Windows System Log · Event 1058
Event 1058: Group Policy could not read a policy file
Windows tried to fetch a policy file from a domain controller's SYSVOL share and could not. Group Policy then applies nothing new for that policy, silently. The error code at the end of the message says whether this is a network problem, a permissions problem, or a policy that no longer exists.
Also written as Event ID 1058gpt.ini access denied1058 group policy error
- How oftenUncommon
- Vendor calls itError
- LogSystem
- SourceMicrosoft-Windows-GroupPolicy
What it means for you
For an analyst
Read the error code before anything else; the three common causes need completely different work. Access denied usually means the computer account cannot reach SYSVOL, often because a network path is being resolved to a DC it cannot authenticate to. 'The system cannot find the path specified' after a GPO deletion is a stale link, not a fault. And a persistent 1058 on one client with others fine points at the client's own name resolution rather than at the domain. Worth remembering that Group Policy refresh failures leave previously applied settings in place, so nothing visibly changes at the moment it breaks — which is why these go unnoticed for months.
The fields that decide it
Everything else in the log line is context.
- GPO GUID in the path
- The policy that could not be read. Resolve it with Get-GPO -Guid, or by browsing SYSVOL, to find out which policy is affected — the GUID alone tells you nothing about the impact.
- Error code
- The reason the read failed, and the field that decides the investigation.
-
Access is deniedThe computer account cannot read SYSVOL. Usually authentication rather than NTFS permissions. -
The system cannot find the path specifiedThe GPO was deleted but a link or a cached reference remains. -
The network path was not foundName resolution or connectivity to the domain controller failed. -
The specified domain either does not existThe client cannot locate a domain controller at all. Check DNS first. - Domain controller named
- Which DC was being contacted. A failure against one DC while others work narrows it to that server or the client's site assignment.
- Whether Event 1030 accompanies it
- 1030 is the generic 'Group Policy processing failed' companion. The pair together is the normal shape; 1058 carries the detail.
Common questions
Does Event 1058 mean my Group Policy settings have been removed?
No. When policy processing fails, Windows leaves whatever was applied last time in place — it does not roll settings back. That is why this failure is easy to miss: nothing changes at the moment it starts. The risk is that new or updated policy never arrives, so a security setting you added weeks ago may not actually be on the affected machines.
How do I find out which policy Event 1058 is complaining about?
The path in the message contains a GUID in braces. Run Get-GPO -Guid with that value on a domain controller to get the policy's friendly name. If the GUID resolves to nothing, the policy has been deleted and the client is chasing a stale reference, which is the benign version of this error.
Why does Event 1058 say access is denied when SYSVOL permissions look correct?
Because it is usually authentication rather than file permissions. The computer account has to authenticate to the domain controller before it can read the share, so a Kerberos problem, a broken secure channel, or a time skew presents itself as access denied. Test the secure channel with Test-ComputerSecureChannel before touching SYSVOL permissions.
Is Event 1058 a problem if it happens once?
A single occurrence during a reboot or a network blip is not worth chasing — Group Policy retries on its next refresh cycle. It becomes a problem when it repeats, because that means the machine has not received a policy update in however long the errors have been running. Check the client's last successful policy application with gpresult /r rather than counting events.
Read next
- Usually comes before Event 1014: A DNS lookup timed out DNS resolution failures, the most common underlying reason a domain controller cannot be reached.
- Related Event 36871: Windows could not build a TLS credential Another connectivity failure that reads as a component fault rather than a network one.
- Read alongside Event 4771: Kerberos pre-authentication failed Kerberos pre-authentication failures, which show up when the access-denied variant is really an authentication problem.
- Read alongside Event 4624: An account was successfully logged on The computer account's own logon to the domain controller, useful for confirming whether authentication is working at all.
Mentioned by
Vendor documentation
Last reviewed 6 September 2026