMachine": "0",
    "IsDomainJoined": "true",
    "IsBackgroundProcessing": "false",
    "IsAsyncProcessing": "false",
    "IsServiceRestart": "false",
    "ReasonForSyncProcessing": "5"
  },
  "message": "Starting user logon Policy processing for cell-c\\domainadmin. \r\nActivity id: {dc96b6cb-ced9-4463-8c28-581adffd8e96}"
}

References #

Windows Forensic Artifacts

Event ID 4002: Starting policy processing due to network state change for computer PolicyActivityId.

Channel: Operational
Opcode: Start

Message #

Starting policy processing due to network state change for computer %2. 
Activity id: %1

Fields #

Name	Description
`PolicyActivityId` GUID
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsDomainJoined` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`IsServiceRestart` Boolean
`ReasonForSyncProcessing` UInt32

Event ID 4003: Starting policy processing due to network state change for user PolicyActivityId.

Channel: Operational
Opcode: Start

Message #

Starting policy processing due to network state change for user %2. 
Activity id: %1

Fields #

Name	Description
`PolicyActivityId` GUID
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsDomainJoined` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`IsServiceRestart` Boolean
`ReasonForSyncProcessing` UInt32

Event ID 4004: Starting manual processing of policy for computer PrincipalSamName.

Channel: Operational
Level: Informational
Opcode: Start

Message #

Starting manual processing of policy for computer %2. 
Activity id: %1

Fields #

Name	Description
`PolicyActivityId` GUID	Activity id.
`PrincipalSamName` UnicodeString	SAM name of the computer account for which GPO processing was started
`IsMachine` UInt32
`IsDomainJoined` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`IsServiceRestart` Boolean
`ReasonForSyncProcessing` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4004,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T06:52:27.2496306+00:00",
    "event_record_id": 29388,
    "correlation": {
      "ActivityID": "{84ECAB31-F9E8-4B4F-A2FD-465D7AC5C011}"
    },
    "execution": {
      "process_id": 1864,
      "thread_id": 5828
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyActivityId": "{84ecab31-f9e8-4b4f-a2fd-465d7ac5c011}",
    "PrincipalSamName": "cell-c\\TELEMETRY-DC-C$",
    "IsMachine": "1",
    "IsDomainJoined": "true",
    "IsBackgroundProcessing": "true",
    "IsAsyncProcessing": "false",
    "IsServiceRestart": "false",
    "ReasonForSyncProcessing": "0"
  },
  "message": "Starting manual processing of policy for computer cell-c\\TELEMETRY-DC-C$. \r\nActivity id: {84ecab31-f9e8-4b4f-a2fd-465d7ac5c011}"
}

References #

Windows Forensic Artifacts

Event ID 4005: Starting manual processing of policy for user PrincipalSamName.

Channel: Operational
Level: Informational
Opcode: Start

Message #

Starting manual processing of policy for user %2. 
Activity id: %1

Fields #

Name	Description
`PolicyActivityId` GUID	Activity id.
`PrincipalSamName` UnicodeString	SAM name of the user account for which GPO processing was started
`IsMachine` UInt32
`IsDomainJoined` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`IsServiceRestart` Boolean
`ReasonForSyncProcessing` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4005,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:56:40.7919982+00:00",
    "event_record_id": 18255,
    "correlation": {
      "ActivityID": "{805A095A-2906-4A2D-AFAE-826D5D69CA6F}"
    },
    "execution": {
      "process_id": 1904,
      "thread_id": 552
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyActivityId": "{805a095a-2906-4a2d-afae-826d5d69ca6f}",
    "PrincipalSamName": "cell-a\\domainadmin",
    "IsMachine": "0",
    "IsDomainJoined": "true",
    "IsBackgroundProcessing": "true",
    "IsAsyncProcessing": "false",
    "IsServiceRestart": "false",
    "ReasonForSyncProcessing": "0"
  },
  "message": "Starting manual processing of policy for user cell-a\\domainadmin. \r\nActivity id: {805a095a-2906-4a2d-afae-826d5d69ca6f}"
}

References #

Windows Forensic Artifacts

Event ID 4006: Starting periodic policy processing for computer PrincipalSamName.

Channel: Operational
Level: Informational
Opcode: Start

Message #

Starting periodic policy processing for computer %2. 
Activity id: %1

Fields #

Name	Description
`PolicyActivityId` GUID	Activity id.
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsDomainJoined` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`IsServiceRestart` Boolean
`ReasonForSyncProcessing` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4006,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.1640288+00:00",
    "event_record_id": 34982,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyActivityId": "{dbcfe2fb-1977-4351-9d05-5bf8388c112e}",
    "PrincipalSamName": "cell-c\\TELEMETRY-DC-C$",
    "IsMachine": "1",
    "IsDomainJoined": "true",
    "IsBackgroundProcessing": "true",
    "IsAsyncProcessing": "false",
    "IsServiceRestart": "false",
    "ReasonForSyncProcessing": "0"
  },
  "message": "Starting periodic policy processing for computer cell-c\\TELEMETRY-DC-C$. \r\nActivity id: {dbcfe2fb-1977-4351-9d05-5bf8388c112e}"
}

Event ID 4007: Starting periodic policy processing for user PrincipalSamName.

Channel: Operational
Level: Informational
Opcode: Start

Message #

Starting periodic policy processing for user %2. 
Activity id: %1

Fields #

Name	Description
`PolicyActivityId` GUID
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsDomainJoined` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`IsServiceRestart` Boolean
`ReasonForSyncProcessing` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 4007,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-14T01:40:41.526525+00:00",
    "event_record_id": 179683,
    "correlation": {
      "ActivityID": "261F3C8C-5577-42F1-99D9-89D7A88E5B00"
    },
    "execution": {
      "process_id": 1112,
      "thread_id": 6604
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyActivityId": "261F3C8C-5577-42F1-99D9-89D7A88E5B00",
    "PrincipalSamName": "ludus\\domainadmin",
    "IsMachine": 0,
    "IsDomainJoined": true,
    "IsBackgroundProcessing": true,
    "IsAsyncProcessing": false,
    "IsServiceRestart": false,
    "ReasonForSyncProcessing": 0
  },
  "message": ""
}

Event ID 4016: Starting CSEExtensionName Extension Processing.

Channel: Operational
Level: Informational
Opcode: Start

Message #

Starting %2 Extension Processing. 

