Recently we noticed RSoP warnings on our Windows Server 2008 Server
Core Domain Controllers that re-occurred every five minutes in the
system as well as in the application eventlog, saying that it was
unable to log RSoP-Data for some reason. Resultant Set of Policies
(RSoP) is the combined result of all applied group policies, which is logged
for analysis reasons and can be seen with the Resultant Set of Policies
MMC-snap-in.
Log Name: System
Source: Microsoft-Windows-GroupPolicy
Event ID: 1091
Level: Warning
Description:
Windows could not record the Resultant Set of Policy (RSoP)
information for the Group Policy extension <Group Policy
Registry>. Group Policy settings successfully applied to the
computer or user; however, management tools may not report accurately.
Log Name: Application
Source: Group Policy Registry
Event ID: 4099
Level: Warning
Description:
The client-side extension could not log RSoP data because it failed
with error code '0x8004401e <unknown-message-text>'.After
some digging on the net, it turned out that it was related to Group
Policy Preference Client Side Extensions we used to distribute some
registry settings. The Group Policy Preference Client Side Extensions
are an addition to Windows Server 2008 respectively Windows Vista SP1
which can be installed on
Windows XP and
Windows Server 2003
as well. They add the possibility to distribute "preferences" rather
than "policies" in a very smart way. The functionality was named
PolicyMaker before, has been bought by Microsoft and is now
distributed freely as part of Windows.
Regarding those Group
Policy Preference Client Side Extensions, Microsoft obviously has been
to aggressive while stripping down server core, as it turns out that in
order to generate RSoP of these preferences, a WBEM (WMI) MOF file
(Managed Object Format) is needed but missing in server core.
Fortunately that can be fixed real easy:
1. Get
%SYSTEMROOT%\system32\wbem\polprocl.mof from a full Windows Server 2008 and copy it to the same path on the server core.
2. Get
%SYSTEMROOT%\system32\wbem\en-US\polprocl.mfl
from a full Windows Server 2008 and copy it to the same path on the
server core, where en-US should be replaced with the actual language
that is installed (repeat for every language pack installed)
3. On an administrative cmd do
mofcomp %SYSTEMROOT%\system32\wbem\polprocl.mofAfterwards issue a
gpupdate /force and the problem should be gone.