SOC Event Lookup
Event ID 6145GroupPolicyP3

Windows Event ID 6145: Errors occurred while processing security policy in GPOs

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 6145 records that Security Settings from one or more Group Policy Objects were applied to a computer with errors.

Technical Metadata

Technical metadata for Event ID 6145
Event ID6145
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0112 Defense Impairment / T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
Key fields to watchErrorCode, GPOList, Computer

Trigger Scenarios

The event is generated on the target computer during Group Policy processing, for example when a security principal SID in policy cannot be resolved to an account name.

Key Fields

ErrorCode

The specific Group Policy processing error. Microsoft examples show ErrorCode 1332, meaning no mapping between account names and SIDs was done.

GPOList

The list of GPO GUID and name pairs applied with errors, in GROUP_POLICY_GUID GROUP_POLICY_NAME format.

Computer

The target computer that failed to apply Security Settings. Compare affected hosts against the intended scope of the listed GPOs.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 6145
SecurityEvent
| where EventID == 6145
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the documented fields.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 6145
index=wineventlog source="WinEventLog:Security" EventCode=6145
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index and parsed field names vary by deployment. Add the documented event-specific conditions after field validation.
Cortex XQL: Retrieve Windows Security Event ID 6145
dataset = microsoft_windows_raw
| filter edr_event_id = 6145
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested. Inspect raw fields because parsed names vary.
Query reference
Sigma rule: Windows Security Event ID 6145
title: Windows Security Event ID 6145
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 6145
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This retrieves the event and is not a standalone malicious-behavior detection.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
ErrorCode1332Microsoft's example error for an unresolved account-to-SID mapping.Interpret ErrorCode with the full event and correlated activity; this value alone is not proof of compromise. Source
GPOListGUID listIdentifies the Group Policy objects whose security settings processing failed.Interpret GPOList with the full event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1484.001Domain or Tenant Policy Modification: Group Policy Modification

Detection Notes

Use threshold=1 for 6145 on critical servers because ErrorCode 1332 is Microsoft’s example for unresolved account/SID mappings and GPOList names the policies that failed. In T1484.001 triage, a malformed or tampered GPO Security Settings section can prevent intended controls from applying; inspect each GROUP_POLICY_GUID in GPOList, compare SYSVOL policy files to change history, and correlate with recent GPO edits or 4719 audit-policy changes.

Common False Positives

  • Deleted accounts, stale SIDs, or administrative mistakes in GPO Security Settings can cause 6145 without adversary activity.
  • Large GPO migrations or domain cleanups can temporarily produce unresolved SID errors.

Related Events

Sample Log

Sanitized event sample
ErrorCode: 1332
GPOList: {6AC1786C-016F-11D2-945F-00C04fB984F9} Default Domain Controllers Policy {31B2F340-016D-11D2-945F-00C04FB984F9} Default Domain Policy
Computer: DC01

Frequently Asked Questions

What does Windows Event ID 6145 mean?

Windows encountered errors while applying security settings from one or more GPOs.

Does Event ID 6145 always indicate malicious activity?

No. Replication, malformed policy and account-resolution problems can cause it.

How should Event ID 6145 be investigated?

Decode ErrorCode, inspect every GPO GUID, compare SYSVOL and directory state, and validate recent policy changes.

Sources