Group policy with WMI filters can be denied or cause slow logon/boot

Article ID: 2663850 - View products that this article applies to.
Expand all | Collapse all

Symptoms

Group policy with WMI filter fails to apply. The WMI query ( WMI filter linked to a GPO ) times out due to which the GPO does not apply to the computers, intermittently.

GPSVC logs show the following :

GPSVC(320.af8) 12:00:14:840 FilterCheck: Evaluate returned error. hr=0x80041069
GPSVC(320.af8) 12:00:14:840 ProcessGPO: The GPO does not pass the filter check and so will not be applied.

ERR for 0x80041069 gives the following result :

# for hex 0x80041069 / decimal -2147217303
  WBEM_E_TIMED_OUT                                               wbemcli.h
# as an HRESULT: Severity: FAILURE (1), FACILITY_ITF (0x4), Code 0x1069
# for hex 0x1069 / decimal 4201
  ERROR_WMI_INSTANCE_NOT_FOUND                                   winerror.h
# The instance name passed was not recognized as valid by a
# WMI data provider.
# 2 matches found for "0x80041069"

Cause

WMI filtering was taking time while being processed. It was trying to enumerate all the domain names as query used was :

[Select * from Win32_NTDomain where ClientSiteName = "XYZ" ]

Resolution

Add domain name component to the WMI query to resolve the issue ( along with the AND operator ): 

Select * from Win32_NTDomain where DomainName = "Domain_name" AND ClientSiteName = "XYZ"

Make sure the below hotfix is already installed :

After you apply a WMI filter, the GPO does not take effect on a client computer that is running Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/979383

More information

Timeout for WMI queries :

Per-Vista = None
Vista onwards = 30 seconds ( hardcoded )

Behavioral change when using WMI-Filter in a GPO
http://support.microsoft.com/kb/2587435

In one of the cases, it was informed that removing customized security filtering from the GPO ( that has WMI filter configured ) resolved the issue, however, it has not been tested or verified.
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use for other considerations.

Properties

Article ID: 2663850 - Last Review: July 30, 2012 - Revision: 3.0
Applies to
  • Windows Server 2008 Enterprise
  • Windows Server 2008 R2 Enterprise
  • Windows Server 2008 R2 Service Pack 1
  • Windows Server 2008 R2 Standard
  • Windows Server 2008 Service Pack 2
  • Windows Server 2008 Standard
Keywords: 
KB2663850

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com