So basically this is by design and the error message just tells you that VBS/VSM/Device Guard was not able to start and the CSE failed. When you enable the Device Guard policy it will automatically try to enable required features, and this is not possible since it is not supported in VMs. (OK, yes, it is possible if you enable nested Hyper-V, but I haven’t done that, because it does not work together with Isolated User Mode/vTPM) One of the requirements for Device Guard or Virtualization Based Security is the feature Hyper-V Hypervisor, and this is not possible to enable in VMs. I re-ran GPUpdate /force at the client to be sure that all group polices are refreshed.įinally the result was successful! Ok to sum this up
I disabled the link, by right clicking the GPO and uncheck Link Enabled One central GPO for Device Guard/Credential Guard, so I started looking at the central GPO. I got two hits (The extension GUID is found in the Extensions value) When running GPUpdate, this message appears
#EVENT ID 7016 GROUP POLICY ERROR WINDOWS 10#
In the end this was a total unnecessary troubleshooting, but during the time I learned that there are several CSEs not documented, there will be a post of all the CSEs in Windows 10 soon.
I recently in my lab environment discovered a group policy error that was quite interesting, I only got the error for some of my Windows 10 machines, so I started to investigate.
0 kommentar(er)
