| Event Id | 1065 |
| Source | Microsoft-Windows-GroupPolicy |
| Description | The processing of Group Policy failed. Windows could not evaluate the Windows Management Instrumentation (WMI) filter for the Group Policy object (GPO) %8. This could be caused by RSoP being disabled or Windows Management Instrumentation (WMI) service being disabled or stopped, or other WMI errors. Make sure the WMI service is started and the startup type is set to Automatic. New GPOs or settings will not be processed until this event has been resolved. |
| Event Information | According to Microsoft : Cause : This event is logged when the processing Policy failed and windows could not evaluate the windows Management instrusion filter for the Group policy Object.This could be caused by RSoP being disabled or windows management instrumentation service being disabled or stopped. Resolution : Correct a failed WMI filter Group Policy relies on Windows Management Instrumentation (WMI) to evaluate filters that determine if a Group Policy object is applied to a computer or user. Windows cannot apply Group Policy objects to users or computer if it cannot evaluate WMI filters. Possible resolutions include: 1.Ensure the Windows Management Instrumentation (WMI) service is enabled and configured for automatic startup. 2.Ensure the path, %Systemroot%\System32\Wbem, is included in the PATH system environment variable. 3.Ensure the computer can evaluate WMI queries. To start the Windows Management Instrumentation Tester utility: a)Open the Start menu and then clickAll Programs. Click Accessories and then clickRun. b)Type wbemtest.exe in the box and then clickOK. c)Click Connect. In the namespace box type root\cimv2. ClickConnect. d)ClickQuery. Type Select * from WIN32_OperatingSystem in the Enter Query box. e)ClickApply. A successful query returns one object. Verify : Group Policy applies during computer startup and user logon. Afterward, Group Policy applies every 90 to 120 minutes. Events appearing in the event log may not reflect the most current state of Group Policy. Therefore, you should always refresh Group Policy to determine if Group Policy is working correctly. To refresh Group Policy on a specific computer: 1.Open theStart menu. ClickAll Programs and then clickAccessories. 2.ClickCommand Prompt. 3.In the command prompt window, typegpupdate and then press ENTER. 4.When the gpupdate command completes, open the Event Viewer. |
| Reference Links | Event ID 1065 from Source Microsoft-Windows-GroupPolicy |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.