[gptalk] Re: Event ID 1047 Windows cannot read GPO history

  • From: "Darren Mar-Elia" <darren@xxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Thu, 28 Dec 2006 09:19:06 -0800

Cynthia-

One possibility relates to an issue that Alan Cuthberson brought up recently
on this list. When a new user logs into a new machine, their user profile is
created from c:\documents and settings\default user. Have you tweaked that
default profile in your image? Maybe it has history keys with old
information stored in it? If so, try cleaning up that default profile and
see if the problem goes away.

 

Darren

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Berridge Cynthia
Sent: Thursday, December 28, 2006 9:15 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: Event ID 1047 Windows cannot read GPO history

 

Darren,

 

I have noticed in my testing that this error appears on the first logon, if
a user profile does not exist.  The user can then subsequently logon

without this error.  I am testing to see if this error appears when a user
profile already exists.  I have been able to fix the issue by deleting the
history

and then loading the hive of the user profile experiencing the problem.  

 

We image our desktop computers, however there are many different variations
in the images.  We are working on standardizing, but you know how that goes.

It may be that there is something built into our image that is contributing
to this problem.  I find it interesting however, that it appears to be
occurring only on first logon.

All desktops are XP SP1.  Do you think it could have something to do with
how GPO is applied, asynchronous\synchronous?

 

Regards,

 

Cynthia Berridge

IT Dept.

Moore County Schools

 

 

  _____  

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Darren Mar-Elia
Sent: Thursday, December 28, 2006 12:05 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: Event ID 1047 Windows cannot read GPO history

Cynthia-

I've not seen this error before but one thing to keep in mind is that
history is held both per-computer and per-user, so in both HKLM and HKCU in
the registry. The latter is going to be tough to deal with for 5,000 users
because they have to be logged on in order to delete those history subkeys,
but by default, normal non-administrative users don't have access to those
keys. I really wonder if this is the true problem and if so, why its
happening on such a large scale. Have you been able to fix the problem by
deleting history on a single computer and user yet?

 

Darren

 

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Berridge Cynthia
Sent: Thursday, December 28, 2006 7:30 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Event ID 1047 Windows cannot read GPO history

 

Hello,

 

I am having a problem with Windows not reading the GPO history from the
registry on many computers. Event ID 1047 from Userenv is logged in the 

event logs.  I have followed instructions according to Microsoft Article
319006 and deleted the History sub keys from the registry as well as
deleting any existing profiles from the desktop.

The error continues to appear.  Does anyone know how to detect and repair
this problem on a large scale?  I have about 5,000 computers to work with.

 

Thank you,

 

Regards,

 

Cynthia Berridge

 

 

 

Other related posts: