Hello Everyone,
I have recently run into a strange problem with a new policy that I am working on. We have a domain running in 2003 mode. On a DC running 2012R2 I have created a user policy that uses the following settings:
For some odd reason this policy applies to some computers without problems but is not appliedcompletely on some others. On the problematic computers the policy is only applied partially. In event viewer I get error
7016 "Completed Registry Extension Processing in ... milliseconds"
I have turned on logging and created a gpsvc.log file. In the (huge) file I find the following info:
GPSVC(17c.1060) 10:26:25:819 SetRegistryValue: DisableLockWorkstation => 1 [OK]
GPSVC(17c.1060) 10:26:25:819 SetRegistryValue: DisableChangePassword => 1 [OK]
GPSVC(17c.1060) 10:26:25:819 SetRegistryValue: Failed to set value <DisableRegistryTools> with 5
So some settings are applying but for example "DisableRegistryTools" is not set. When I access the registry as the user that should receive the policy and navigate to HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, I can see that some entries are set by the policy. I can create a test entry there manually, but I cannot create an entry specifically called "DisableRegistryTools":
Google has not been helpful either. Does anyone have an idea why setting the registry value sometimes fails?
Thanks for your help!
HarryNew