List of applicable Group Policy objects: (%5)

%6

Fields #

Name	Description
`CSEExtensionId` GUID
`CSEExtensionName` UnicodeString
`IsExtensionAsyncProcessing` Boolean
`IsGPOListChanged` Boolean
`GPOListStatusString` UnicodeString
`DescriptionString` UnicodeString
`ApplicableGPOList` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4016,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T13:39:15.5855300+00:00",
    "event_record_id": 34796,
    "correlation": {
      "ActivityID": "{C2EE9D80-D0BC-4B89-9A29-4D244941B824}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "CSEExtensionId": "{827d319e-6eac-11d2-a4ea-00c04f79f83a}",
    "CSEExtensionName": "Security",
    "IsExtensionAsyncProcessing": "true",
    "IsGPOListChanged": "true",
    "GPOListStatusString": "%%4102",
    "DescriptionString": "Default Domain Policy\nDefault Domain Controllers Policy\n",
    "ApplicableGPOList": "<GPO ID=\"{31B2F340-016D-11D2-945F-00C04FB984F9}\"><Name>Default Domain Policy</Name></GPO><GPO ID=\"{6AC1786C-016F-11D2-945F-00C04fB984F9}\"><Name>Default Domain Controllers Policy</Name></GPO>"
  },
  "message": "Starting Security Extension Processing. \r\n\r\nList of applicable Group Policy objects: (Changes were detected.)\r\n\r\nDefault Domain Policy\nDefault Domain Controllers Policy\n"
}

Event ID 4017: OperationDescription Parameter.

Channel: Operational
Level: Informational

Description

OperationDescription Parameter

Message #

%1 
%2

Fields #

Name	Description
`OperationDescription` UnicodeString
`Parameter` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4017,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3157615+00:00",
    "event_record_id": 35002,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "OperationDescription": "%%4131",
    "Parameter": "\\\\cell-c.ludus.domain\\sysvol\\cell-c.ludus.domain\\Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9}\\gpt.ini"
  },
  "message": "Making system calls to access specified file. \r\n\\\\cell-c.ludus.domain\\sysvol\\cell-c.ludus.domain\\Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9}\\gpt.ini"
}

Event ID 4018: Starting ScriptType for PrincipalSamName.

Channel: Operational
Opcode: Start

Message #

Starting %2 for %1.

Fields #

Name	Description
`PrincipalSamName` UnicodeString
`ScriptType` UInt32
`IsScriptHidden` Boolean
`IsScriptSync` Boolean
`IsScriptMinimized` Boolean
`SessionId` UInt32

Event ID 4019: Running script name ScriptName.

Channel: Operational

Message #

Running script name %1.

Fields #

Name	Description
`ScriptName` UnicodeString
`ScriptFileSystemPath` UnicodeString
`ScriptArguments` UnicodeString

Event ID 4115: Group Policy Service started.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsServiceRestart` Boolean
`IsMachineBoot` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4115,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:22:56.1841189+00:00",
    "event_record_id": 31538,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 1052
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsServiceRestart": "false",
    "IsMachineBoot": "true"
  },
  "message": "Group Policy Service started."
}

Event ID 4116: Started the Group Policy service initialization phase.

Channel: Operational
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4116,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:22:56.1799164+00:00",
    "event_record_id": 31537,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 1052
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Started the Group Policy service initialization phase."
}

Event ID 4117: Group Policy Session started.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4117,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:59.5460185+00:00",
    "event_record_id": 31587,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 2780
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsMachine": "false",
    "IsBackgroundProcessing": "false",
    "IsAsyncProcessing": "false"
  },
  "message": "Group Policy Session started."
}

Event ID 4126: Group Policy receiving applicable GPOs from the domain controller.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4126,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.2842276+00:00",
    "event_record_id": 34997,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsMachine": "true"
  },
  "message": "Group Policy receiving applicable GPOs from the domain controller."
}

Event ID 4216: Starting to save policies to the local datastore.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 4216,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-09T00:48:47.640241+00:00",
    "event_record_id": 5485,
    "correlation": {
      "ActivityID": "9197D599-AFC9-4584-AEA0-64AEB7628F03"
    },
    "execution": {
      "process_id": 2268,
      "thread_id": 8268
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "IsMachine": false
  },
  "message": ""
}

Event ID 4217: Starting to load policies from the local datastore.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean

Event ID 4218: Starting the first WMI query for the policy.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean

Event ID 4257: Starting to download policies.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4257,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.2860369+00:00",
    "event_record_id": 34998,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsMachine": "true",
    "IsBackgroundProcessing": "true",
    "IsAsyncProcessing": "true"
  },
  "message": "Starting to download policies."
}

Event ID 4326: Group Policy is trying to discover the Domain Controller information.

Channel: Operational
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 4326,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.1648966+00:00",
    "event_record_id": 34988,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Group Policy is trying to discover the Domain Controller information."
}

Event ID 5016: Completed CSEExtensionName Extension Processing in CSEElaspedTimeInMilliSeconds milliseconds.

Channel: Operational
Level: Informational
Opcode: Stop

Message #

Completed %3 Extension Processing in %1 milliseconds.

Fields #

Name	Description
`CSEElaspedTimeInMilliSeconds` UInt32
`ErrorCode` UInt32
`CSEExtensionName` UnicodeString
`CSEExtensionId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5016,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T13:39:16.3255249+00:00",
    "event_record_id": 34797,
    "correlation": {
      "ActivityID": "{C2EE9D80-D0BC-4B89-9A29-4D244941B824}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "CSEElaspedTimeInMilliSeconds": "735",
    "ErrorCode": "0",
    "CSEExtensionName": "Security",
    "CSEExtensionId": "{827d319e-6eac-11d2-a4ea-00c04f79f83a}"
  },
  "message": "Completed Security Extension Processing in 735 milliseconds."
}

Event ID 5017: OperationDescription Parameter The call completed in OperationElaspedTimeInMilliSeconds milliseconds.

Channel: Operational
Level: Informational

Description

OperationDescription Parameter The call completed in OperationElaspedTimeInMilliSeconds milliseconds.

Message #

%3 
%4
The call completed in %1 milliseconds.

