Group policy ошибка 1085

• Remove From My Forums

Event ID 1085 on DC — Failed to Apply the Group Policy Local Users and Groups Settings

• Question

• I have a domain with 2 DCs.  The primary DC is running Server 2012 and is raising Event ID 1085 every 10 minutes and 20 seconds.

  Windows failed to apply the Group Policy Local Users and Groups settings. Group Policy Local Users and Groups settings might have its own log file. Please click on the «More information» link.

  System
  
    - Provider 
  
     [ Name]  Microsoft-Windows-GroupPolicy 
     [ Guid]  {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9} 
   
     EventID 1085 
   
     Version 0 
   
     Level 3 
   
     Task 0 
   
     Opcode 1 
   
     Keywords 0x8000000000000000 
   
    - TimeCreated 
  
     [ SystemTime]  2014-10-20T20:09:03.706992400Z 
   
     EventRecordID 130087 
   
    - Correlation 
  
     [ ActivityID]  {FDDFB8C5-9ECF-41B9-B2B4-3AD0B345A37A} 
   
    - Execution 
  
     [ ProcessID]  1000 
     [ ThreadID]  3280 
   
     Channel System 
   
     Computer SERVER.DOMAIN.NAME
   
    - Security 
  
     [ UserID]  S-1-5-18 
   
  
  - EventData 
  
    SupportInfo1 1 
    SupportInfo2 4404 
    ProcessingMode 0 
    ProcessingTimeInMilliseconds 10343 
    ErrorCode 183 
    ErrorDescription Cannot create a file when that file already exists.  
    DCName SERVER.DOMAIN.name
    ExtensionName Group Policy Local Users and Groups 
    ExtensionId {17D89FEC-5C44-4972-B12D-241CAEF74509} 

  Everything I look up for Event ID 1085 seems to be about a different cause.

  Any ideas?

  • Edited by

    Monday, October 20, 2014 8:38 PM

Hi All,

I have a large domain and a long list of websites that are trusted using the following group policy setting:

Administrative Templates > Windows Components > Internet Explorer> Internet Control Panel > Security Page >
Site to Zone Assignment List

On all (XP/vista/win7) workstations across the domain I’m getting the following error:

Log Name:  System
Source:  Microsoft-Windows-GroupPolicy
Event ID: 1085
Task Category: None
Level: Warning
Keywords:   Description: Windows failed to apply the Internet Explorer Zonemapping settings. Internet Explorer Zonemapping settings might have its own log file.

There’s nothing either side of this error in the log that shines any more light on the issue.

I know which group policy object its applying these settings but cant find which of the entries in the site to zone assignment list is causing this issue. I looked in the
Group Policy/Operational log but all I see is the following entry which says «completed» but is logged as an error:

After some research I’m guessing that the issue is an incorrect wild-card. This is what my trusted sites list looks like (with names removed of course):

Is there something obviously incorrect here?
Does anyone know where I could find an article that clearly outlines the acceptable wildcard syntax for the
«Security page site to zone assignment list» group policy?  Ive read every forum post, website and blog I could find on the internet but nothing is clear and I wasn’t able to find an MS document that steps it out. I’ve also changed the
existing list a number of times based on blog posts etc but had no luck.

**Please Note**
I dont want to change to a different method or have an intellectual debate re why I would have these sites/wildacrd/policy set. I’m really looking to see what entry is invalid and where the documentation is for this policy setting so i can make sure they are
always correct in the future. 

thanks in advance for your time and assistance
Simone

PS: I’ve already read the following posts a number of times:

• I get no data but have identified the GP that is causing the issue:

  A test case for troubleshooting group policy application – Event ID 1085 and 7016 — http://blogs.technet.com/b/askds/archive/2008/08/21/a-test-case-for-troubleshooting-group-policy-application-event-id-1085-and-7016.aspx 
  

• I dont have any 2 letter domain names:
  Problems Adding Top-Level Domains to Zone Sites List — http://support.microsoft.com/kb/259493
  
• I tried formatting the list per this article:
  [Solved] The Group Policy client-side extension Internet Explorer Zonemapping failed to execute  — http://daily-it.blogspot.com.au/2008/09/solved-group-policy-client-side.html
• Has no domain wildcard format info:
  Behavior of Site to Zone Assignment List  — http://blogcastrepository.com/blogs/mattbro/archive/2006/09/07/2183.aspx
• Great article, no wildcard data:
  Internet Explorer Policy Settings  — http://technet.microsoft.com/en-us/library/bb457144.aspx

