none
1065 errors on computers not even in scope? - "The processing of Group Policy failed. Windows could not evaluate the WMI filter"

    Question

  • I have a 2008R2 domain with Win7 clients.  I have some clients that have the WMI service running on them, but are getting the Event ID 1065 errors "The processing of Group Policy failed. Windows could not evaluate the WMI filter".  The weird thing is that if I lookup Policy UID, I will find a GPO that does have a WMI filter on it, but the policy has both the User and computer side disabled.  Does anyone have any ideas why a GPO could cause this errors on clients that are out of scope and actually do have the WMI service running?  

    Dave


    Monday, May 18, 2015 6:44 PM

Answers

  • > UID, I will find a GPO that does have a WMI filter on it, but the policy
    > has both the User and computer side disabled.  Does anyone have any
    > ideas why a GPO could cause this errors on clients that are out of scope
    > and actually do have the WMI service running?
     
    1. 1065: Weird query? :-)
    2. Evaluation order for GPOs:
    a) Apply Access
    b) WMI filter
    c) Flags
    d) Content present?
     
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    • Marked as answer by DaveBryan37 Thursday, May 21, 2015 3:42 PM
    Tuesday, May 19, 2015 8:20 AM

All replies

  • > UID, I will find a GPO that does have a WMI filter on it, but the policy
    > has both the User and computer side disabled.  Does anyone have any
    > ideas why a GPO could cause this errors on clients that are out of scope
    > and actually do have the WMI service running?
     
    1. 1065: Weird query? :-)
    2. Evaluation order for GPOs:
    a) Apply Access
    b) WMI filter
    c) Flags
    d) Content present?
     
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    • Marked as answer by DaveBryan37 Thursday, May 21, 2015 3:42 PM
    Tuesday, May 19, 2015 8:20 AM
  • There were actually (2)GPOs causing some issues, but it was not impacting every client.  I think both GPOs were disabled, and that is what is so weird. To stop the problem I simply removed the filter from the disabled GPO.  Both filters were basically interrogating the computernames of the clients.  If Flags are "c" and after the WMI filter, then that makes more sense.  Any ideas why several clients would have issue with this simple query?  They all did have WMI service running

    Select * From Win32_ComputerSystem Where Name LIKE 'LT*'


    Dave



    Tuesday, May 19, 2015 2:21 PM
  • > Select * From Win32_ComputerSystem Where Name LIKE 'LT*'
     
    Replace LT* with LT% - in WQL, % is the wildcard character.
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    Wednesday, May 20, 2015 7:53 AM
  • Thanks Martin - I had 10 filters based on names and using %, but just was not paying attention to that one.  I appreciate your help, especially on the order of GPOs getting applied because I had no idea that a disabled GPO could still cause issues.

    Dave



    Thursday, May 21, 2015 3:44 PM
  • > was not paying attention to that one.
     
    :-)
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    Friday, May 22, 2015 9:11 AM