How to eliminate re-occurring RSoP warnings in the eventlog on a Windows Server 2008 Server Core

rl — Tue, 18 Nov 2008 22:17:00 GMT

Recently we noticed RSoP warnings on our Windows Server 2008 Server Core Domain Controllers that re-occurred every five minutes in the system as well as in the application eventlog, saying that it was unable to log RSoP-Data for some reason. Resultant Set of Policies (RSoP) is the combined result of all applied group policies, which is logged for analysis reasons and can be seen with the Resultant Set of Policies MMC-snap-in.

Log Name:      System
Source:        Microsoft-Windows-GroupPolicy
Event ID:      1091
Level:         Warning
Description:      Windows could not record the Resultant Set of Policy (RSoP) information for the Group Policy extension <Group Policy Registry>. Group Policy settings successfully applied to the computer or user; however, management tools may not report accurately.

Log Name:      Application
Source:        Group Policy Registry
Event ID:      4099
Level:         Warning
Description:      The client-side extension could not log RSoP data because it failed with error code '0x8004401e <unknown-message-text>'.

After some digging on the net, it turned out that it was related to Group Policy Preference Client Side Extensions we used to distribute some registry settings. The Group Policy Preference Client Side Extensions are an addition to Windows Server 2008 respectively Windows Vista SP1 which can be installed on Windows XP and Windows Server 2003 as well. They add the possibility to distribute "preferences" rather than "policies" in a very smart way. The functionality was named PolicyMaker before, has been bought by Microsoft and is now distributed freely as part of Windows.

Regarding those Group Policy Preference Client Side Extensions, Microsoft obviously has been to aggressive while stripping down server core, as it turns out that in order to generate RSoP of these preferences, a WBEM (WMI) MOF file (Managed Object Format) is needed but missing in server core. Fortunately that can be fixed real easy:

1. Get %SYSTEMROOT%\system32\wbem\polprocl.mof from a full Windows Server 2008 and copy it to the same path on the server core.
2. Get %SYSTEMROOT%\system32\wbem\en-US\polprocl.mfl from a full Windows Server 2008 and copy it to the same path on the server core, where en-US should be replaced with the actual language that is installed (repeat for every language pack installed)
3. On an administrative cmd do mofcomp %SYSTEMROOT%\system32\wbem\polprocl.mof

Afterwards issue a gpupdate /force and the problem should be gone.

robertlacroix.com - Robert Lacroix : RSoP, mofcomp, WMI, MOF, Group Policy

How to eliminate re-occurring RSoP warnings in the eventlog on a Windows Server 2008 Server Core