Group Policy Preprocessing (Active Directory)
Group Policy processing requires Active Directory. The Group Policy service reads and updates information stored in Active Directory. The absence of Active Directory (or a domain controller) prevents Group Policy from applying to the computer or user.
Correct binding to the directory
The Group Policy service logs the error code. This information appears on the Details tab of the error message in Event Viewer. The error code (displayed as a decimal) and error description fields further identify the reason for the failure. Evaluate the error code with the list below:
Error code 5
Error code 49
Error code 258
Error code 5 (Access is denied)
This error code might indicate that the user does not have permisson to Active Directory.
To correct permisssions for accessing Active Directory:
Use Active Directory troubleshooting procedures to further diagnose the problem.
Error code 49 (Invalid credentials)
This error code might indicate that the user's password expired while the user is still logged on the computer.
To correct invalid credentials:
Change the user's password.
Lock/unlock the workstation.
Check if there are any system services running as the user account.
Verify the password in service configuration is correct for the user account.
Error code is 258 (Timeout)
This error code might indicate that the DNS configuration is incorrect.
To correct timeout issues:
Use the nslookup tool to confirm _ldap._tcp.<domain-dns-name> records are registered and point to correct servers (where domain-dns-name is the fully qualified domain name of your Active Directory domain).
Note: These steps may have varying results if your network constrains or blocks ICMP packets.