Fields #

Name	Description
`OperationElaspedTimeInMilliSeconds` UInt32
`ErrorCode` UInt32
`OperationDescription` UnicodeString
`Parameter` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5017,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3186721+00:00",
    "event_record_id": 35003,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "OperationElaspedTimeInMilliSeconds": "0",
    "ErrorCode": "0",
    "OperationDescription": "%%4132",
    "Parameter": "\\\\cell-c.ludus.domain\\sysvol\\cell-c.ludus.domain\\Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9}\\gpt.ini"
  },
  "message": "The system calls to access specified file completed. \r\n\\\\cell-c.ludus.domain\\sysvol\\cell-c.ludus.domain\\Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9}\\gpt.ini\r\nThe call completed in 0 milliseconds."
}

Event ID 5018: Completed ScriptType for PrincipalSamName in ScriptElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Completed %4 for %3 in %1 seconds.

Fields #

Name	Description
`ScriptElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`ScriptType` UInt32

Event ID 5019: Completed ScriptName in ScriptElaspedTimeInSeconds seconds.

Channel: Operational

Message #

Completed %3 in %1 seconds.

Fields #

Name	Description
`ScriptElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`ScriptName` UnicodeString

Event ID 5115: Group Policy Service stopped.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsServiceRestart` Boolean
`IsMachineBoot` Boolean
`GpsvcTimeElapsedInMilliseconds` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5115,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:22:33.9370914+00:00",
    "event_record_id": 31536,
    "correlation": {},
    "execution": {
      "process_id": 1784,
      "thread_id": 1104
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsServiceRestart": "false",
    "IsMachineBoot": "true",
    "GpsvcTimeElapsedInMilliseconds": "6010359"
  },
  "message": "Group Policy Service stopped."
}

Event ID 5116: Successfully completed the Group Policy Service initialization phase.

Channel: Operational
Level: Informational

Fields #

Name	Description
`GpsvcInitTimeElapsedInMilliseconds` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5116,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:22:56.1891837+00:00",
    "event_record_id": 31539,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 2064
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "GpsvcInitTimeElapsedInMilliseconds": "16"
  },
  "message": "Successfully completed the Group Policy Service initialization phase."
}

Event ID 5117: Group policy session completed successfully.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean
`SessionTimeElapsedInMilliseconds` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5117,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:59.6975593+00:00",
    "event_record_id": 31616,
    "correlation": {
      "ActivityID": "{DC96B6CB-CED9-4463-8C28-581ADFFD8E96}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 2780
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsMachine": "false",
    "SessionTimeElapsedInMilliseconds": "156"
  },
  "message": "Group policy session completed successfully."
}

Event ID 5126: Group Policy successfully got applicable GPOs from the domain controller.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean
`IsBackgroundProcessing` Boolean
`IsAsyncProcessing` Boolean
`NumberOfGPOsDownloaded` UInt32
`NumberOfGPOsApplicable` UInt32
`GPODownloadTimeElapsedInMilliseconds` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5126,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3190717+00:00",
    "event_record_id": 35005,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsMachine": "true",
    "IsBackgroundProcessing": "true",
    "IsAsyncProcessing": "false",
    "NumberOfGPOsDownloaded": "2",
    "NumberOfGPOsApplicable": "0",
    "GPODownloadTimeElapsedInMilliseconds": "31"
  },
  "message": "Group Policy successfully got applicable GPOs from the domain controller."
}

References #

Ultimate Windows Security

Event ID 5216: Successfully saved policies to the local datastore.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean
`SaveToCacheTimeElapsedInMilliseconds` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 5216,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-09T00:48:47.649684+00:00",
    "event_record_id": 5486,
    "correlation": {
      "ActivityID": "9197D599-AFC9-4584-AEA0-64AEB7628F03"
    },
    "execution": {
      "process_id": 2268,
      "thread_id": 8268
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "IsMachine": false,
    "SaveToCacheTimeElapsedInMilliseconds": 16
  },
  "message": ""
}

Event ID 5217: Successfully loaded policies from the local datastore.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`LoadFromCacheTimeElapsedInMilliseconds` UInt32

Event ID 5218: Successfully completed the first WMI query.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`FirstWmiQueryTimeElapsedInMilliseconds` UInt32

Event ID 5257: Successfully completed downloading policies.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean
`PolicyDownloadTimeElapsedInMilliseconds` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5257,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3187075+00:00",
    "event_record_id": 35004,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsMachine": "true",
    "PolicyDownloadTimeElapsedInMilliseconds": "31"
  },
  "message": "Successfully completed downloading policies."
}

Event ID 5308: Domain Controller details.

Channel: Operational
Level: Informational

Message #

Domain Controller details: 
	Domain Controller Name : %1
	Domain Controller IP Address : %2

Fields #

Name	Description
`DCName` UnicodeString	[Domain Controller details] Domain Controller Name.
`DCIPAddress` UnicodeString	[Domain Controller details] Domain Controller IP Address.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5308,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.2783668+00:00",
    "event_record_id": 34992,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DCName": "telemetry-DC-c.cell-c.ludus.domain",
    "DCIPAddress": "10.1.40.11"
  },
  "message": "Domain Controller details: \r\n\tDomain Controller Name : telemetry-DC-c.cell-c.ludus.domain\r\n\tDomain Controller IP Address : 10.1.40.11"
}

Event ID 5309: Computer details.

Channel: Operational
Level: Informational

Message #

Computer details: 
	Computer role : %1
	Network name : %2

Fields #

Name	Description
`MachineRole` UInt32	[Computer details] Computer role.
`NetworkName` UnicodeString	[Computer details] Network name.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5309,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.2788342+00:00",
    "event_record_id": 34994,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "MachineRole": "3",
    "NetworkName": "<none>"
  },
  "message": "Computer details: \r\n\tComputer role : 3\r\n\tNetwork name : <none>"
}

Event ID 5310: Account details.

Channel: Operational
Level: Informational

Message #

Account details: 
	Account Name : %1
	Account Domain Name : %2
	DC Name : %3
	DC Domain Name : %4

Fields #

Name	Description
`PrincipalCNName` UnicodeString	[Account details] Account Name.
`PrincipalDomainName` UnicodeString	[Account details] Account Domain Name.
`DCName` UnicodeString	[Account details] DC Name.
`DCDomainName` UnicodeString	[Account details] DC Domain Name.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5310,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.2788360+00:00",
    "event_record_id": 34995,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PrincipalCNName": "CN=TELEMETRY-DC-C,OU=Domain Controllers,DC=cell-c,DC=ludus,DC=domain",
    "PrincipalDomainName": "cell-c.ludus.domain",
    "DCName": "\\\\telemetry-DC-c.cell-c.ludus.domain",
    "DCDomainName": "cell-c.ludus.domain"
  },
  "message": "Account details: \r\n\tAccount Name : CN=TELEMETRY-DC-C,OU=Domain Controllers,DC=cell-c,DC=ludus,DC=domain\r\n\tAccount Domain Name : cell-c.ludus.domain\r\n\tDC Name : \\\\telemetry-DC-c.cell-c.ludus.domain\r\n\tDC Domain Name : cell-c.ludus.domain"
}

Event ID 5311: The loopback policy processing mode is PolicyProcessingMode.

