Windows Server

Stelios Skiathitis · Guest

We are using a Windows SBS 2003, and in the event viewer in all workstations
in the company
appears the following error:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1104
Date: 5/1/2005
Time: 9:15:06 ðì
User: GREC\sski
Computer: STELIOS
Description:
Windows cannot perform filter check for Group Policy object
CN={.28AA1690-DAAD-4BE4-979B-EAEB3643A5E8},CN=Policies,CN=System,DC=grec.
The associated filter cannot be found. This Group Policy Object will be
skipped.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

The above link to microsoft does not provide any information.
This error appears approximately 4-5 times in each workstation in eight
hours time.

This message also duplicates in event log with difference in User where User
is
NT AUTHORITY\SYSTEM instead of GREC\sski as shown above

Also it duplicates with the same errors but with different CN id
I must also not that the group policy object with CN Id refers to the
Windows small business firewall gpo and the other with different cn id
refers to
Windows internet connection firewall.

Both GPO's use WMI filters. The one is the Post SP2 and the other Pre SP2
It' s the only GPO's which use Wmi from all enabled in the domain.

There are two WMI Filters. One called PreSP2 and the other PostSP2.
The first is applied-linked to Small Business Server Internet Connection
Firewall and the other
to Small Business Server Windows Firewall GPO.
What these WMI filters do is to determine if client pc's have Service Pack 2
installed.
These WMI were not customly created, I assume they were installed with an
update concerning windows firewall in sp2.
However these messages appear in each client event viewer?

I would like to know if this error means that the GPO is not applied and why
the filter check is not applied.
I really don't know how to fix this,
Any ideas I would appriciate much...

Thanks
Stelios Skiathitis

Bill Peng [MSFT] · Guest

Hi Stelios,

I'd like to provide you with the following suggestions.

Suggestion 1. Check the WMI Filters.

1. Open Server Management.
2. Navigate to Server Management\Advanced Management\Group Policy
Management\Forest\Domains\your
domain\WMI Filters.
3. On the Delegation tab, check if the appropriate user has permissions to
the filter.

I also noticed that some similar issue has been fixed by Hotfix 885827. You
can contact PSS to obtain the Hotfix.

Some memory-related results that are returned from the
Win32_OperatingSystem WMI class are incorrect in Windows 2000 and in
Windows Server 2003
http://support.microsoft.com/?kbid=885827

I hope the above info helps.

Have a nice day!

Bill Peng
MCSE 2000, MCDBA
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------

	Windows Server Forum Index -> Small Business Server 2003	All times are GMT
Page 1 of 1