none
running gpresult returns "ERROR: Not found."

    Question

  • I asked this in the Direcotry Services forum as well, but thought it might also be appropriate here.

    I have one desktop in our domain that is having some problems (drives not being mapped, program shortcuts missing, etc).  This is only happening when one user logs into the system.  If another user logs into the same computer, everything appears normally as it should. 

    My first inclination was to look at the users account and check policy. The user is in the same OU as the other user whose login works fine.  The computer is a laptop, and is taken out of the office every morning before I get into work, so I cannot run a GP results wizard as the computer is not on the corporate LAN when I am at work.  So I got a tech on site (this computer is in another city) to run "gpresult > result.txt" and email me the results. When the tech runs gpresult, he gets the following: "ERROR: Not found."

    I've checked google (of course) and there really isn't much on this error.  The computer joins the domain fine when the user logs on, but it certainly appears that GP is not being applied to his specific logon.  Any ideas?

    Thursday, January 26, 2012 2:55 PM

Answers

  • Am 07.02.2012 21:07, schrieb jadedpuppy:
    > The WMI service is started and running, I have restarted it and still
    > receive the same error when trying to run rsop.msc.  After restarting
    > the WMI service the following events (Event ID 28) are in the
    > application log "WinMgmt could not initialize the core parts.  This
    > could be due to a badly installed version of WinMgmt, WinMgmt
    > repository upgrade failure, insufficient disk space or insufficient
    > memory."  I know disk space and memory are fine.
     
    Run "sfc /scannow". If unsuccessfull, try to rebuild WMI:
     
    net stop winmgmt /y
    rd %systemroot%\system32\repository /s /q
    net start winmgmt
    for %D in (%systemroot%\system32\wbem\*.dll) do regsvr32 /s %D
    for %D in (%systemroot%\system32\wbem\*.mof) do mofcomp %D
     
    (If you run this in a batch, replace %D with %%D)
     
    This is the hardcore method to get a clean fresh WMI database. For me it
    worked almost every time WMI was corrupt.
     
    sincerely, Martin
     
     

    A bissle "Experience", a bissle GMV... Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    • Marked as answer by jadedpuppy Wednesday, February 8, 2012 4:51 PM
    Wednesday, February 8, 2012 7:38 AM

All replies

  • I have one desktop in our domain that is having some problems (drives not being mapped, program shortcuts missing, etc).  This is only happening when one user logs into the system.  If another user logs into the same computer, everything appears normally as it should. 

    My first inclination was to look at the users account and check policy. The user is in the same OU as the other user whose login works fine.  The computer is a laptop, and is taken out of the office every morning before I get into work, so I cannot run a GP results wizard as the computer is not on the corporate LAN when I am at work.  So I got a tech on site (this computer is in another city) to run "gpresult > result.txt" and email me the results. When the tech runs gpresult, he gets the following: "ERROR: Not found."

    I've checked google (of course) and there really isn't much on this error.  The computer joins the domain fine when the user logs on, but it certainly appears that GP is not being applied to his specific logon.  Any ideas?

    Thursday, January 26, 2012 2:48 PM
  • Hello,

    make sure the command is run correct as you didn't specify any switch.

    gpresult /z > gpresult.log


    Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Thursday, January 26, 2012 2:55 PM
  • If the machine in question is Windows 7, try following and see if it helps...

    run cmd as administrator, restart WMI service by executing following command

    net stop Winmgmt && net start Winmgmt

    then, from same command prompt, execute

     GPRESULT /H > C:\GPReport.html 

    Above command saves the report in HTML format at the location (root of C drive) and with the file name specified by the <filename> parameter. (valid in Windows Vista SP1 and above)

     


    ~Santosh View Santosh  Bhandarkar's profile on LinkedIn
    Thursday, January 26, 2012 3:02 PM
    Moderator
  • Hard to say for sure but of the possibilities here:

    -user profile for this user could be corrupted and preventing user policy from applying

    -The RSoP error not found could mean WMI repository issues--but this would not necessarily prevent policy from applying.

     

    Beyond those two things, it's really hard to say. You didn't say if this was a Win7 machine--if so, you might have your remote tech have a looking in the event log under the Group Policy Operational log to see if it gives any clues.

     

    Darren


    Darren Mar-Elia MS-MVP, Group Policy
    www.gpoguy.com
    www.sdmsoftware.com - "The Group Policy Experts"
    Thursday, January 26, 2012 3:31 PM
  • Yes, I had him run the command with switches and output to a file.