Channel: Operational
Level: Informational

Message #

The loopback policy processing mode is %1.

Fields #

Name	Description
`PolicyProcessingMode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5311,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.2842257+00:00",
    "event_record_id": 34996,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyProcessingMode": "0"
  },
  "message": "The loopback policy processing mode is \"No loopback mode\"."
}

Event ID 5312: List of applicable Group Policy objects.

Channel: Operational
Level: Informational

Message #

List of applicable Group Policy objects: 

%1

Fields #

Name	Description
`DescriptionString` UnicodeString	List of applicable Group Policy objects
`GPOInfoList` UnicodeString	XML string containing information about the applicable Group Policy objects

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5312,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3194250+00:00",
    "event_record_id": 35006,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DescriptionString": "Default Domain Policy\nDefault Domain Controllers Policy\n",
    "GPOInfoList": "<GPO ID=\"{31B2F340-016D-11D2-945F-00C04FB984F9}\"><Name>Default Domain Policy</Name><Version>262148</Version><SOM>LDAP://DC=cell-c,DC=ludus,DC=domain</SOM><FSPath>\\\\cell-c.ludus.domain\\sysvol\\cell-c.ludus.domain\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\Machine</FSPath><Extensions>[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]</Extensions></GPO><GPO ID=\"{6AC1786C-016F-11D2-945F-00C04fB984F9}\"><Name>Default Domain Controllers Policy</Name><Version>196611</Version><SOM>LDAP://OU=Domain Controllers,DC=cell-c,DC=ludus,DC=domain</SOM><FSPath>\\\\cell-c.ludus.domain\\sysvol\\cell-c.ludus.domain\\Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9}\\Machine</FSPath><Extensions>[{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}]</Extensions></GPO>"
  },
  "message": "List of applicable Group Policy objects: \r\n\r\nDefault Domain Policy\nDefault Domain Controllers Policy\n"
}

References #

Windows Forensic Artifacts

Event ID 5313: The following Group Policy objects were not applicable because they were filtered out.

Channel: Operational
Level: Informational

Message #

The following Group Policy objects were not applicable because they were filtered out : 

%1

Fields #

Name	Description
`DescriptionString` UnicodeString	The following Group Policy objects were not applicable because they were filtered out
`GPOInfoList` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5313,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3194566+00:00",
    "event_record_id": 35007,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DescriptionString": "Local Group Policy\n\tNot Applied (Empty)\n",
    "GPOInfoList": "<GPO ID=\"Local Group Policy\"><Name>Local Group Policy</Name><Version>0</Version><SOM>Local</SOM><FSPath>C:\\Windows\\System32\\GroupPolicy\\Machine</FSPath><Reason>NOTAPPLIED-EMPTY</Reason></GPO>"
  },
  "message": "The following Group Policy objects were not applicable because they were filtered out : \r\n\r\nLocal Group Policy\n\tNot Applied (Empty)\n"
}

Event ID 5314: A LinkDescription link was detected.

Channel: Operational
Level: Informational

Description

A LinkDescription link was detected. The Estimated bandwidth is BandwidthInkbps kbps. The slow link threshold is ThresholdInkbps kbps.

Message #

A %6 link was detected. The Estimated bandwidth is %1 kbps. The slow link threshold is %3 kbps.

Fields #

Name	Description
`BandwidthInkbps` UInt32
`IsSlowLink` Boolean
`ThresholdInkbps` UInt32
`PolicyApplicationMode` UInt32
`ErrorCode` UInt32
`LinkDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "event_id": 5314,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:17:04.9396956+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-GroupPolicy"
  },
  "event_data": {
    "PolicyApplicationMode": "0",
    "ErrorCode": "0",
    "ThresholdInkbps": "500",
    "LinkDescription": "%%4113",
    "IsSlowLink": "false",
    "BandwidthInkbps": "1410065"
  }
}

Event ID 5315: Next policy processing for PrincipalSamName will be attempted in NextPolicyApplicationTime NextPolicyApplicationTimeUnit.

Channel: Operational
Level: Informational

Message #

Next policy processing for %1 will be attempted in %2 %3.

Fields #

Name	Description
`PrincipalSamName` UnicodeString
`NextPolicyApplicationTime` UInt32
`NextPolicyApplicationTimeUnit` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5315,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3334593+00:00",
    "event_record_id": 35012,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PrincipalSamName": "cell-c\\TELEMETRY-DC-C$",
    "NextPolicyApplicationTime": "5",
    "NextPolicyApplicationTimeUnit": "%%4100"
  },
  "message": "Next policy processing for cell-c\\TELEMETRY-DC-C$ will be attempted in 5 minutes."
}

Event ID 5320: InfoDescription.

Channel: Operational
Level: Informational

Message #

%1

Fields #

Name	Description
`InfoDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5320,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3235606+00:00",
    "event_record_id": 35010,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InfoDescription": "%%4165"
  },
  "message": "Finished checking for non-system extensions."
}

Event ID 5321: InfoDescription Parameter: OperationParameter1.

Channel: Operational
Level: Informational

Message #

%1 Parameter: %2

Fields #

Name	Description
`InfoDescription` UnicodeString
`OperationParameter1` UnicodeString	1 Parameter.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5321,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:22:56.2755729+00:00",
    "event_record_id": 31543,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 2064
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InfoDescription": "%%4167",
    "OperationParameter1": "ea290edc-1514-4f09-bb35-db08da390e9d"
  },
  "message": "A previous instance of the Group Policy Client Service was detected. Parameter: ea290edc-1514-4f09-bb35-db08da390e9d"
}

Event ID 5322: Group Policy waited for TimeWaitedAtStartup milliseconds for the network subsystem at computer boot.

Channel: Operational
Level: Informational

Message #

Group Policy waited for %3 milliseconds for the network subsystem at computer boot.

