SOC Event Lookup
Event ID 6145GroupPolicyP3

Windows Event ID 6145: Errors occurred while processing security policy in GPOs

Windows Security Event ID 6145 records that Security Settings from one or more Group Policy Objects were applied to a computer with errors.

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-13

Trigger Scenarios

The event is generated on the target computer during Group Policy processing, for example when a security principal SID in policy cannot be resolved to an account name.

Key Fields

ErrorCode

The specific Group Policy processing error. Microsoft examples show ErrorCode 1332, meaning no mapping between account names and SIDs was done.

GPOList

The list of GPO GUID and name pairs applied with errors, in GROUP_POLICY_GUID GROUP_POLICY_NAME format.

Computer

The target computer that failed to apply Security Settings. Compare affected hosts against the intended scope of the listed GPOs.

Common False Positives

  • Deleted accounts, stale SIDs, or administrative mistakes in GPO Security Settings can cause 6145 without adversary activity.
  • Large GPO migrations or domain cleanups can temporarily produce unresolved SID errors.

Related Events

MITRE ATT&CK Mapping

  • T1484.001Domain or Tenant Policy Modification: Group Policy Modification

Detection Notes

Use threshold=1 for 6145 on critical servers because ErrorCode 1332 is Microsoft’s example for unresolved account/SID mappings and GPOList names the policies that failed. In T1484.001 triage, a malformed or tampered GPO Security Settings section can prevent intended controls from applying; inspect each GROUP_POLICY_GUID in GPOList, compare SYSVOL policy files to change history, and correlate with recent GPO edits or 4719 audit-policy changes.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 6145
| project TimeGenerated, Computer, ErrorCode, GPOList
Splunk SPL
index=wineventlog EventCode=6145
| table _time, host, ErrorCode, GPOList
Sample Log
ErrorCode: 1332
GPOList: {6AC1786C-016F-11D2-945F-00C04fB984F9} Default Domain Controllers Policy {31B2F340-016D-11D2-945F-00C04FB984F9} Default Domain Policy
Computer: DC01

Source

Official documentationMachine-readable JSON