We have a Remote Desktop Services server (running Windows Server 2012 R2 Standard) that is sometimes logging an Error Event ID 7126 when performing a periodic group policy processing for the users logged into the server. This error occurs for only
two users (out of about 10 different users that log into the server), but does not always occur for those users (in other words, sometimes the periodic group policy processing for a given user is successful, sometimes not). All the users are configured
in an identical manner and are part of the same domain and local groups as far as I can tell (and I was the one that originally setup all of those users, all at the same time when we brought up the server a few months ago).
This error event appears in the Microsoft > Windows > Group Policy > Operational log, and the errors are displayed in the Event Log summary ("Summary of Administrative Events"), which is how it was brought to my attention.
This event always occurs immediately after a 4257 Event ("Starting to download policies"). In the times where this error *doesn't* occur (i.e., the periodic processing works), the 4257 Event is followed up by a 5327 Event ("Estimated
network bandwidth on one of the connections: 4618712 kbps."). Because of this, I suspect the actual error has something to do with the determination of the network bandwidth. However, if this was the case, I would expect to see a 7327 Error
Event ("Error estimated bandwidth event: Estimating the bandwidth for a network interface did not complete.") and not a 7126 Error Event (found that information here: https://technet.microsoft.com/en-us/library/7e940882-33b7-43db-b097-f3752c84f67f).
I've done a couple Google searches on the 7126 event ID and have found very little. I see this event happening about once an hour (the Event Log shows 27 occurrences in the last 24 hours, 179 occurrences in the past 7 days).
The Domain Controller and this server are on the same local network and are hosted servers (hosted in AWS - so I don't have direct access to the hardware level). No other authentication problems have been reported. I do not see any errors or
audit failures on the Domain Controller around the times of these errors. No other errors are being logged on the RDS server around this time either.
If this is an event that I can safely ignore, that is fine, but I wanted to dig a little deeper to see if this event is something I should be concerned about. Does anyone have any insight into this specific event, or have experienced this error themselves
(and if so, is there a way to fix this error)?
The full details of the Event ID (specific domain and user information scrubbed):
Log Name: Microsoft-Windows-GroupPolicy/Operational
Source: Microsoft-Windows-GroupPolicy
Date: 10/17/2017 4:06:16 PM
Event ID: 7126
Task Category: None
Level: Error
Keywords:
User: DOMAIN\user01
Computer: RDSServer.DOMAIN.com
Description:
Group Policy could not get applicable GPOs from the domain controller.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
<EventID>7126</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2017-10-17T16:06:16.169910500Z" />
<EventRecordID>139654</EventRecordID>
<Correlation ActivityID="{AD0091D3-354A-4A38-B69F-61D0496AB0A5}" />
<Execution ProcessID="952" ThreadID="11184" />
<Channel>Microsoft-Windows-GroupPolicy/Operational</Channel>
<Computer>RDSServer.DOMAIN.com</Computer>
<Security UserID="S-1-1-11-1111111111-1111111111-111111111-1111" />
</System>
<EventData>
<Data Name="IsMachine">false</Data>
<Data Name="ErrorCode">1</Data>
<Data Name="GPODownloadTimeElapsedInMilliseconds">0</Data>
</EventData>
</Event>