none
Invalid pointer - Error in GPO backup

    Question

  • Hi,

    I got a Active Directory with domain and forest in Windows Server 2012 R2 level.

    I'm starting to restructure the GPOs that we have and I started with a backup of the existing ones.

    In five of them I got the following error:

    "

    The overall error was: Invalid pointer
    Additional details follow.

    [Error] The task cannot be completed. There was an error with extension [Core Extension]. The attributes of Directory Services object [LDAP://Server/cn={95B712C8-D23B-49DB-B376-B83D1B6BDFE1},CN=Policies,CN=System,DC=ualg,DC=pt] cannot be accessed.
    The following error occurred:
    Invalid pointer

    "

    I've edited the gpos and it doesn't seem to have any errors. I've accessed the policy server on the DC and I got no errors.

    The AD Replication Status Tool shows no errors or delays in the forest.

    What could be the problem and how can I solve it?

    Thanks in advance...

    With the best regards,

    dmsousa

    Monday, January 04, 2016 3:42 PM

All replies

  • The first thing to check is does the folder exist on sysvol?  Probably at \\ualg.pt\sysvol\ualg.pt\policies

    Then maybe https://support.microsoft.com/en-us/kb/3005420

    Are you backing up via GPMC, Powershell or something else?

    Monday, January 04, 2016 8:01 PM
  • Hi,
     
    Just would like to confirm that, at which exact point will you get this error message?
     
    Check the KB article shared by <vaadadmin2010> above, and see if it is helpful.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Tuesday, January 05, 2016 4:36 AM
    Moderator
  • Hi,

    The folder exists and all the files are acessible?

    I'm backing up via GPMC...

    Again thanks

    Tuesday, January 05, 2016 9:32 AM
  • Hi,

    I get the error when I'm backing up via GPMC, in the report.

    I'm going to check the KB...

    Again, thanks

    Tuesday, January 05, 2016 9:33 AM
  • > [Core Extension]. The attributes of Directory Services object
    > [LDAP://Server/cn={95B712C8-D23B-49DB-B376-B83D1B6BDFE1},CN=Policies,CN=System,DC=ualg,DC=pt]
    > cannot be accessed.
     
    Could you run
     
    dsquery *
    "cn={95B712C8-D23B-49DB-B376-B83D1B6BDFE1},CN=Policies,CN=System,DC=ualg,DC=pt"
    -scope base -attr *
     
    and post the output? Seems some attribute values are either missing or
    incorrectly populated (flags, gPC[User|Machine]ExtensionNames, version
    or whatever...) (you might run the same command against a working GPO
    and compare the results on your own :-))
     
    Tuesday, January 05, 2016 1:16 PM
  • Hi,

    This is the output of the command:

    objectClass: top
    objectClass: container
    objectClass: groupPolicyContainer
    cn: {95B712C8-D23B-49DB-B376-B83D1B6BDFE1}
    distinguishedName: CN={95B712C8-D23B-49DB-B376-B83D1B6BDFE1},CN=Policies,CN=System,DC=ualg,DC=pt
    instanceType: 4
    whenCreated: 03/18/2015 13:21:48
    whenChanged: 04/14/2015 17:15:49
    displayName: SI_Voip_Client
    uSNCreated: 30493394
    uSNChanged: 32067151
    showInAdvancedViewOnly: TRUE
    name: {95B712C8-D23B-49DB-B376-B83D1B6BDFE1}
    objectGUID: {880D1EE6-7448-4F00-92D0-1F7EF58990D1}
    flags: 0
    versionNumber: 786432
    objectCategory: CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=ualg,DC=pt
    gPCFunctionalityVersion: 2
    gPCFileSysPath: \\ualg.pt\SysVol\ualg.pt\Policies\{95B712C8-D23B-49DB-B376-B83D1B6BDFE1}
    gPCUserExtensionNames: [{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
    dSCorePropagationData: 03/20/2015 11:16:37
    dSCorePropagationData: 03/18/2015 13:28:54
    dSCorePropagationData: 03/18/2015 13:27:53
    dSCorePropagationData: 01/01/1601 00:00:00
    ADsPath: LDAP://Server.ualg.pt/cn={95B712C8-D23B-49DB-B376-B83D1B6BDFE1},CN=Policies,CN=System,DC=ualg,DC=pt

    Wednesday, January 06, 2016 3:49 PM
  • > This is the output of the command:
     
    Doesn't look invalid in any aspect... But since this GPO only contains a
    script, could you give a try and create a new one?
     
    Thursday, January 07, 2016 2:21 PM
  • Hi,
     
    How is it going? Is the KB article helpful for you? Please feel free to post back if you need further assistance.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Monday, January 11, 2016 1:49 AM
    Moderator
  • Hello,

    Sorry for the delay in getting back to this issue.

