Group policy with WMI filters can be denied or cause slow logon/boot

S’applique à : Windows Server 2008 EnterpriseWindows Server 2008 R2 EnterpriseWindows Server 2008 R2 Service Pack 1

Symptoms


Group policy with WMI filter fails to apply. The WMI query ( WMI filter linked to a GPO ) times out due to which the GPO does not apply to the computers, intermittently.

GPSVC logs show the following :

GPSVC(320.af8) 12:00:14:840 FilterCheck: Evaluate returned error. hr=0x80041069
GPSVC(320.af8) 12:00:14:840 ProcessGPO: The GPO does not pass the filter check and so will not be applied.

ERR for 0x80041069 gives the following result :

# for hex 0x80041069 / decimal -2147217303
  WBEM_E_TIMED_OUT                                               wbemcli.h
# as an HRESULT: Severity: FAILURE (1), FACILITY_ITF (0x4), Code 0x1069
# for hex 0x1069 / decimal 4201
  ERROR_WMI_INSTANCE_NOT_FOUND                                   winerror.h
# The instance name passed was not recognized as valid by a
# WMI data provider.
# 2 matches found for "0x80041069"

Cause


WMI filtering was taking time while being processed. It was trying to enumerate all the domain names as query used was :

[Select * from Win32_NTDomain where ClientSiteName = "XYZ" ]

Resolution


Add domain name component to the WMI query to resolve the issue ( along with the AND operator ): 

Select * from Win32_NTDomain where DomainName = "Domain_name" AND ClientSiteName = "XYZ"

Make sure the below hotfix is already installed :

After you apply a WMI filter, the GPO does not take effect on a client computer that is running Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/979383

More Information


Timeout for WMI queries :

Per-Vista = None
Vista onwards = 30 seconds ( hardcoded )

Behavioral change when using WMI-Filter in a GPO
http://support.microsoft.com/kb/2587435

In one of the cases, it was informed that removing customized security filtering from the GPO ( that has WMI filter configured ) resolved the issue, however, it has not been tested or verified.