• Internet zonemapping problem: http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/a8756a27-b562-42ad-8782-87d284e6bcfb/
• Spiceworks Event 1085 (Warning) — http://community.spiceworks.com/windows_event/show/1582-microsoft-windows-grouppolicy-1085
• Event ID 1085 — Application of Group Policy — http://technet.microsoft.com/en-us/library/cc727303%28v=ws.10%29.aspx
  Application of group policy — http://technet.microsoft.com/en-us/library/cc727312%28v=ws.10%29.aspx
• Evt ID 1085 GP client-side extension IE ZoneMapping failed to exec  — http://www.winvistatips.com/evt-id-1085-gp-client-side-extension-ie-zonemapping-failed-exec-t706399.html
• Event 1085 — Internet Explorer Zonemapping — http://www.minasi.com/forum/topic.asp?TOPIC_ID=29206
• EventID.net — http://www.eventid.net/display.asp?eventid=1085&eventno=1412&source=Userenv&phase=1
• Event ID 1085 — Internet Explorer Zonemapping failed to execute — http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_24897522.html

.

.

.

UPDATE:

I disabled the original policy and created a new one with only one trusted site address in it. Then I logged into a clean test machine did some testing.What I found after a few hours of testing was; regardless of the site that I have listed in group policy
—

• The HKCUSoftwarePoliciesMicrosoftCurrent versionInternet SettingsZone Map Key registry entry is
  always updated with that entry on the workstation. So the workstation’s registry always updates the key with
  *.sitename.com per the site that I have set in GP
• If I run GPUPDATE /FORCE over and over again, on the same machine, under the same user account, using the same DC I get:
  Failure, Failure, Failure, Success, Success, Success, Failure etc

I wasn’t able to determine any pattern to the failures, I tried stopping some of the processes on that machine but didn’t find anything that would make it fail/succeed reliably.
There is no AV or firewalls installed on my test machine

Anyone have any more ideas?  I think I might install filemon and try to capture some more data unless there’s a better tool?

• Edited by

  Wednesday, August 15, 2012 6:14 AM

Hi All,

I have a large domain and a long list of websites that are trusted using the following group policy setting:

Administrative Templates > Windows Components > Internet Explorer> Internet Control Panel > Security Page >
Site to Zone Assignment List

On all (XP/vista/win7) workstations across the domain I’m getting the following error:

Log Name:  System
Source:  Microsoft-Windows-GroupPolicy
Event ID: 1085
Task Category: None
Level: Warning
Keywords:   Description: Windows failed to apply the Internet Explorer Zonemapping settings. Internet Explorer Zonemapping settings might have its own log file.

There’s nothing either side of this error in the log that shines any more light on the issue.

I know which group policy object its applying these settings but cant find which of the entries in the site to zone assignment list is causing this issue. I looked in the
Group Policy/Operational log but all I see is the following entry which says «completed» but is logged as an error:

After some research I’m guessing that the issue is an incorrect wild-card. This is what my trusted sites list looks like (with names removed of course):

Is there something obviously incorrect here?
Does anyone know where I could find an article that clearly outlines the acceptable wildcard syntax for the
«Security page site to zone assignment list» group policy?  Ive read every forum post, website and blog I could find on the internet but nothing is clear and I wasn’t able to find an MS document that steps it out. I’ve also changed the
existing list a number of times based on blog posts etc but had no luck.

**Please Note**
I dont want to change to a different method or have an intellectual debate re why I would have these sites/wildacrd/policy set. I’m really looking to see what entry is invalid and where the documentation is for this policy setting so i can make sure they are
always correct in the future. 

thanks in advance for your time and assistance
Simone

PS: I’ve already read the following posts a number of times:

• I get no data but have identified the GP that is causing the issue:

  A test case for troubleshooting group policy application – Event ID 1085 and 7016 — http://blogs.technet.com/b/askds/archive/2008/08/21/a-test-case-for-troubleshooting-group-policy-application-event-id-1085-and-7016.aspx 
  

• I dont have any 2 letter domain names:
  Problems Adding Top-Level Domains to Zone Sites List — http://support.microsoft.com/kb/259493
  