Fields #

Name	Description
`IsPolicyConfigured` Boolean
`MaxTimeToWait` UInt32
`TimeWaitedAtStartup` UInt32
`PrevAvgWaitTimeout` UInt32
`NewAvgWaitTimeout` UInt32
`DidWaitTimeout` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5322,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:58.0799894+00:00",
    "event_record_id": 31549,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsPolicyConfigured": "false",
    "MaxTimeToWait": "120000",
    "TimeWaitedAtStartup": "61562",
    "PrevAvgWaitTimeout": "60000",
    "NewAvgWaitTimeout": "60000",
    "DidWaitTimeout": "true"
  },
  "message": "Group Policy waited for 61562 milliseconds for the network subsystem at computer boot."
}

Event ID 5323: Invalid Error Message.

Channel: Operational

Event ID 5324: Group Policy received the notification NotificationType from Winlogon for session SessionId.

Channel: Operational
Level: Informational

Message #

Group Policy received the notification %1 from Winlogon for session %2.

Fields #

Name	Description
`NotificationType` UInt32
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5324,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:24:00.1241944+00:00",
    "event_record_id": 31619,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 2064
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NotificationType": "3",
    "SessionId": "1"
  },
  "message": "Group Policy received the notification StartShell from Winlogon for session 1."
}

Event ID 5325: Group Policy received NotificationType notification from Service Control Manager.

Channel: Operational
Level: Informational

Message #

Group Policy received %1 notification from Service Control Manager.

Fields #

Name	Description
`NotificationType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5325,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:22:33.9368217+00:00",
    "event_record_id": 31535,
    "correlation": {},
    "execution": {
      "process_id": 1784,
      "thread_id": 1788
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NotificationType": "0"
  },
  "message": "Group Policy received Preshutdown notification from Service Control Manager."
}

Event ID 5326: Group Policy successfully discovered the Domain Controller in DCDiscoveryTimeInMilliSeconds milliseconds.

Channel: Operational
Level: Informational

Message #

Group Policy successfully discovered the Domain Controller in %1 milliseconds.

Fields #

Name	Description
`DCDiscoveryTimeInMilliSeconds` UInt32
`ErrorCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5326,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.2783694+00:00",
    "event_record_id": 34993,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DCDiscoveryTimeInMilliSeconds": "110",
    "ErrorCode": "0"
  },
  "message": "Group Policy successfully discovered the Domain Controller in 110 milliseconds."
}

Event ID 5327: Estimated network bandwidth on one of the connections: NetworkBandwidthInKbps kbps.

Channel: Operational
Level: Informational

Message #

Estimated network bandwidth on one of the connections: %1 kbps.

Fields #

Name	Description
`NetworkBandwidthInKbps` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "event_id": 5327,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:17:04.9371831+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-GroupPolicy"
  },
  "event_data": {
    "NetworkBandwidthInKbps": "1250000000"
  }
}

Event ID 5331: Service configuration update to standalone was attempted due to the presence of Group Policy client extension UpdateCauseExtensionName that is not part of the operating ...

Channel: Operational
Level: Informational

Description

Service configuration update to standalone was attempted due to the presence of Group Policy client extension UpdateCauseExtensionName that is not part of the operating system and completed with status ErrorCode.

Message #

Service configuration update to standalone was attempted due to the presence of Group Policy client extension %1 that is not part of the operating system and completed with status %3.

Fields #

Name	Description
`UpdateCauseExtensionName` UnicodeString
`UpdateCauseExtensionId` UnicodeString
`ErrorCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "event_id": 5331,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T00:27:32.8630314+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-GroupPolicy"
  },
  "event_data": {
    "ErrorCode": "0",
    "UpdateCauseExtensionId": "{9F02E2F5-5A41-4D1A-B473-4617E84BC957}",
    "UpdateCauseExtensionName": "Windows Protected Print Policy"
  }
}

Event ID 5332: Group Policy waited for TimeWaitedAtStartup milliseconds for the Direct Access CorpNet connectivity at computer boot.

Channel: Operational

Message #

Group Policy waited for %3 milliseconds for the Direct Access CorpNet connectivity at computer boot.

Fields #

Name	Description
`IsPolicyConfigured` Boolean
`MaxTimeToWait` UInt32
`TimeWaitedAtStartup` UInt32
`DidWaitTimeout` Boolean

Event ID 5340: The Group Policy processing mode is PolicyApplicationMode.

Channel: Operational
Level: Informational

Message #

The Group Policy processing mode is %1.

Fields #

Name	Description
`PolicyApplicationMode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5340,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.1643929+00:00",
    "event_record_id": 34983,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyApplicationMode": "0"
  },
  "message": "The Group Policy processing mode is Background."
}

Event ID 5351: Group policy session returned to winlogon.

Channel: Operational
Level: Informational

Fields #

Name	Description
`IsMachine` Boolean
`WinlogonReturnTimeElapsedInMilliseconds` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 5351,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:59.6975731+00:00",
    "event_record_id": 31618,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 2064
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsMachine": "false",
    "WinlogonReturnTimeElapsedInMilliseconds": "156"
  },
  "message": "Group policy session returned to winlogon."
}

Event ID 6000: Invalid Error Message.

Channel: Operational

Event ID 6001: Invalid Error Message.

Channel: Operational

Event ID 6002: Invalid Error Message.

Channel: Operational

Event ID 6003: Invalid Error Message.

Channel: Operational

Event ID 6004: Invalid Error Message.

Channel: Operational

Event ID 6005: Invalid Error Message.

Channel: Operational

Event ID 6006: Invalid Error Message.

Channel: Operational

Event ID 6007: Invalid Error Message.

Channel: Operational

Event ID 6016: Completed CSEExtensionName Extension Processing in CSEElaspedTimeInMilliSeconds milliseconds.

Channel: Operational
Opcode: Stop

Message #

Completed %3 Extension Processing in %1 milliseconds.

Fields #

Name	Description
`CSEElaspedTimeInMilliSeconds` UInt32
`ErrorCode` UInt32
`CSEExtensionName` UnicodeString
`CSEExtensionId` GUID

Event ID 6017: Invalid Error Message.

Channel: Operational

Event ID 6018: Invalid Error Message.

Channel: Operational

Event ID 6019: Invalid Error Message.

Channel: Operational

Event ID 6033: Skipped CSEExtensionName Extension based on Group Policy client-side processing rules.

