Windows 7 Diagnosing and debugging Group Policy failures

[cjm51213_]

Hi Folks,

I have a Windows Seven domain member that is throwing a couple of errors. gpupdate/force produces the following:

Updating Policy...

User policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=User,cn={DCAEA284-B8F4-4754-8AFE-163010A87E2D},cn=policies,cn=system,DC=TCLC,DC=org. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

<SNIP ...>

Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object LDAP://CN=Machine,cn={6AC1786C-016F-11D2-945F-00C04fB984F9},cn=policies,cn=system,DC=TCLC,DC=org. Group Policy settings will not be resolved until this event is resolved. View the event details for more information on the file name and path that caused the failure.

<SNIP ...>

Let's ignore the first policy, {DC ... 2D}, which I know is a Security Certificates policy of my own construction, and I suspect the problem is an expired certificate, but consider the second policy, {6A ... F9}, which I know is the "Default Domain Controllers Policy", so it is pretty important.

The above failure appears on a desktop, which is not a domain controller, but the policy has a scope of "Authenticated Users" and "Domain Controllers", so the desktop should probably not be trying to apply it in the first place, which is still a failure of sorts.

I ask for instructions to diagnose and resolve this problem.

Thanks for the help,

Chris.

More...