• I tried formatting the list per this article:
  [Solved] The Group Policy client-side extension Internet Explorer Zonemapping failed to execute  — http://daily-it.blogspot.com.au/2008/09/solved-group-policy-client-side.html
• Has no domain wildcard format info:
  Behavior of Site to Zone Assignment List  — http://blogcastrepository.com/blogs/mattbro/archive/2006/09/07/2183.aspx
• Great article, no wildcard data:
  Internet Explorer Policy Settings  — http://technet.microsoft.com/en-us/library/bb457144.aspx

• Internet zonemapping problem: http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/a8756a27-b562-42ad-8782-87d284e6bcfb/
• Spiceworks Event 1085 (Warning) — http://community.spiceworks.com/windows_event/show/1582-microsoft-windows-grouppolicy-1085
• Event ID 1085 — Application of Group Policy — http://technet.microsoft.com/en-us/library/cc727303%28v=ws.10%29.aspx
  Application of group policy — http://technet.microsoft.com/en-us/library/cc727312%28v=ws.10%29.aspx
• Evt ID 1085 GP client-side extension IE ZoneMapping failed to exec  — http://www.winvistatips.com/evt-id-1085-gp-client-side-extension-ie-zonemapping-failed-exec-t706399.html
• Event 1085 — Internet Explorer Zonemapping — http://www.minasi.com/forum/topic.asp?TOPIC_ID=29206
• EventID.net — http://www.eventid.net/display.asp?eventid=1085&eventno=1412&source=Userenv&phase=1
• Event ID 1085 — Internet Explorer Zonemapping failed to execute — http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_24897522.html

.

.

.

UPDATE:

I disabled the original policy and created a new one with only one trusted site address in it. Then I logged into a clean test machine did some testing.What I found after a few hours of testing was; regardless of the site that I have listed in group policy
—

• The HKCUSoftwarePoliciesMicrosoftCurrent versionInternet SettingsZone Map Key registry entry is
  always updated with that entry on the workstation. So the workstation’s registry always updates the key with
  *.sitename.com per the site that I have set in GP
• If I run GPUPDATE /FORCE over and over again, on the same machine, under the same user account, using the same DC I get:
  Failure, Failure, Failure, Success, Success, Success, Failure etc

I wasn’t able to determine any pattern to the failures, I tried stopping some of the processes on that machine but didn’t find anything that would make it fail/succeed reliably.
There is no AV or firewalls installed on my test machine

Anyone have any more ideas?  I think I might install filemon and try to capture some more data unless there’s a better tool?

• Edited by

  Wednesday, August 15, 2012 6:14 AM

1. 3rd March 2009, 12:03 PM #1

   Hi all,

   im getting event ID (1085) for a certain number of computers in the event log and this message relating to folder redirection.

   «The Group Policy client-side extension Folder Redirection failed to execute. Please look for any errors reported earlier by that extension.».

   The error message immediately before this is Event ID 111 and the error message is

   «Unable to apply folder redirection policy, initialization failed.».

   This is causing real problems because i think its related to another problem where he computers arent loading the user group policies either!

   This has really stumped me.

   Thanks

   James

   ---

2. 3rd March 2009, 12:39 PM #2

   This is typically related to redirecting My Documents, but it can also be linked to Redirecting Start Menus and Desktops too.

   Check that users have Full Control of their My Documents. Some users report problems redirecting folders since installing Windows XP SP3, but it’s strange because I have deployed SP3 quite a bit now and haven’t suffered from this problem

   ---

3. 3rd March 2009, 12:57 PM #3

   HI

   Is this any help.

   Event ID 1085 Source Userenv

   Richard

   ---

4. 3rd March 2009, 02:16 PM #4

   Originally Posted by Michael

   This is typically related to redirecting My Documents, but it can also be linked to Redirecting Start Menus and Desktops too.

   Check that users have Full Control of their My Documents. Some users report problems redirecting folders since installing Windows XP SP3, but it’s strange because I have deployed SP3 quite a bit now and haven’t suffered from this problem

   I had this exact issue. Removed SP3 and all worked fine afterwards.

   ---

5. 3rd March 2009, 02:21 PM #5

   Same here.. exact same problem with SP3.. was driving me nuts, until I built a new machine and tested after every update. Stopped working right after SP3…

   ---

6. 3rd March 2009, 02:23 PM #6

   Thanks for the replies

   The starange thing is that this only happens on about 5-6 computers. All the others are fine.