    It is a XP machine, not Win7.  I'm currently getting the tech on site to check for WMI service problems, as I had found some articles suggesting that WMI may be the cause.

    Thursday, January 26, 2012 3:37 PM
  • It is a XP machine. 

    They have already deleted the user profile and had the user lgo back on again.  The same thing occurred when he logged back on. 

    Thursday, January 26, 2012 3:47 PM
  • OK. Well, to the 2nd of my possible cures, check out http://answers.microsoft.com/en-us/windows/forum/windows_xp-system/wmi-repair/a914539b-7197-4e2b-adae-f01c3e7e01bc for repairing WMI.

     

    Darren


    Darren Mar-Elia MS-MVP, Group Policy
    www.gpoguy.com
    www.sdmsoftware.com - "The Group Policy Experts"
    Thursday, January 26, 2012 4:06 PM
  • You say that when one user logs on all GPO is OK and when another there's an issue. There's a couple of things you can look for to assist your problem diagnosis:

    1. Are both users DEFINATELY in the same OU?
    2. Is there some security filtering on the GPO (i.e. "Authenticated Users" removed and replaced with security group) and if so, is the affected user a member of the security group?
    3. Check the application logs of that computer to see if there any errors/warning for
      userenv or scecli that could indicate a problem with Group Policy applying

    Good luck...

     

     If you found this post helpful, please "Vote as Helpful". If it answered your question, remember to "Mark as Answer".








    Thursday, January 26, 2012 4:25 PM
  • Ask him to execute rsop.msc on the same system and see if it works. Also, you can use gpinventory tool to remotely execute rsop.msc. There is also a tool called gpologview which can help you too. Ask the user as a troubleshooting step to login to the system locally and then execute gpresult /z

    http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=14126

    http://blogs.technet.com/b/grouppolicy/archive/2007/02/08/gplogview.aspx

     

    Regards  


    Awinish Vishwakarma

    MY BLOG:  http://awinish.wordpress.com/


    This posting is provided AS-IS with no warranties/guarantees and confers no rights.
    Thursday, January 26, 2012 5:16 PM
  • I can't use gplogview as it does not appear to be supported for XP.

    I will get the tech on site to run rsop.msc. 

    Thursday, January 26, 2012 5:39 PM
  • Give a try it should work on XP too but i haven't tested it. Even, below article says it works for NT systems too. You can also use gpinventory tool to remotely execute rsop.msc result.

    http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/Admin/UsingGPLogView.html

     

    Regards


    Awinish Vishwakarma

    MY BLOG:  http://awinish.wordpress.com/


    This posting is provided AS-IS with no warranties/guarantees and confers no rights.
    Thursday, January 26, 2012 5:49 PM
  • I can't run the rsop remotely because the laptop is not connected to the LAN 90% of the time.  Makes troubleshooting very annoying.  I will get the onsite tech to run rsop when the laptop is next in the office.  (The laptop is used by one of our remote techs who does not need corporate LAN access to do his remote work, so the laptop is not joined most of the time.)
    Thursday, January 26, 2012 7:29 PM
  • Hi,

    Please collect GPMC.log and userenv.log to troubleshoot the issue:

    Userenv.log
    ====================
    1.    Start Registry Editor.
    2.    Locate and then click the following registry subkey:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon 
    3.    Right-click and new add DWORD(32-bit) with the Value of "UserEnvDebugLevel"
    4.    Type in 10002(Hexadecimal) or 65538(Decimal) in the Value data box, and then click OK.
    5.    Reboot the problematic computer to make the change take into effect.

    The Userenv.log is located in the following folder: %SYSTEMDRIVE%\Debug\UserMode\

    GPMC.log
    ==================
    a.    On domain controller, click Start -> Run, type GPMC.MSC, it will load the GPMC console.
    b.    Right click on "Group Policy Result" and choose wizard to generate a report for the problematic computer and user account (please place appropriately). (Choose computer and select the proper user in the wizard)

    If you encounter any difficulties when reading the gpmc.log, please contact me with my account: v-xchen@microsoft.com to get a workspace to upload the information.

    As there are too many threads, please clearly states the thread name in the email subject, please post the thread link in the email. Thanks for your understanding!

