none
GPP - Local Users and groups - Item Level Targeting failing on windows 8.1 machines

    Question

  • Have kind of a weird issue going on with GPP local users and groups using ILT.  This issue is only affecting windows 8.1 machines.  Windows 7 machines are working as intended.  

    DC's - 2008 r2

    Domain functional level 2008 r2

    Forest functional level 2008 r2

    Here is what's being done in GPP:

    

    All event logs are event ID 4106, source: Group Policy Local Users and groups:

    The computer 'DenyNetworkAccess' preference item in the '.Computer - Desktop Security v.1.0 {CF29CACA-2C02-4135-9FE5-10B3F8430C59}' Group Policy Object did not apply because its targeting item failed with error code '0x80072af9 No such host is known.' This error was suppressed.

    The computer 'Administrators (built-in)' preference item in the '.Computer - Desktop Security v.1.0 {CF29CACA-2C02-4135-9FE5-10B3F8430C59}' Group Policy Object did not apply because its targeting item failed with error code '0x80072af9 No such host is known.' This error was suppressed.

    The computer 'Remote Desktop Users (built-in)' preference item in the '.Computer - Desktop Security v.1.0 {CF29CACA-2C02-4135-9FE5-10B3F8430C59}' Group Policy Object did not apply because its targeting item failed with error code '0x80072af9 No such host is known.' This error was suppressed.

    These 3 events are the ones I should be getting.  What is occurring is i'm getting a weird mixture of the 23 policies listed above - not getting one of what I should be - you can see this below in the trace log.

    Turned on logging/tracing, here's the error: 