   Might be a silly question, but can computers have permissions, like users can?

   Its just like the 6 computers dont have the correct permissions to read the group policies that invoke the folder redirection and other user policies.

   James

   ---

7. 3rd March 2009, 02:26 PM #7

   From memory, I think it’s also related to how you setup your user shares. Under Folder Redirection I use ‘Redirect to the user’s home directory’ and setup their shares as servernameshare$ in AD.

   Be interesting to see which method you’re using — both Admiral208 and sippo.

   ---

8. 3rd March 2009, 02:40 PM #8

   We use Basic Redirection and redirect to the users home directory.

   We have one shared folder, which is then split into staff and students- which then splits to year joined.

   ---

9. 3rd March 2009, 03:47 PM #9

   Oh well, knocks that theory on the head. Something must be different though!

   ---

10. 28th June 2011, 11:45 AM #10

    I’ve been encountering this error recently. Other symptoms included programs not working correctly, IE moaning about security and other settings — These were tracked to the HKCU (ntuser.dat) being problematic. Odley I think I have finally fixed the problem when I checked the DNS and found a (Same as parent) Address record with the wrong IP address. SOA, and NS records were both correct.

    ---

11. 22nd September 2011, 01:55 PM #11

    Just to dig this post up — I just had this problem with re-directed desktop and start menu folders, the problem was I was re-directing users to a shared desktop and startmenu, but had the ‘Grant user exclusive rights’ box checked. Clearing this fixed it right away.

    Hope this is of help to someone.

    ---

SHARE:

• Remove From My Forums

• Question

•  

  Hi everybody,

  We are getting Event ID 1085 errors after adding «http://*.gob.es» in Group Policy Internet Zonemapping

  We have enabled Userenv logging and followed the steps provided in  http://blogs.technet.com/b/askds/archive/2008/08/21/a-test-case-for-troubleshooting-group-policy-application-event-id-1085-and-7016.aspx

  After adding the entry «http://*.gob.es», the log looks like this:
  USERENV(2c8.1c0) 14:49:11:600 LogExtSessionStatus: Successfully logged Extension Session data
  USERENV(2c8.1c0) 14:49:11:615 ProcessGPOList: Extension Internet Explorer Zonemapping returned 0x57.
  USERENV(2c8.1c0) 14:49:11:615 ProcessGPOList: Extension Internet Explorer Zonemapping doesn’t support rsop logging
  USERENV(2c8.1c0) 14:49:11:615 ProcessGPOs: Extension Internet Explorer Zonemapping ProcessGroupPolicy failed, status 0x57.
  

  We have tested several valid formats 

  http://*.gob.es
  https://*.gob.es
  *://*.gob.es

  But the error keeps appearing in event viewer

  We have tried with another domains and it works.

  And even more tricky, in the registry of an affected user we can see these registry entries:

  HKEY_CURRENT_USERsoftwarepoliciesmicrosoftwindowscurrentversioninternet settingszonemapkey
      *://*.contoso.com   REG_SZ  2
      *://*.gob.es        REG_SZ  2

  This entry (*.gob.es) references all the ministerial and government pages in Spain
  We are very interested into adding this entry instead of adding each subdomain of gob.es

  Thank you very much in advanced.

  Sincerely yours.

  Ramiro Cascallana

  ---

  Ramiro Cascallana MCDST MCSA

• Remove From My Forums

• Question

•  

  Hi everybody,

  We are getting Event ID 1085 errors after adding «http://*.gob.es» in Group Policy Internet Zonemapping

  We have enabled Userenv logging and followed the steps provided in  http://blogs.technet.com/b/askds/archive/2008/08/21/a-test-case-for-troubleshooting-group-policy-application-event-id-1085-and-7016.aspx

  After adding the entry «http://*.gob.es», the log looks like this:
  USERENV(2c8.1c0) 14:49:11:600 LogExtSessionStatus: Successfully logged Extension Session data
  USERENV(2c8.1c0) 14:49:11:615 ProcessGPOList: Extension Internet Explorer Zonemapping returned 0x57.
  USERENV(2c8.1c0) 14:49:11:615 ProcessGPOList: Extension Internet Explorer Zonemapping doesn’t support rsop logging
  USERENV(2c8.1c0) 14:49:11:615 ProcessGPOs: Extension Internet Explorer Zonemapping ProcessGroupPolicy failed, status 0x57.
  

