Each event recorded with the GroupPolicy source name can be categorized into one of many ranges of related events. These ranges help you determine start, end, success, failure, and so on for each event. Table 5 summarizes each event ID range.
Event ID Range
Description
4000–4007
Group Policy start events: These informational events appear in the event log when an instance of Group Policy processing begins.
4016–4299
Component start events: These informational events appear in the event log when a component of Group Policy processing begins the task described in the event.
5000–5299
Component success events: These informational events appear in the event log when a component of Group Policy processing successfully completes the task described in the event.
5300–5999
Informative events: These informational events appear in the event log during the entire instance of Group Policy processing and provide additional information about the current instance.
6000–6007
Group Policy warning events: These warning events appear in the event log when an instance of Group Policy processing completes with errors.
6017–6299
Component warning events: These warning events appear in the event log when a component of Group Policy processing completes the task described in the event with errors.
6300–6999
Informative warning events: These warning events appear in the event log to provide additional information about possible error conditions with the action described in the event.
7000–7007
Group Policy error events: These error events appear in the event log when the instance of Group Policy processing does not complete.
7017–7299
Component error events: These error events appear in the event log when a component of Group Policy processing does not complete the task described in the event.
7300–7999
Informative error events: These error events appear in the event log to provide additional information about the error condition with the action described in the event.
8000–8007
Group Policy success events: These informational events appear in the event log when the instance of Group Policy completes successfully.
Most of the events related to the GroupPolicy source appear in pairs. Group Policy processing includes a start event and an end event. The Event IDs within the 4000 range are all start events. These events are followed by events that fall in the other ranges, which are all ending events: error, fail, information, or success. Pairing the events will help you identify problems more quickly when using the Event Viewer and logs.
Table 6 summarizes all event IDs that occur in the System log for Group Policy.
Event ID
Event Type
Explanation
1002
Error
Failed Allocation: The Group Policy service logs this event when an attempt to allocate memory fails.
1006
DS Bind Failure: The Group Policy service logs this event when an attempt to authenticate to Active Directory fails.
1007
Site Query Failure: The Group Policy service logs this event when, using the credentials of the user or computer, an attempt to query the Active Directory Site fails.
1030
GPO Query Failure: The Group Policy service logs this event when an attempt to query a Group Policy objects fails.
1052
Computer Role Failure: The Group Policy service logs this event when an attempt to determine the role of the computer (workgroup, domain member, or domain controller) fails.
1053
Username Resolution Failure: The Group Policy service logs this event when an attempt to resolve a user name fails.
1054
DC Resolution Failure: The Group Policy service logs this event when an attempt to obtain the name of a domain controller fails.
1055
Computer Name Resolution Failure: The Group Policy service logs this event when an attempt to resolve a computer name fails.
1058
Policy Read Failure: The Group Policy service logs this event when an attempt to read the GPT.ini file of a Group Policy object fails.
1065
WMI Evaluation Failure: The Group Policy service logs this event when an attempt to evaluate a WMI filter fails.
1079
GPO Search Failure: The Group Policy service logs this event when an attempt to obtain a list of Group Policy objects fails.
1080
OU Search Failure: The Group Policy service logs this event when an attempt to search the Active Directory Organizational Unit hierarchy fails.
1085
Warning
CSE Failure Warning: The Group Policy service logs this event when a Group Policy CSE fails.
1088
Excessive GPO Failure: The Group Policy service logs this event when the scope of Group Policy objects for a computer or user exceeds 999.
1089
RSOP Session Failure: The Group Policy service logs this event when an RSoP session fails.
1090
WMI Failure: The Group Policy service logs this event when it encounters errors with the WMI service.
1091
RSOP CSE Failure: The Group Policy service logs this event when a Group Policy CSE fails to record RSoP information.
1095
RSOP Failure: The Group Policy service logs this event when an error occurs while recording RSoP information.
1096
Registry.pol Failure: The Group Policy service logs this event when an attempt to read the registry.pol file fails.
1097
Computer Token Failure: The Group Policy service logs this event when an attempt to read the computer’s authentication token fails.
1101
Object Not Found Failure: The Group Policy service logs this event when an attempt to locate an Active Directory object fails.
1104
WMI Filter Not Found Warning: The Group Policy service logs this event when an attempt to locate an associated WMI filter fails.
1109
Cross Forest GP Disabled Warning: The Group Policy service logs this event when an attempt is disabled to process Group Policy across a forest.
1110
Cross Forest Discovery Failure: The Group Policy service logs this event when an attempt fails to determine whether the user and computer belong to the same forest.
1112
CSE Synchronous Warning: The Group Policy service logs this event when a Group Policy CSE requires synchronous policy processing to apply one or more policy settings.
1126
Time Skew Failure: The Group Policy service logs this event when the time on the local computer is not synchronized with the time on the domain controller.
1128
CSE Disabled Warning: The Group Policy service logs this event when it disables a Group Policy CSE to prevent unexpected termination of the Group Policy service.
