Group Policy Error - Failed to read data with 38

Hi folks,

we have a strange issue with GPOs.


Problem:

During gpupdate /force the settings in Registry will be deleted.


Repro:

1.Create a hive under HKEY_LOCAL_MACHINE\SOFTWARE\Policies

2. Do gpupdate /force

3. Check HKEY_LOCAL_MACHINE\SOFTWARE\Policies

Error: the hive removed

Good: the hive NOT removed


I have one good and one bad client - it seems that the bad clients are in one specific OU.


Steps done:


Debugging was enabled:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics]

"GPSvcDebugLevel"=dword:00030002

Created the folder %windir%\debug\usermode


In the logfile the important part:


ProcessGPOList:++ Entering for extension Registrierung
ProcessGPOList: Passing in the force refresh flag to Extension Registrierung
LogExtSessionStatus: Successfully logged Extension Session data
GPLockPolicySection: Sid = (null), dwTimeout = 60000, dwFlags = 0x42
Registry Sync Lock Called
Writer Lock got immediately.
Registry Lock taken successfully
ResetPolicies: Entering.
SetPolicyOwnerOnKey: Setting owner on reg key on <Software\Policies>.
SetPolicyOwnerOnKey: Setting owner on reg key on <Software\Microsoft\Windows\CurrentVersion\Policies>.
SetPolicyOwnerOnKey: Setting owner on reg key on <System\CurrentControlSet\Policies>.
ParseRegistryFile: Entering with <C:\ProgramData\ntuser.pol>.
DeleteRegistryValue: Deleted Software\Policies\Microsoft\Microsoft Antimalware\PUAProtection
DeleteRegistryValue: Deleted Software\Policies\Microsoft\Microsoft Antimalware\DisableLocalAdminMerge
(... here comes a lot of similar stuff)


DeleteRegistryValue: Deleted SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications\List\C:\ProgramData\xxxxx\systemdaten\Interface\HuaSupport\HuaSupport.exe:*:Enabled:xxxSupportW10

DeleteRegistryValue: Deleted SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications\List\C:\ProgramData\xxxxxx\engine\php5\php.exe: :*:EnabledHPW10

DeleteRegistryValue: Deleted SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts\AllowUserPrefMerge

DeleteRegistryValue: Deleted SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts\Enabled

ParseRegistryFile: Failed to read data with 38

ParseRegistryFile: Leaving.

ResetPolicies: ParseRegistryFile failed with error 13. deleting policy keys

AddPolicyPermissionOnKey: Setting permission on reg key on <Software\Microsoft\Windows\CurrentVersion\Policies>.




Error 38 translates to

Ende der Datei (EOF) erreicht. // Reached the end of the file


Windows Defender was deactivated > same error

A bad computer was moved to another OU > fixed


OS is Windows 10, 1703


Process Monitor: shows that there are write ops to this file, and before the last two write a read operation which fails. But actually in the logs I can see that the OS tried to lock the file exclusively - and this was accepted...


Any help appreciated!!!


Gabor

Weiterlesen...