Over the years, I've seen this admittedly rare issue come up in a handful of Group Policy discussion forums. As somewhat of a Group Policy aficionado, it intrigued me, however until recently I had never had the opportunity to troubleshoot the issue directly. Last week, however, I witnessed it occur in my environment and had a chance to investigate further. I was able to resolve the issue, although I'm not precisely sure how, so I'm going to post my findings in the hopes that it helps the next person who comes across this issue.
In this instance, a single policy object exhibited this behavior, and only on one workstation. The policy in question uses GPP Drive Maps and maps network drives for all of the users in my environment, and suddenly stopped mapping them for one user. The policy had experienced no changes for at least a year, and the workstation had no changes that I am aware of for about a month. There were no other recent changes that I feel were connected to the issue.
This particular problem produces a number of symptoms. Namely:
- The policy fails to take effect: drives don't map, registry entries don't get applied, etc.
- GPResult produces contradictory output: the policy object is listed as both applied and filtered.
Applied Group Policy Objects
[Policy Object Name]
The following GPOs were not applied because they were filtered out
[Policy Object Name]
Filtering: Not Applied (Unknown Reason)
- System and Application logs show no issues with policy processing. All sections report successful application. In my instance, each drive map in the policy reported that it was successful.
- Group Policy Preferences debug logging (you have to turn this on), however, shows no record of the policy whatsoever, success, error, or otherwise.
- The Operational event log in Applications and Services\Microsoft\Windows\Group Policy (you know, that part of event viewer that no one ever looks at) shows that the object is retrieved and added to the list of objects to be applied. The next event, ID 5313, should be a list of events filtered out. The policy in question does NOT appear in there.
Following these events, the operational log should list each GPP extension (drive maps, registry, files, etc.) and all of the objects that contain any policy of that class. In this case, there was simply no entry for Drive Maps, almost as if the extension didn't execute at all. My theory is that the extension itself is running into some kind of trouble. If there was an issue retrieving the objects, it wouldn't be downloaded successfully. If there was something in the object that was crashing the extension, it would be logged in the GPP debug logs. If there was a general problem with the GPP extensions, none of the others would run successfully. It's recorded in the GPResult output as applied because it's assigned to the extension to be processed, but filtered with "Unknown Reason" because the extension either never runs or crashes immediately upon running. I have the feeling that if I had had more policy objects containing drive maps, they would have failed as well, however I didn't get a chance to test this.
This issue seemed to resolve itself when I cleared the GPP Operational event log. I'm not sure if this was the actual solution, or if it was just a coincidence. If this helps anyone, please let me know.