  We have tested several valid formats 

  http://*.gob.es
  https://*.gob.es
  *://*.gob.es

  But the error keeps appearing in event viewer

  We have tried with another domains and it works.

  And even more tricky, in the registry of an affected user we can see these registry entries:

  HKEY_CURRENT_USERsoftwarepoliciesmicrosoftwindowscurrentversioninternet settingszonemapkey
      *://*.contoso.com   REG_SZ  2
      *://*.gob.es        REG_SZ  2

  This entry (*.gob.es) references all the ministerial and government pages in Spain
  We are very interested into adding this entry instead of adding each subdomain of gob.es

  Thank you very much in advanced.

  Sincerely yours.

  Ramiro Cascallana

  ---

  Ramiro Cascallana MCDST MCSA

Event Type: Error

Event Source: Userenv

Event Category: None

Event ID: 1085

Date: 7/29/2008

Time: 11:03:23 AM

User: NT AUTHORITYSYSTEM

Computer: M1

Description:

The Group Policy client-side extension Internet Explorer Zonemapping failed to

execute. Please look for any errors reported earlier by that extension.

Log Name: Microsoft-Windows-GroupPolicy/Operational

Source: Microsoft-Windows-GroupPolicy

Date: 7/29/2008 11:39:53 AM

Event ID: 7016

Task Category: None

Level: Error

Keywords:

User: SYSTEM

Computer: M7.contoso.com

Description:

Completed Internet Explorer Zonemapping Extension Processing in 31 milliseconds.

Event Xml:

<Event xmlns=»

>

<System>

<Provider Name=»Microsoft-Windows-GroupPolicy»

Guid=»{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}» />

<EventID>7016</EventID>

<Version>0</Version>

<Level>2</Level>

<Task>0</Task>

<Opcode>2</Opcode>

<Keywords>0x4000000000000000</Keywords>

<TimeCreated SystemTime=»2008-07-29T15:39:53.866Z» />

<EventRecordID>6128</EventRecordID>

<Correlation ActivityID=»{917B65C2-7289-4E9C-8CE0-2364319F6D66}» />

<Execution ProcessID=»1092″ ThreadID=»2332″ />

<Channel>Microsoft-Windows-GroupPolicy/Operational</Channel>

<Computer>M7.contoso.com</Computer>

<Security UserID=»S-1-5-18″ />

</System>

<EventData>

<Data Name=»CSEElaspedTimeInMilliSeconds»>31</Data>

<Data Name=»ErrorCode»>87</Data>

<Data Name=»CSEExtensionName»>Internet Explorer Zonemapping</Data>

<Data Name=»CSEExtensionId»>{4CFB60C1-FAA6-47F1-89AA-0B18730C9FD3}</Data>

</EventData>

</Event>

C:err 0x57

# for hex 0x57 / decimal 87 :

XNS_INTERNAL_ERROR                                            bugcodes.h

MSG_E_BAD_DEFAULT_CA_XCHG_CSP                                 certlog.mc

# Certificate Services could not use the default provider for

# encryption keys.  %1

LLC_STATUS_INADEQUATE_LINKS                                   dlcapi.h

NMERR_FRAME_HAS_NO_CAPTURE                                    netmon.h

ERROR_INVALID_PARAMETER                                       winerror.h

# The parameter is incorrect.

LDAP_FILTER_ERROR                                             winldap.h

# 6 matches found for «0x57»

Value Path:

HKLMSOFTWAREMicrosoftWindows NTCurrentVersionDiagnostics

Value Name:

GPSvcDebugLevel

Value Type:

REG_DWORD

Value Data:

30002 (hex)

GPSVC(444.91c) 17:03:40:02 SetRegistryValue: ListBox_Support_ZoneMapKey => 1 [OK]

GPSVC(444.91c) 17:03:40:02 SetRegistryValue:

192.168.*

=> 1 [OK]

KeyName: SoftwarePoliciesMicrosoftWindowsCurrentVersionInternet Settings

ValueName: ListBox_Support_ZoneMapKey

ValueType: REG_DWORD

Value: 0x00000001

KeyName: SoftwarePoliciesMicrosoftWindowsCurrentVersionInternet SettingsZoneMapKey

ValueName: 192.168.*

ValueType: REG_SZ

Value: 1