    Yes, I could replace the GPO with a new one, but I have, I think four other GPOs with the same issue. I just want to understand whats going on, fix the issues, so that I can I have a fully healthy AD...

    I'm going to run the commands and procedures sent with other affected gpo that has no scripts but has some settings and I'll get back to you...

    Again, thanks for the time...

    With the best regards,

    dmsousa

    Monday, January 11, 2016 9:48 AM
  • Hello,

    I just ran the command: dsquery * "cn={9BD19EC9-95A8-4942-BC28-4E3C28D5F3DC},CN=Policies,CN=System,DC=ualg,DC=pt" -scope base -attr *" for another GPO and received this:

    objectClass: top
    objectClass: container
    objectClass: groupPolicyContainer
    cn: {9BD19EC9-95A8-4942-BC28-4E3C28D5F3DC}
    distinguishedName: CN={9BD19EC9-95A8-4942-BC28-4E3C28D5F3DC},CN=Policies,CN=System,DC=ualg,DC=pt
    instanceType: 4
    whenCreated: 05/19/2015 12:40:41
    whenChanged: 01/04/2016 14:23:45
    displayName: SI_SIGES_Formacao
    uSNCreated: 1763738
    uSNChanged: 17308018
    showInAdvancedViewOnly: TRUE
    name: {9BD19EC9-95A8-4942-BC28-4E3C28D5F3DC}
    objectGUID: {BF5346B9-0B91-4D06-8BB0-D9E5F57B9F51}
    flags: 0
    versionNumber: 786432
    objectCategory: CN=Group-Policy-Container,CN=Schema,CN=Configuration,DC=ualg,DC=pt
    gPCFunctionalityVersion: 2
    gPCFileSysPath: \\ualg.pt\SysVol\ualg.pt\Policies\{9BD19EC9-95A8-4942-BC28-4E3C28D5F3DC}
    gPCUserExtensionNames: [{00000000-0000-0000-0000-000000000000}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}][{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}][{C418DD9D-0D14-4EFB-8FBF-CFE535C8FAC7}{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}]
    dSCorePropagationData: 01/04/2016 14:23:45
    dSCorePropagationData: 05/19/2015 13:24:45
    dSCorePropagationData: 05/19/2015 13:03:00
    dSCorePropagationData: 05/19/2015 12:52:33
    dSCorePropagationData: 01/01/1601 00:00:00
    ADsPath: LDAP://Server.ualg.pt/cn={9BD19EC9-95A8-4942-BC28-4E3C28D5F3DC},CN=Policies,CN=System,DC=ualg,DC=pt

    Monday, January 11, 2016 9:52 AM
  • > gPCUserExtensionNames:
    > [{00000000-0000-0000-0000-000000000000}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}][{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}][{C418DD9D-0D14-4EFB-8FBF-CFE535C8FAC7}{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}]
     
    For the erroneous GPO, the first [] Entry is missing. If i remember
    correctly, this first entry specifies the "Group Policy Core protocol".
    So you might try to add
    [{00000000-0000-0000-0000-000000000000}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}]
    to the erroneous ones. But that's only a guess :)
     
    Monday, January 11, 2016 10:25 AM
  • For the erroneous GPO, the first [] Entry is missing. If i remember
    correctly, this first entry specifies the "Group Policy Core protocol".
    So you might try to add
    [{00000000-0000-0000-0000-000000000000}{A8C42CEA-CDB8-4388-97F4-5831F933DA84}{CEFFA6E2-E3BD-421B-852C-6F6A79A59BC1}]
    to the erroneous ones. But that's only a guess :

    It's the "Core GPO Engine", refer to this link for more reference:

    http://blogs.technet.com/b/mempson/archive/2010/12/01/group-policy-client-side-extension-list.aspx

    Wednesday, January 13, 2016 3:31 AM
  • Can pleas confirm and close the case?
    Monday, January 18, 2016 8:11 AM
  • Hi,

    I haven't confirm and close the case because I still haven´t make the changes to confirm the solution.

    I'll try this if not today, I'll do so in a couple of days...

    Monday, January 18, 2016 9:56 AM
  • I just ran into the same thing.  Turns out my GPO contained a Restricted Group member that corresponds to a SID string. Check this KB (scroll down to "more information") for the same thing:

    https://support.microsoft.com/en-us/kb/867462

    For instance, if you are adding "CO" to a security group in your GPO, you'll get an invalid pointer.


    • Edited by SaintFrag Wednesday, March 23, 2016 6:47 PM typo
    Wednesday, March 23, 2016 6:46 PM