1129
DC Connectivity Failure: The Group Policy service logs this event when there is an absence of authenticated connectivity from the computer to the domain controller.
1130
Script Failure: The Group Policy service logs this event when an attempt fails to run a script.
1500
Informational
Computer Policy Processing: The Group Policy service logs this event when an instance of computer Group Policy processing completes without encountering new policy settings.
1501
User Policy Processing: The Group Policy service logs this event when an instance of user Group Policy processing completes without encountering new policy settings.
1502
Computer Policy Processing: The Group Policy service logs this event when an instance of computer Group Policy processing completes with new or changed policy settings.
1503
User Policy Processing: The Group Policy service logs this event when an instance of user Group Policy processing completes with new or changed policy settings.
Table 7 summarizes all Event IDs that occur in the Group Policy operational log.
Computer Start and End Events
4000
The Group Policy service logs this event when an instance of computer Group Policy processing begins.
6000
The Group Policy service logs this event when an instance of computer Group Policy processing completes with one or more errors.
7000
The Group Policy service logs this event when an instance of computer Group Policy processing fails to complete.
8000
Success
The Group Policy service logs this event when an instance of computer Group Policy processing completes successfully.
User Log-on Start and End Events
4001
The Group Policy service logs this event when an instance of user Group Policy processing begins.
6001
The Group Policy service logs this event when an instance of user Group Policy processing completes with one or more errors.
7001
The Group Policy service logs this event when an instance of user Group Policy processing fails to complete.
8001
The Group Policy service logs this event when an instance of user Group Policy processing completes successfully.
Computer Network Change Start and End Events
4002
The Group Policy service logs this event when a network change triggers the start of an instance of computer Group Policy processing.
6002
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a network change, completes with one or more errors.
7002
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a network change, fails to complete.
8002
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a network change, completes successfully.
User Network Change Start and End Events
4003
The Group Policy service logs this event when a network change triggers the start of an instance of user Group Policy processing.
6003
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a network change, completes with one or more errors.
7003
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a network change, fails to complete.
8003
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a network change, completes successfully.
Computer Manual Refresh Start and End Events
4004
The Group Policy service logs this event when a manual refresh triggers the start of an instance of computer Group Policy processing.
6004
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a manual refresh, completes with one or more errors.
7004
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a manual refresh, fails to complete.
8004
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a manual refresh, completes successfully.
User Manual Refresh Start and End Events
4005
The Group Policy service logs this event when a manual refresh triggers the start of an instance of user Group Policy processing.
6005
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a manual refresh, completes with one or more errors.
7005
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a manual refresh, fails to complete.
8005
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a manual refresh, completes successfully.
Computer Periodic Refresh Start and End Events
4006
The Group Policy service logs this event when a periodic refresh triggers the start of an instance of computer Group Policy processing.
6006
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a periodic refresh, completes with one or more errors.
7006
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a periodic refresh, fails to complete.
8006
The Group Policy service logs this event when an instance of computer Group Policy processing, triggered by a periodic refresh, completes successfully.
User Periodic Refresh Start and End Events
4007
The Group Policy service logs this event when a periodic refresh triggers the start of an instance of user Group Policy processing.
6007
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a periodic refresh, completes with one or more errors.
7007
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a periodic refresh, fails to complete.
8007
The Group Policy service logs this event when an instance of user Group Policy processing, triggered by a periodic refresh, completes successfully.
Client-Side Extension Processing
4016
The Group Policy service logs this event each time a Group Policy CSE begins processing.
5016
The Group Policy service logs this event when a Group Policy CSE completes its processing successfully.
6016
The Group Policy service logs this event when a Group Policy CSE completes its processing while encountering one or more errors.
7016
The Group Policy service logs this event when a Group Policy CSE fails to complete its processing.
Trace Events
4017
The Group Policy service logs this event to mark the beginning of the service making a system call.
5017
The Group Policy service logs this event when a system call completes successfully.
6017
The Group Policy service logs this event when a system call completes while encountering one or more errors.
7017
The Group Policy service logs this event when a system call fails to complete.
Scripts Processing
4018
The Group Policy service logs this event when it begins to process Group Policy scripts.
5018
The Group Policy service logs this event when Group Policy scripts processing completes successfully.
6018
The Group Policy service logs this event when Group Policy scripts processing completes while encountering one or more errors.
7018
The Group Policy service logs this event when Group Policy scripts processing fails to complete.
Individual Script Processing
4019
The Group Policy service logs this event when it begins to process an individual script during the processing of Group Policy scripts.
5019
The Group Policy service logs this event when an individual script, during Group Policy script processing, completes successfully.
6019
The Group Policy service logs this event when an individual script, during Group Policy script processing, completes while encountering one or more errors.
7019
The Group Policy service logs this event when an individual script, during Group Policy script processing, fails to complete.
Domain Controller Discovery
4326
The Group Policy service logs this event when it begins to discover an Active Directory domain controller.
5326
The Group Policy service logs this event when the discovery of an Active Directory domain controller completes successfully.
6326
The Group Policy service logs this event when the discovery of an Active Directory domain controller completes while encountering one or more errors.
7326
The Group Policy service logs this event when the discovery of an Active Directory domain controller fails to complete.
Domain Controller Information
5308
The Group Policy service logs this event when an attempt to display information about a discovered domain controller completes successfully.
6308
The Group Policy service logs this event when an attempt to display information about a discovered domain controller completes while encountering one or more errors.
7308
The Group Policy service logs this event when an attempt to display information about a discovered domain controller fails to complete.
Computer Information
5309
The Group Policy service logs this event when an attempt to display information about a computer completes successfully.
6309
The Group Policy service logs this event when an attempt to display information about a computer completes while encountering one or more errors.
7309
The Group Policy service logs this event when an attempt to display information about a computer fails to complete.
Security Principal Information
5310
The Group Policy service logs this event when an attempt to display security principal information about a user completes successfully.
6310
The Group Policy service logs this event when an attempt to display security principal information about a user completes while encountering one or more errors.
7310
The Group Policy service logs this event when an attempt to display security principal information about a user fails to complete.
Loopback Processing Mode
5311
The Group Policy service logs this event when an attempt to display information about loopback processing mode completes successfully.
6311
The Group Policy service logs this event when an attempt to display information about loopback processing mode completes while encountering one or more errors.
7311
The Group Policy service logs this event when an attempt to display information about loopback processing mode fails to complete.
Applied GPO List
5312
The Group Policy service logs this event when an attempt to display a list of applied Group Policy objects completes successfully.
6312
The Group Policy service logs this event when an attempt to display a list of applied Group Policy objects completes while encountering one or more errors.
7312
The Group Policy service logs this event when an attempt to display a list of applied Group Policy objects fails to complete.
Filtered GPO List
5313
The Group Policy service logs this event when an attempt to display a list of filtered Group Policy objects completes successfully.
6313
The Group Policy service logs this event when an attempt to display a list of filtered Group Policy objects completes while encountering one or more errors.
7313
The Group Policy service logs this event when an attempt to display a list of filtered Group Policy objects fails to complete.
Network Information
5314
The Group Policy service logs this event when an attempt to display network information completes successfully.
6314
The Group Policy service logs this event when an attempt to display network information completes while encountering one or more errors.
7314
The Group Policy service logs this event when an attempt to display network information fails to complete.
Next Policy Processing Information
5315
The Group Policy service logs this event when an attempt to display information about the next instance of Group Policy processing completes successfully.
6315
The Group Policy service logs this event when an attempt to display information about the next instance of Group Policy processing completes while encountering one or more errors.
7315
The Group Policy service logs this event when an attempt to display information about the next instance of Group Policy processing fails to complete.
Successful or Informational Interaction
5320
The Group Policy service logs this event to display successful information about the current instance of Group Policy processing.
6320
The Group Policy service logs this event to display warning information about the current instance of Group Policy processing.
7320
The Group Policy service logs this event to display failure information about the current instance of Group Policy processing.
5321
6321
7321
The events that end in 1 in these criteria typically have more verbose information in the log, but the information is similar to those events that end in 0.
Computer Start-up Wait Information
5322
The Group Policy service logs this event to display successful information about the service waiting for the network.
6322
The Group Policy service logs this event to display warning information about the service waiting for the network.
7322
The Group Policy service logs this event to display failure information about the service waiting for the network.
Winlogon Notification Information
5324
The Group Policy service logs this event to display successful information about a notification received from Winlogon.
6324
The Group Policy service logs this event to display warning information about a notification received from Winlogon.
7324
The Group Policy service logs this event to display failure information about a notification received from Winlogon.
Service Control Manager Notification Information
5325
The Group Policy service logs this event to display successful information about a notification received from the Service Control Manager.
6325
The Group Policy service logs this event to display warning information about a notification received from the Service Control Manager.
7325
The Group Policy service logs this event to display failure information about a notification received from the Service Control Manager.
Network Bandwidth Information
5327
The Group Policy service logs this event to display successful information about network bandwidth.
6327
The Group Policy service logs this event to display warning information about network bandwidth.
7327
The Group Policy service logs this event to display failure information about network bandwidth.
Service Configuration Information
5331
The Group Policy service logs this event to display successful information about the Group Policy service’s configuration.
6331
The Group Policy service logs this event to display warning information about the Group Policy service’s configuration.
7331
The Group Policy service logs this event to display failure information about the Group Policy service’s configuration.
Network Location Awareness Service Warning
6323
The Group Policy service logs this event to display warning information about the operability of the NLA service.
7323
The Group Policy service logs this event to display failure information about the operability of the NLA service.
Client-Side Failure Information
6330
The Group Policy service logs this event to display warning information about a Group Policy CSE that failed in an earlier instance of Group Policy processing.
