none
Error 1128 - An attempt was made to load a program with an incorrect format - group policy error

    Question

  • Hello,

    I hope all is well.

    We have 150 provisioned servers that run the same image.  Each day anywhere from 2-5 of them come up with a lot of 1128 Errors in the event log.  Running Group policy results shows the error message, "An attempt was made to load a program with an incorrect format"

    The actual policy can vary and include one or more of the following:  Citrix group policy, Group policy drive mappings, Group policy Internet Settings, group policy registry, Internet explorer zonemapping.

    Once the event happens it is reproducible running gpudate.  I have compared a good server next to a bad server running gpudate at the same time, hitting the same domain controller and the one that works works and the one that doesn't doesn't. 

    Comparing "HKLM\software\microsoft\windows NT\current version\winlogon\GPextensions"  doesn't show any differences between the one that works and the one that doesn't.

    Bouncing the server will fix the problem at least for the short term.

    Any idea on how to fix this once and for all?

    Thanks

    Friday, February 05, 2016 3:48 PM

Answers

  • Hello,

    As this issue randomly happened on different computers, it seems like a network related issue. Please analysis your GPSVC log for more details.

    And as reboot several times, the issue may disappear. And if a user connects to the network over a slow link with cached credentials, Group Policy may not be processed. So please try to disable slow link follow the link below:

    https://technet.microsoft.com/en-us/library/cc759191%28v=ws.10%29.aspx

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, February 23, 2016 7:49 AM
    Moderator

All replies

  • Hello,

    According to my understanding, only 2-5 of 150 servers have the problem, I would like to confirm whether always those same 2-5 computers have this issue? If that is the case, please reboot on of them and also run gpupdate /force to check the result.

    In addition, please check whether the link below can be helpful:

    Event ID 1128 — Application of Group Policy
    http://technet.microsoft.com/en-us/library/cc727258(v=WS.10).aspx

    To go deeper, I would recommend enabling GPSVC debug logging and GPCSE logging:

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, February 08, 2016 3:13 AM
    Moderator
  • No, not the same servers, I have started compiling a report and so far over the course of 4 weeks it is spread out over 50 odd servers, ranging from 1-3 occurrences per server (typically when it happens we drain a server of users, bounce the server and put back into production).  We run a report daily on the instances of 1128.

    Also:

    We have two sites, the servers with incidences are spread out over both sites.

    We have 5 reboot scheduled tasks to spread out the reboot cycle with each server up for a week - getting the 1128 will range from 2 days to 6 days.  One server was taken out of the reboot cycle and got it after 12 days.

    Also in Event Viewer - Group Policy - operational I see Event ID 7016 errors,  ErrorCode 11.  The only errors.  146 instances in 3 days.

    I will take a look at your links, thanks for responding Yan.


    • Edited by wca4oi Tuesday, February 09, 2016 3:05 PM
    Tuesday, February 09, 2016 2:24 PM
  • Hello,

    As this issue randomly happened on different computers, it seems like a network related issue. Please analysis your GPSVC log for more details.

    And as reboot several times, the issue may disappear. And if a user connects to the network over a slow link with cached credentials, Group Policy may not be processed. So please try to disable slow link follow the link below:

    https://technet.microsoft.com/en-us/library/cc759191%28v=ws.10%29.aspx

    Regards,

    Yan Li


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, February 23, 2016 7:49 AM
    Moderator