    2016-01-26 11:21:11.162 [pid=0x12a8,tid=0x213c] Entering ProcessGroupPolicyExLocUsAndGroups()
    2016-01-26 11:21:11.162 [pid=0x12a8,tid=0x213c] SOFTWARE\Policies\Microsoft\Windows\Group Policy\{17D89FEC-5C44-4972-B12D-241CAEF74509}
    2016-01-26 11:21:11.162 [pid=0x12a8,tid=0x213c] BackgroundPriorityLevel ( 7 )
    2016-01-26 11:21:11.177 [pid=0x12a8,tid=0x213c] DisableRSoP ( 0 )
    2016-01-26 11:21:11.177 [pid=0x12a8,tid=0x213c] LogLevel ( 2 )
    2016-01-26 11:21:11.177 [pid=0x12a8,tid=0x213c] Command subsystem initialized. [SUCCEEDED(S_FALSE)]
    2016-01-26 11:21:12.093 [pid=0x12a8,tid=0x213c] ----- Parameters
    2016-01-26 11:21:12.093 [pid=0x12a8,tid=0x213c] CSE GUID : {17D89FEC-5C44-4972-B12D-241CAEF74509}
    2016-01-26 11:21:12.093 [pid=0x12a8,tid=0x213c] Flags : ( X ) GPO_INFO_FLAG_MACHINE - Apply machine policy rather than user policy
    2016-01-26 11:21:12.093 [pid=0x12a8,tid=0x213c]         ( X ) GPO_INFO_FLAG_BACKGROUND - Background refresh of policy (ok to do slow stuff)
    2016-01-26 11:21:12.093 [pid=0x12a8,tid=0x213c]         (   ) GPO_INFO_FLAG_SLOWLINK - Policy is being applied across a slow link
    2016-01-26 11:21:12.093 [pid=0x12a8,tid=0x213c]         (   ) GPO_INFO_FLAG_VERBOSE - Verbose output to the eventlog
    2016-01-26 11:21:12.108 [pid=0x12a8,tid=0x213c]         ( X ) GPO_INFO_FLAG_NOCHANGES - No changes were detected to the Group Policy Objects
    2016-01-26 11:21:12.108 [pid=0x12a8,tid=0x213c]         (   ) GPO_INFO_FLAG_LINKTRANSITION - A change in link speed was detected between previous policy application and current policy application
    2016-01-26 11:21:12.108 [pid=0x12a8,tid=0x213c]         (   ) GPO_INFO_FLAG_LOGRSOP_TRANSITION - A change in RSoP logging was detected between the application of the previous policy and the application of the current policy.
    2016-01-26 11:21:12.108 [pid=0x12a8,tid=0x213c]         (   ) GPO_INFO_FLAG_FORCED_REFRESH - Forced Refresh is being applied. redo policies.
    2016-01-26 11:21:12.108 [pid=0x12a8,tid=0x213c]         (   ) GPO_INFO_FLAG_SAFEMODE_BOOT - windows safe mode boot flag
    2016-01-26 11:21:12.108 [pid=0x12a8,tid=0x213c]         (   ) GPO_INFO_FLAG_ASYNC_FOREGROUND - Asynchronous foreground refresh of policy
    2016-01-26 11:21:12.108 [pid=0x12a8,tid=0x213c] Token (computer or user SID): S-1-5-18
    2016-01-26 11:21:12.108 [pid=0x12a8,tid=0x213c] Abort Flag : Yes (0x2988b500)
    2016-01-26 11:21:12.124 [pid=0x12a8,tid=0x213c] HKey Root : Yes (0x80000002)
    2016-01-26 11:21:12.124 [pid=0x12a8,tid=0x213c] Deleted GPO List : No
    2016-01-26 11:21:12.124 [pid=0x12a8,tid=0x213c] Changed GPO List : Yes
    2016-01-26 11:21:12.124 [pid=0x12a8,tid=0x213c] Asynchronous Processing : Yes
    2016-01-26 11:21:12.124 [pid=0x12a8,tid=0x213c] Status Callback : No (0x00000000)
    2016-01-26 11:21:12.124 [pid=0x12a8,tid=0x213c] WMI namespace : No (0x00000000)
    2016-01-26 11:21:12.124 [pid=0x12a8,tid=0x213c] RSoP Status : Yes (0x2ce5ea54)
    2016-01-26 11:21:12.140 [pid=0x12a8,tid=0x213c] Planning Mode Site : (none)
    2016-01-26 11:21:12.140 [pid=0x12a8,tid=0x213c] Computer Target : No (0x00000000)
    2016-01-26 11:21:12.140 [pid=0x12a8,tid=0x213c] User Target : No (0x00000000)
    2016-01-26 11:21:12.140 [pid=0x12a8,tid=0x213c] Calculated list relevance. [SUCCEEDED(S_FALSE)]
    2016-01-26 11:21:12.140 [pid=0x12a8,tid=0x213c] ----- Changed - 0
    2016-01-26 11:21:12.140 [pid=0x12a8,tid=0x213c] Options : (   ) GPO_FLAG_DISABLE - This GPO is disabled.
    2016-01-26 11:21:12.140 [pid=0x12a8,tid=0x213c]           (   ) GPO_FLAG_FORCE - Do not override the settings in this GPO with settings in a subsequent GPO.
    2016-01-26 11:21:12.155 [pid=0x12a8,tid=0x213c] Options (raw) : 0x00000000
    2016-01-26 11:21:12.155 [pid=0x12a8,tid=0x213c] Version : 67503110 (0x04060406)
    2016-01-26 11:21:12.155 [pid=0x12a8,tid=0x213c] GPC : LDAP://CN=Machine,cn={CF29CACA-2C02-4135-9FE5-10B3F8430C59},cn=policies,cn=system,DC="domain",DC=org
    2016-01-26 11:21:12.155 [pid=0x12a8,tid=0x213c] GPT : \\"domain"\sysvol\"domain"\Policies\{CF29CACA-2C02-4135-9FE5-10B3F8430C59}\Machine
    2016-01-26 11:21:12.155 [pid=0x12a8,tid=0x213c] GPO Display Name : .Computer - Desktop Security v.1.0
