[gptalk] Re: Event ID 1047 Windows cannot read GPO history

  • From: "Berridge Cynthia" <netcom3@xxxxxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Thu, 28 Dec 2006 12:15:18 -0500

I have noticed in my testing that this error appears on the first logon,
if a user profile does not exist.  The user can then subsequently logon
without this error.  I am testing to see if this error appears when a
user profile already exists.  I have been able to fix the issue by
deleting the history
and then loading the hive of the user profile experiencing the problem.

We image our desktop computers, however there are many different
variations in the images.  We are working on standardizing, but you know
how that goes.
It may be that there is something built into our image that is
contributing to this problem.  I find it interesting however, that it
appears to be occurring only on first logon.
All desktops are XP SP1.  Do you think it could have something to do
with how GPO is applied, asynchronous\synchronous?
Cynthia Berridge
IT Dept.
Moore County Schools


From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Thursday, December 28, 2006 12:05 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: Event ID 1047 Windows cannot read GPO history


I've not seen this error before but one thing to keep in mind is that
history is held both per-computer and per-user, so in both HKLM and HKCU
in the registry. The latter is going to be tough to deal with for 5,000
users because they have to be logged on in order to delete those history
subkeys, but by default, normal non-administrative users don't have
access to those keys. I really wonder if this is the true problem and if
so, why its happening on such a large scale. Have you been able to fix
the problem by deleting history on a single computer and user yet?





From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of Berridge Cynthia
Sent: Thursday, December 28, 2006 7:30 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Event ID 1047 Windows cannot read GPO history




I am having a problem with Windows not reading the GPO history from the
registry on many computers. Event ID 1047 from Userenv is logged in the 

event logs.  I have followed instructions according to Microsoft Article
319006 and deleted the History sub keys from the registry as well as
deleting any existing profiles from the desktop.

The error continues to appear.  Does anyone know how to detect and
repair this problem on a large scale?  I have about 5,000 computers to
work with.


Thank you,




Cynthia Berridge




Other related posts: