| Event Id | 1047 |
| Source | userenv |
| Description | Windows cannot read the history of GPOs from the registry. Continuing Group Policy Processing. |
| Event Information | Explanation : Each time Group Policy Objects (GPOs) are processed, a record of all of the GPOs applied to the user or computer is written to the registry (in a GPO list). To optimize performance, Group Policy compares this GPO list to the current list to determine if there are any GPOs that need to be applied. This event occurs when Group Policy is unable to read the registry to determine the list of GPOs that were applied last. Group Policy processing continues. This behavior might occur if some values (such as Options or FileSysPath) are missing in subkeys of the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History When this occurs, Group Policy cannot be applied on the computer. User Action : To troubleshoot this problem, try the following: To resolve this behavior: Use Registry Editor Regedt32 to check the permissions on the History key. Make sure that the permissions are: - Administrators (Read, Full Control) - Authenticated Users (Read) - System (Read, Full Control) Delete all of the subkeys in the History key, and then refresh the group policy. To immediately regenerate the deleted keys in the registry, type the following command at a command prompt on the affected computer: secedit /refreshpolicy machine_policy /enforce The subkeys are re-created in the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History You can also check the Application event log for informational Userenv event ID 1704. |
| Reference Links | More Information |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.