Channel: Operational
Opcode: Stop

Description

Skipped CSEExtensionName Extension based on Group Policy client-side processing rules. Refer to a Resultant Set of Policy report for more information.

Message #

Skipped %1 Extension based on Group Policy client-side processing rules.  Refer to a Resultant Set of Policy report for more information.

Fields #

Name	Description
`CSEExtensionName` UnicodeString
`CSEExtensionID` UnicodeString

Event ID 6034: Group Policy changed from synchronous foreground to asynchronous foreground based on slow link detection.

Channel: Operational

Event ID 6035: CSEExtensionName Extension deferred processing until next synchronous foreground.

Channel: Operational
Opcode: Stop

Description

CSEExtensionName Extension deferred processing until next synchronous foreground. Refer to a Resultant Set of Policy report for more information.

Message #

%1 Extension deferred processing until next synchronous foreground.  Refer to a Resultant Set of Policy report for more information.

Fields #

Name	Description
`CSEExtensionName` UnicodeString
`CSEExtensionID` UnicodeString

Event ID 6226: Invalid Error Message.

Channel: Operational

Event ID 6308: Invalid Error Message.

Channel: Operational

Event ID 6309: Invalid Error Message.

Channel: Operational

Event ID 6310: Invalid Error Message.

Channel: Operational

Event ID 6311: Invalid Error Message.

Channel: Operational

Event ID 6312: Invalid Error Message.

Channel: Operational

Event ID 6313: Invalid Error Message.

Channel: Operational

Event ID 6314: Group Policy bandwidth estimation failed.

Channel: Operational
Level: Warning

Description

Group Policy bandwidth estimation failed. Group Policy processing will continue. Assuming LinkDescription link.

Message #

Group Policy bandwidth estimation failed. Group Policy processing will continue. Assuming %6 link.

Fields #

Name	Description
`BandwidthInkbps` UInt32
`IsSlowLink` Boolean
`ThresholdInkbps` UInt32
`PolicyApplicationMode` UInt32
`ErrorCode` UInt32
`LinkDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 6314,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3054336+00:00",
    "event_record_id": 34999,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BandwidthInkbps": "0",
    "IsSlowLink": "false",
    "ThresholdInkbps": "500",
    "PolicyApplicationMode": "0",
    "ErrorCode": "1",
    "LinkDescription": "%%4113"
  },
  "message": "Group Policy bandwidth estimation failed. Group Policy processing will continue. Assuming fast link."
}

Event ID 6315: Invalid Error Message.

Channel: Operational

Event ID 6320: Warning: Warning Warning code WarningDescription.

Channel: Operational

Message #

Warning: %1 Warning code %2.

Fields #

Name	Description
`WarningDescription` UnicodeString
`WarningCode` UInt32

Event ID 6321: Warning: Warning Parameter: WarningDescription : Warning code Parameter.

Channel: Operational

Message #

Warning: %1 Parameter: %3 : Warning code %2.

Fields #

Name	Description
`WarningDescription` UnicodeString
`WarningCode` UInt32
`OperationParameter1` UnicodeString

Event ID 6322: Invalid Error Message.

Channel: Operational

Event ID 6323: Group Policy dependency (DisplayName) did not start.

Channel: Operational

Description

Group Policy dependency (DisplayName) did not start. As a result, network related features of Group Policy such as bandwidth estimation and response to network changes will not work.

Message #

Group Policy dependency (%1) did not start. As a result, network related features of Group Policy such as bandwidth estimation and response to network changes will not work.

Fields #

Name	Description
`DisplayName` UnicodeString

Event ID 6324: Invalid Error Message.

Channel: Operational

Event ID 6325: Invalid Error Message.

Channel: Operational

Event ID 6326: Invalid Error Message.

Channel: Operational

Event ID 6327: Invalid Error Message.

Channel: Operational

Event ID 6330: An unfinished invocation of the Group Policy Client Side Extension InfoDescription from a previous instance of the Group Policy Service was detected.

Channel: Operational

Description

An unfinished invocation of the Group Policy Client Side Extension InfoDescription from a previous instance of the Group Policy Service was detected. This may indicate that the extension caused the Group Policy Client Service to terminate unexpectedly.

Message #

An unfinished invocation of the Group Policy Client Side Extension %1 from a previous instance of the Group Policy Service was detected.  This may indicate that the extension caused the Group Policy Client Service to terminate unexpectedly.

Fields #

Name	Description
`InfoDescription` UnicodeString
`OperationParameter1` UnicodeString

Event ID 6331: Invalid Error Message.

Channel: Operational

Fields #

Name	Description
`UpdateCauseExtensionName` UnicodeString
`UpdateCauseExtensionId` UnicodeString
`ErrorCode` UInt32

Event ID 6332: Invalid Error Message.

Channel: Operational

Event ID 6337: Group Policy network connection is via Direct Access.

Channel: Operational

Event ID 6338: Group Policy Winlogon status reporting has completed.

Channel: Operational
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 6338,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:59.6975701+00:00",
    "event_record_id": 31617,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 2064
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Group Policy Winlogon status reporting has completed."
}

Event ID 6339: Group Policy Winlogon Start Shell handling completed.

Channel: Operational
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 6339,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:24:00.1243494+00:00",
    "event_record_id": 31620,
    "correlation": {},
    "execution": {
      "process_id": 1980,
      "thread_id": 2064
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "Group Policy Winlogon Start Shell handling completed."
}

Event ID 6341: A Group Policy setting was used to override the fast/slow link detection.

Channel: Operational

Event ID 6342: The network connection is using a WWAN device for connectivity.

Channel: Operational

Event ID 6344: Group Policy detected a slow link during sync mode processing.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`SlowlinkThresholdInMilliseconds` UInt32
`DcResponseTimeInMilliseconds` UInt32

Event ID 6345: The connection to DC timed out during the Group Policy sync mode process.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`DcResponseTimeInMilliseconds` UInt32

Event ID 6346: Group Policy switched the sync mode process to async mode.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`CSEExtensionName` UnicodeString
`CSEExtensionID` GUID

Event ID 7000: Computer boot policy processing failed for PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Computer boot policy processing failed for %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 7001: User logon policy processing failed for PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

User logon policy processing failed for %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 7002: Policy processing due to network state change failed for computer PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Policy processing due to network state change failed for computer %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 7003: Policy processing due to network state change failed for user PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Policy processing due to network state change failed for user %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 7004: Manual processing of policy failed for computer PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Manual processing of policy failed for computer %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 7005: Manual processing of policy failed for user PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Manual processing of policy failed for user %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 7006: Periodic policy processing failed for computer PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Periodic policy processing failed for computer %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 7007: Periodic policy processing failed for user PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Periodic policy processing failed for user %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 7016: Completed CSEExtensionName Extension Processing in CSEElaspedTimeInMilliSeconds milliseconds.