    2016-01-26 11:21:12.155 [pid=0x12a8,tid=0x213c] GPO Name : {CF29CACA-2C02-4135-9FE5-10B3F8430C59}
    2016-01-26 11:21:12.155 [pid=0x12a8,tid=0x213c] GPO Link : (   ) GPLinkUnknown - No link information is available.
    2016-01-26 11:21:12.171 [pid=0x12a8,tid=0x213c]            (   ) GPLinkMachine - The GPO is linked to a computer (local or remote).
    2016-01-26 11:21:12.171 [pid=0x12a8,tid=0x213c]            (   ) GPLinkSite - The GPO is linked to a site.
    2016-01-26 11:21:12.171 [pid=0x12a8,tid=0x213c]            (   ) GPLinkDomain - The GPO is linked to a domain.
    2016-01-26 11:21:12.171 [pid=0x12a8,tid=0x213c]            ( X ) GPLinkOrganizationalUnit - The GPO is linked to an organizational unit.
    2016-01-26 11:21:12.171 [pid=0x12a8,tid=0x213c]            (   ) GP Link Error
    2016-01-26 11:21:12.171 [pid=0x12a8,tid=0x213c] lParam : 0x00000000
    2016-01-26 11:21:12.171 [pid=0x12a8,tid=0x213c] Prev GPO : No
    2016-01-26 11:21:12.186 [pid=0x12a8,tid=0x213c] Next GPO : No
    2016-01-26 11:21:12.186 [pid=0x12a8,tid=0x213c] Extensions : [{00000000-0000-0000-0000-000000000000}{3BAE7E51-E3F4-41D0-853D-9BB9FD47605F}{3EC4E9D3-714D-471F-88DC-4DD4471AAB47}{79F92669-4224-476C-9C5C-6EFB4D87DF4A}{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}][{17D89FEC-5C44-4972-B12D-241CAEF74509}{79F92669-4224-476C-9C5C-6EFB4D87DF4A}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1D-2488-11D1-A28C-00C04FB94F17}{B05566AC-FE9C-4368-BE01-7A4CBB6CBA11}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{6232C319-91AC-4931-9385-E70C2B099F0E}{3EC4E9D3-714D-471F-88DC-4DD4471AAB47}][{7150F9BF-48AD-4DA4-A49C-29EF4A8369BA}{3BAE7E51-E3F4-41D0-853D-9BB9FD47605F}][{7933F41E-56F8-41D6-A31C-4148A711EE93}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{AADCED64-746C-4633-A97C-D61349046527}{CAB54552-DEEA-4691-817E-ED4A4D1AFC72}][{B087BE9D-ED37-454F-AF9C-04291E351182}{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1D-2488-11D1-A28C-00C04FB94F17}][{C631DF4C-088F-4156-B058-4375F0853CD8}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{CDEAFC3D-948D-49DD-AB12-E578BA4AF7AA}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{F3CCC681-B74C-4060-9F26-CD84525DCA2A}{0F3F3735-573D-9804-99E4-AB2A69BA5FD4}]
    2016-01-26 11:21:12.186 [pid=0x12a8,tid=0x213c] lParam2 : 0x3b8ca3e8
    2016-01-26 11:21:12.186 [pid=0x12a8,tid=0x213c] Link : LDAP://OU=.Departments,DC="domain",DC=org
    2016-01-26 11:21:12.202 [pid=0x12a8,tid=0x213c] Purge GPH : C:\ProgramData\Microsoft\Group Policy\History\{CF29CACA-2C02-4135-9FE5-10B3F8430C59}\Machine\Preferences\Groups\Groups.xml
    2016-01-26 11:21:12.233 [pid=0x12a8,tid=0x213c] Read GPE XML data file (19110 bytes total).
    2016-01-26 11:21:12.265 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.265 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.265 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.280 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.280 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.280 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.280 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.437 [pid=0x12a8,tid=0x213c] Failed filter [FilterComputer]. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.437 [pid=0x12a8,tid=0x213c] Filters error. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.437 [pid=0x12a8,tid=0x213c] Error suppressed. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.483 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Workstation_Admins
    2016-01-26 11:21:12.483 [pid=0x12a8,tid=0x213c] Added group member LocalAdmin
    2016-01-26 11:21:12.483 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.499 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.499 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.515 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.530 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.546 [pid=0x12a8,tid=0x213c] Failed filter [FilterComputer]. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.562 [pid=0x12a8,tid=0x213c] Filters error. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.562 [pid=0x12a8,tid=0x213c] Error suppressed. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.562 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.562 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.562 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.562 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.577 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.577 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.577 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.577 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.577 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.577 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.609 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Worksation_SCUNBCHQ01545_LocalAdmins
    2016-01-26 11:21:12.624 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.640 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Workstation_LAPIT08_LocalAdmins
    2016-01-26 11:21:12.655 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.671 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Workstation_SCUNBCHQ00354_LocalAdmins
    2016-01-26 11:21:12.687 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.702 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Workstation_SCUNBCHQ00353_LocalAdmins
    2016-01-26 11:21:12.702 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.733 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Workstation_APPDEVTEMP_LocalAdmins
    2016-01-26 11:21:12.749 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Workstation_RDP
    2016-01-26 11:21:12.765 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.781 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.796 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.812 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.827 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.859 [pid=0x12a8,tid=0x213c] Failed filter [FilterComputer]. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.859 [pid=0x12a8,tid=0x213c] Filters error. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.859 [pid=0x12a8,tid=0x213c] Error suppressed. [ hr = 0x80072af9 "No such host is known." ]
    2016-01-26 11:21:12.859 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterGroup].
    2016-01-26 11:21:12.874 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.905 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Workstation_MRKTNG_RDP
    2016-01-26 11:21:12.921 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\"User"
    2016-01-26 11:21:12.921 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.921 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.921 [pid=0x12a8,tid=0x213c] Starting filter [AND FilterComputer].
    2016-01-26 11:21:12.953 [pid=0x12a8,tid=0x213c] Starting filter [OR FilterComputer].
    2016-01-26 11:21:12.984 [pid=0x12a8,tid=0x213c] Added group member "DOMAIN"\ACL_Workstation_TECSVCNetwork_RDP
    2016-01-26 11:21:13.030 [pid=0x12a8,tid=0x213c] Completed get next GPO. [SUCCEEDED(S_FALSE)]
    2016-01-26 11:21:13.046 [pid=0x12a8,tid=0x213c] Completed get GPO list. [SUCCEEDED(S_FALSE)]
    2016-01-26 11:21:13.046 [pid=0x12a8,tid=0x213c] IsRsopPlanningMode() [SUCCEEDED(S_FALSE)]
    2016-01-26 11:21:14.989 [pid=0x12a8,tid=0x213c] Leaving ProcessGroupPolicyExLocUsAndGroups() returned 0x00000000

    Thank you!



    Tuesday, January 26, 2016 9:03 PM

All replies

  • These 3 events are the ones I should be getting.  What is occurring is i'm getting a weird mixture of the 23 policies listed above - not getting one of what I should be -

    Hi,

    I am not quite sure about this sentence. Do you mean that the 23 policies listed above automatically appeared in GPP, not configured by yourself?

    Besides, could you share us detail settings of what Item Level Targeting you’ve configured?



    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, January 27, 2016 8:36 AM
    Moderator
  • > 2016-01-26 11:21:12.437 [pid=0x12a8,tid=0x213c] Failed filter
    > [FilterComputer]. [ hr = 0x80072af9 "No such host is known." ]
     
    Would you mind sharing your EXACT item level targeting filters? (right
    click - all tasks - show xml)
     
    Wednesday, January 27, 2016 8:55 AM