Group Policy processing errors: event IDs 1058, 1030, 1129 and more with fixes

When gpupdate reports that policy could not be updated, the useful detail is in the System log: a Group Policy event such as 1058, 1030 or 1129, plus an error code on the event's Details tab. This reference lists the processing errors Microsoft documents, what each one means, the usual cause and the first check, then the gpupdate and gpresult messages, the SceCli 1202 security policy warnings and a short routine to prove the fix.

How to read these codes#

• System log: in Event Viewer, open Windows Logs › System and filter on the source Microsoft-Windows-GroupPolicy. Errors describe the failure and its probable causes; warnings point to something that needs attention before it fails.
• Details tab: the event names the domain controller it used and an error code, shown in decimal with its description. The same event ID has several causes, so the error code decides the fix. The User field shows the user name for user policy and SYSTEM for computer policy.
• Operational log: Applications and Services Logs › Microsoft › Windows › GroupPolicy › Operational records every step of a cycle, including the GPOs that applied and the ones that were denied, with the reason. Starting events pair with ending events (4016 when a client-side extension starts, 5016 when it completes successfully), so the step without a good ending is where processing broke.
• gpupdate and gpresult: gpupdate /force prints the same message as the event; gpresult /h gp.html from an elevated prompt shows applied and denied GPOs and the errors of the last cycle.

Each refresh gets its own ActivityID. Copy it from the System event (Details › Friendly view › System), then create a custom view (Custom Views › Create Custom View › XML, check Edit query manually) that shows only that cycle:

<QueryList><Query Id="0" Path="Application"><Select Path="Microsoft-Windows-GroupPolicy/Operational">*[System/Correlation/@ActivityID='{INSERT ACTIVITY ID HERE}']</Select></Query></QueryList>

Recent Group Policy errors and warnings from PowerShell, and Group Policy service debug logging for when the events aren't enough (the usermode folder must exist, or no gpsvc.log is written):

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-GroupPolicy'; Level=2,3} -MaxEvents 20 |
    Format-List TimeCreated, Id, LevelDisplayName, Message

New-Item -Path "$env:windir\debug\usermode" -ItemType Directory -Force | Out-Null
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /t REG_DWORD /d 0x00030002 /f
gpupdate /force    # then read %windir%\debug\usermode\gpsvc.log

System log errors: reaching the domain controller and SYSVOL#

The Group Policy service logs these on the client, or on a domain controller processing its own policy. Windows retries at the next refresh cycle, so a single event after a reboot or VPN change can be transient; a repeating one is not.

Error codes on the Details tab#

Microsoft documents these codes for 1058, 1006 and 1053. Test as the account that failed: SYSTEM (the computer account) for computer policy, the signed-in user for user policy.

gpupdate, gpresult and Operational log messages#

Security policy warnings: SceCli 1202#

User rights, restricted groups and other security settings go through the security extension, which logs event 1202 from SceCli in the Application log: Security policies were propagated with warning. followed by a Win32 error code. To find the item that failed, turn on the extension's debug log, refresh, and search it:

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}" /v ExtensionDebugLevel /t REG_DWORD /d 2 /f
gpupdate /target:computer /force
find /i "cannot find" %SYSTEMROOT%\security\logs\winlogon.log
find /i "<account name>" %SYSTEMROOT%\security\templates\policies\gpt*.*

The cached template's GPOPath= line holds the GPO's GUID; Get-GPO -Guid <guid> on a server with the RSAT Group Policy tools returns its display name. Remove or replace the bad entry in that GPO.

How to verify a fix#

1. Run gpupdate /force. Good looks like Computer Policy update has completed successfully. and User Policy update has completed successfully. with no list of errors.
2. In the System log, the error stops repeating and a Group Policy success event follows for the same processing type.
3. Run gpresult /h gp.html elevated: the GPO is listed as applied, the report shows no errors, and every denied GPO has a reason you expect (security filtering, WMI filter, empty).
4. For access-denied codes on a computer, check the machine account: Test-ComputerSecureChannel -Verbose should return True and say the secure channel is in good condition.
5. For SceCli 1202, run gpupdate /target:computer /force again: no new 1202 warning. Then set ExtensionDebugLevel back to 0.
6. Turn off gpsvc logging when you're done:

reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /t REG_DWORD /d 0x00000000 /f

Related: Kerberos error codes, LDAP bind errors and domain join errors.

References#

• Applying Group Policy troubleshooting guidance (events 1129, 1002, 1006, 1030, 1058, 1053, 1097, 5016 and gpsvc logging)
• Troubleshoot SCECLI 1202 events
• Force synchronization for DFSR-replicated SYSVOL