Channel: Operational
Level: Error
Opcode: Stop

Message #

Completed %3 Extension Processing in %1 milliseconds.

Fields #

Name	Description
`CSEElaspedTimeInMilliSeconds` UInt32
`ErrorCode` UInt32
`CSEExtensionName` UnicodeString
`CSEExtensionId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 7016,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-08-01T01:03:26.333250+00:00",
    "event_record_id": 568920,
    "correlation": {
      "ActivityID": "E41CED89-5F44-40D9-9830-808813EBDC16"
    },
    "execution": {
      "process_id": 2496,
      "thread_id": 3344
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "CSEElaspedTimeInMilliSeconds": 31,
    "ErrorCode": 1252,
    "CSEExtensionName": "Security",
    "CSEExtensionId": "827D319E-6EAC-11D2-A4EA-00C04F79F83A"
  },
  "message": ""
}

Event ID 7017: OperationDescription Parameter The call failed after OperationElaspedTimeInMilliSeconds milliseconds.

Channel: Operational
Level: Error

Description

OperationDescription Parameter The call failed after OperationElaspedTimeInMilliSeconds milliseconds.

Message #

%3 
%4
The call failed after %1 milliseconds.

Fields #

Name	Description
`OperationElaspedTimeInMilliSeconds` UInt32
`ErrorCode` UInt32
`OperationDescription` UnicodeString
`Parameter` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 7017,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2022-04-07T16:59:24.588821+00:00",
    "event_record_id": 562,
    "correlation": {
      "ActivityID": "178B5CEF-A5EC-4DF9-951A-EF713A1FE2F6"
    },
    "execution": {
      "process_id": 1352,
      "thread_id": 4040
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "OperationElaspedTimeInMilliSeconds": 2000,
    "ErrorCode": 58,
    "OperationDescription": "%%4120",
    "Parameter": "WIN-FPV0DSIC9O6.lab.local"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 7018: Script for PrincipalSamName failed in ScriptElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Script for %3 failed in %1 seconds.

Fields #

Name	Description
`ScriptElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`ScriptType` UInt32

Event ID 7019: Invalid Error Message.

Channel: Operational

Event ID 7117: Group policy session completed with error.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`ErrorCode` UInt32
`SessionTimeElapsedInMilliseconds` UInt32

Event ID 7126: Group Policy could not get applicable GPOs from the domain controller.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`ErrorCode` UInt32
`GPODownloadTimeElapsedInMilliseconds` UInt32

Event ID 7216: Saved policies to the local datastore with error.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`ErrorCode` UInt32
`SessionTimeElapsedInMilliseconds` UInt32

Event ID 7217: Loaded policies from the local datastore with error.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`ErrorCode` UInt32
`LoadFromCacheTimeElapsedInMilliseconds` UInt32

Event ID 7257: Downloaded policies with error.

Channel: Operational

Fields #

Name	Description
`IsMachine` Boolean
`ErrorCode` UInt32
`PolicyDownloadTimeElapsedInMilliseconds` UInt32

Event ID 7308: Invalid Error Message.

Channel: Operational

Event ID 7309: Invalid Error Message.

Channel: Operational

Event ID 7310: Invalid Error Message.

Channel: Operational

Event ID 7311: Invalid Error Message.

Channel: Operational

Event ID 7312: Invalid Error Message.

Channel: Operational

Event ID 7313: Invalid Error Message.

Channel: Operational

Event ID 7314: Invalid Error Message.

Channel: Operational

Event ID 7315: Invalid Error Message.

Channel: Operational

Event ID 7320: Error: ErrorDescription Error code ErrorCode.

Channel: Operational
Level: Error

Message #

Error: %1 Error code %2.

Fields #

Name	Description
`ErrorDescription` UnicodeString	Error.
`ErrorCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 7320,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2022-04-07T16:59:24.590503+00:00",
    "event_record_id": 564,
    "correlation": {
      "ActivityID": "178B5CEF-A5EC-4DF9-951A-EF713A1FE2F6"
    },
    "execution": {
      "process_id": 1352,
      "thread_id": 4040
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ErrorDescription": "%%4125",
    "ErrorCode": 50
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 7321: Error: Error Parameter: ErrorDescription : Error code Parameter.

Channel: Operational

Message #

Error: %1 Parameter: %3 : Error code %2.

Fields #

Name	Description
`ErrorDescription` UnicodeString
`ErrorCode` UInt32
`OperationParameter1` UnicodeString

Event ID 7322: Invalid Error Message.

Channel: Operational

Event ID 7323: Invalid Error Message.

Channel: Operational

Event ID 7324: Invalid Error Message.

Channel: Operational

Event ID 7325: Invalid Error Message.

Channel: Operational

Event ID 7326: Group Policy failed to discover the Domain Controller details in DCDiscoveryTimeInMilliSeconds milliseconds.

Channel: Operational
Level: Error

Message #

Group Policy failed to discover the Domain Controller details in %1 milliseconds.

Fields #

Name	Description
`DCDiscoveryTimeInMilliSeconds` UInt32
`ErrorCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 7326,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2022-04-07T16:59:24.588837+00:00",
    "event_record_id": 563,
    "correlation": {
      "ActivityID": "178B5CEF-A5EC-4DF9-951A-EF713A1FE2F6"
    },
    "execution": {
      "process_id": 1352,
      "thread_id": 4040
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DCDiscoveryTimeInMilliSeconds": 4000,
    "ErrorCode": 58
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 7327: Invalid Error Message.

Channel: Operational

Event ID 7331: Service configuration update to standalone was attempted due to the presence of Group Policy client extension UpdateCauseExtensionName that is not part of the operating ...

Channel: Operational

Description

Message #

Service configuration update to standalone was attempted due to the presence of Group Policy client extension %1 that is not part of the operating system and completed with status %3.

Fields #

Name	Description
`UpdateCauseExtensionName` UnicodeString
`UpdateCauseExtensionId` UnicodeString
`ErrorCode` UInt32

Event ID 7332: Invalid Error Message.