    In addition, there are some related links for your reference:

    Terminal server 2008 R2 WMI Rsop problems
    http://social.technet.microsoft.com/Forums/en/winserverTS/thread/d3346fdb-b9ff-42af-bf23-dcd8cb2d8408

    Userenv errors occur and events are logged after you apply Group Policy to computers that are running Windows Server 2003, Windows XP, or Windows 2000
    http://support.microsoft.com/kb/887303


    Hope this helps!

    Best Regards
    Elytis Cheng

     


    Please remember to click “Mark as Answer” on the post that

    Elytis Cheng

    TechNet Community Support

    Monday, January 30, 2012 9:19 AM
    Moderator
  • Okay, I finally got this user to leave his system attached to the network, so I was able to log into the system.

    I am still unable to run gpresult. 

    When I try to locally run rsop.msc it fails with the following error: "Failed to connect to STC1029903 due to the error listed below. Ensure that the Windows Management Instrumentation (WMI) service is enabled on the target computer, adn consult the event log of the target computer for further details. Details: Not Found." 

    The WMI service is started and running, I have restarted it and still receive the same error when trying to run rsop.msc.  After restarting the WMI service the following events (Event ID 28) are in the application log "WinMgmt could not initialize the core parts.  This could be due to a badly installed version of WinMgmt, WinMgmt repository upgrade failure, insufficient disk space or insufficient memory."  I know disk space and memory are fine. 

    Additionally, the application log is full of userenv errors:

    Event ID 1090: Windows couldn't log the RSoP (Resultant Set of Policies) session status. An attempt to connect to WMI failed.  No more RSoP logging will be done for this application of policy.

    Event ID 1104: Windows cannot perform filter check for Group Policy object cn={75FB7DEA-D26F-4499-A601-01267161EAA0},cn=policies,cn=system,DC=stholdco,DC=com. The associated filter cannot be found. This Group Policy Object will be skipped. 

    There are a bunch of these Event ID 1104 events, all referencing different CNs, so different policies. 

    Any additional help would be greatly appreciated. 

    Tuesday, February 7, 2012 8:07 PM
  • Am 07.02.2012 21:07, schrieb jadedpuppy:
    > The WMI service is started and running, I have restarted it and still
    > receive the same error when trying to run rsop.msc.  After restarting
    > the WMI service the following events (Event ID 28) are in the
    > application log "WinMgmt could not initialize the core parts.  This
    > could be due to a badly installed version of WinMgmt, WinMgmt
    > repository upgrade failure, insufficient disk space or insufficient
    > memory."  I know disk space and memory are fine.
     
    Run "sfc /scannow". If unsuccessfull, try to rebuild WMI:
     
    net stop winmgmt /y
    rd %systemroot%\system32\repository /s /q
    net start winmgmt
    for %D in (%systemroot%\system32\wbem\*.dll) do regsvr32 /s %D
    for %D in (%systemroot%\system32\wbem\*.mof) do mofcomp %D
     
    (If you run this in a batch, replace %D with %%D)
     
    This is the hardcore method to get a clean fresh WMI database. For me it
    worked almost every time WMI was corrupt.
     
    sincerely, Martin
     
     

    A bissle "Experience", a bissle GMV... Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    • Marked as answer by jadedpuppy Wednesday, February 8, 2012 4:51 PM
    Wednesday, February 8, 2012 7:38 AM
  • The problem ended up being a corrupt WMI.  Thanks for all the help.
    Wednesday, February 8, 2012 4:51 PM
  • Wokr nice for me : Repair WMI...

    sc config winmgmt start= disabled
    net stop winmgmt /y
    Winmgmt /salvagerepository %windir%\System32\wbem
    Winmgmt /resetrepository %windir%\System32\wbem
    sc config winmgmt start= auto

    Wednesday, May 7, 2014 12:02 PM
  • Run "sfc /scannow". If unsuccessfull, try to rebuild WMI:
     
    net stop winmgmt /y
    rd %systemroot%\system32\repository /s /q
    net start winmgmt
    for %D in (%systemroot%\system32\wbem\*.dll) do regsvr32 /s %D
    for %D in (%systemroot%\system32\wbem\*.mof) do mofcomp %D

    On Windows 2008 R2

    The only discrepancy was that my repository was found in:

    C:\Windows\System32\wbem\repository

    I had to use:

    rd %systemroot%\system32\wbem\repository /s /q

    I also had to disable my TrendMicro AV in order to successfully stop the winmgmt. 

    Wednesday, May 6, 2015 4:36 PM
  • re-registering the .dll files mentioned above did not work for me. However, this worked.
    Monday, July 4, 2016 9:23 AM