Windows: unable to apply GPOs, event id 1065

by luca
0 comment

Today I noticed that some Windows servers were not applying the correct GPOs (Group Policy Objects). Troubleshooting the problem, I found the event id 1065 in the Windows eventlog:


A GPO was indeed configured with a WMI filter and the server, not being able for some reason to perform a filter check, aborted all the processing of the policies.

I therefore opened the WMI management console with the wmimgmt.msc command:


and found that all the WMI subsystem was probably corrupted:


For a deeper analysis, I downloaded the WMIdiag utility from Microsoft’s website and ran it on my server. In its log, I found that the WMI repository state was INCONSISTENT:


To completely rebuild the repository I first stopped the Windows Management Instrumentation service, then I renamed the Repository folder (in C:\Windows\System32\wbem) to Repository.old:


I restarted the service to create a new repository.

I needed also to re-add to the repository all the third-party WMI classes present in my system. I opened a command prompt, changed the working directory to C:\ and executed the following command:

for /f %%s in ('dir /s /b *.mof *.mfl') do mofcomp %%s

After a reboot, the server correctly applied all the policies and the WMI subsystem was available again.

Related Posts

Leave a Comment

6 + ten =