Channel: Operational

Event ID 8000: Completed computer boot policy processing for PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Level: Informational
Opcode: Stop

Message #

Completed computer boot policy processing for %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 8000,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:58.2937079+00:00",
    "event_record_id": 31579,
    "correlation": {
      "ActivityID": "{A841B46F-F932-4765-A57F-C992AEC87CA4}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyElaspedTimeInSeconds": "0",
    "ErrorCode": "0",
    "PrincipalSamName": "cell-c\\TELEMETRY-DC-C$",
    "IsMachine": "1",
    "IsConnectivityFailure": "false"
  },
  "message": "Completed computer boot policy processing for cell-c\\TELEMETRY-DC-C$ in 0 seconds."
}

Event ID 8001: Completed user logon policy processing for PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Level: Informational
Opcode: Stop

Message #

Completed user logon policy processing for %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 8001,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:23:59.6973726+00:00",
    "event_record_id": 31614,
    "correlation": {
      "ActivityID": "{DC96B6CB-CED9-4463-8C28-581ADFFD8E96}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 2780
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyElaspedTimeInSeconds": "0",
    "ErrorCode": "0",
    "PrincipalSamName": "cell-c\\domainadmin",
    "IsMachine": "0",
    "IsConnectivityFailure": "false"
  },
  "message": "Completed user logon policy processing for cell-c\\domainadmin in 0 seconds."
}

Event ID 8002: Completed policy processing due to network state change for computer PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Completed policy processing due to network state change for computer %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 8003: Completed policy processing due to network state change for user PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Opcode: Stop

Message #

Completed policy processing due to network state change for user %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Event ID 8004: Completed manual processing of policy for computer PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Level: Informational
Opcode: Stop

Message #

Completed manual processing of policy for computer %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 8004,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T06:52:28.2740150+00:00",
    "event_record_id": 29421,
    "correlation": {
      "ActivityID": "{84ECAB31-F9E8-4B4F-A2FD-465D7AC5C011}"
    },
    "execution": {
      "process_id": 1864,
      "thread_id": 5828
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyElaspedTimeInSeconds": "1",
    "ErrorCode": "0",
    "PrincipalSamName": "cell-c\\TELEMETRY-DC-C$",
    "IsMachine": "1",
    "IsConnectivityFailure": "false"
  },
  "message": "Completed manual processing of policy for computer cell-c\\TELEMETRY-DC-C$ in 1 seconds."
}

Event ID 8005: Completed manual processing of policy for user PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Level: Informational
Opcode: Stop

Message #

Completed manual processing of policy for user %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 8005,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:56:41.0294444+00:00",
    "event_record_id": 18280,
    "correlation": {
      "ActivityID": "{805A095A-2906-4A2D-AFAE-826D5D69CA6F}"
    },
    "execution": {
      "process_id": 1904,
      "thread_id": 552
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyElaspedTimeInSeconds": "0",
    "ErrorCode": "0",
    "PrincipalSamName": "cell-a\\domainadmin",
    "IsMachine": "0",
    "IsConnectivityFailure": "false"
  },
  "message": "Completed manual processing of policy for user cell-a\\domainadmin in 0 seconds."
}

Event ID 8006: Completed periodic policy processing for computer PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Level: Informational
Opcode: Stop

Message #

Completed periodic policy processing for computer %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}",
    "event_source_name": "",
    "event_id": 8006,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T14:09:17.3269334+00:00",
    "event_record_id": 35011,
    "correlation": {
      "ActivityID": "{DBCFE2FB-1977-4351-9D05-5BF8388C112E}"
    },
    "execution": {
      "process_id": 1980,
      "thread_id": 1816
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyElaspedTimeInSeconds": "0",
    "ErrorCode": "0",
    "PrincipalSamName": "cell-c\\TELEMETRY-DC-C$",
    "IsMachine": "1",
    "IsConnectivityFailure": "false"
  },
  "message": "Completed periodic policy processing for computer cell-c\\TELEMETRY-DC-C$ in 0 seconds."
}

Event ID 8007: Completed periodic policy processing for user PrincipalSamName in PolicyElaspedTimeInSeconds seconds.

Channel: Operational
Level: Informational
Opcode: Stop

Message #

Completed periodic policy processing for user %3 in %1 seconds.

Fields #

Name	Description
`PolicyElaspedTimeInSeconds` UInt32
`ErrorCode` UInt32
`PrincipalSamName` UnicodeString
`IsMachine` UInt32
`IsConnectivityFailure` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "guid": "AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9",
    "event_source_name": "",
    "event_id": 8007,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-14T01:40:41.669270+00:00",
    "event_record_id": 179708,
    "correlation": {
      "ActivityID": "261F3C8C-5577-42F1-99D9-89D7A88E5B00"
    },
    "execution": {
      "process_id": 1112,
      "thread_id": 6604
    },
    "channel": "Microsoft-Windows-GroupPolicy/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PolicyElaspedTimeInSeconds": 0,
    "ErrorCode": 0,
    "PrincipalSamName": "ludus\\domainadmin",
    "IsMachine": 0,
    "IsConnectivityFailure": false
  },
  "message": ""
}

Event ID 8016: CSEExtensionName Extension (CSEExtensionId) requests a sync mode process.

Channel: Operational

Message #

%1 Extension (%2) requests a sync mode process.

Fields #

Name	Description
`CSEExtensionName` UnicodeString
`CSEExtensionId` GUID

Event ID 9001: This machine is configured to retrieve Group Policy files from a file share in an insecure way.

Channel: Operational
Level: Warning

Message #

This machine is configured to retrieve Group Policy files from a file share in an insecure way.

UNC Path: %1
Mutual Authentication Enforced: %2
Integrity Enforced: %3

Guidance: The UNC path contains logon scripts and/or files that control system security policies. Microsoft recommends configuring Windows to require both mutual authentication and integrity when accessing files on this UNC path.

For details on configuring Windows machines to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPath` UnicodeString
`MutualAuthenticationEnforced` Boolean
`IntegrityEnforced` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-GroupPolicy",
    "event_id": 9001,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T03:03:33.8017414+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-GroupPolicy"
  },
  "event_data": {
    "MutualAuthenticationEnforced": "false",
    "IntegrityEnforced": "false",
    "UncPath": "\\\\ludus.domain\\NETLOGON"
  }
}

Provenance

ETW provider GUID aea1b4fa-97d1-45f2-a64c-4d69fffd92c9

Defined in gpsvc.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB