The following error was found in the Group Policy result set and the event log at the corresponding point in time:
system:1085 Warning
The following error occurred while executing gpupdate/force on the DC and client
From the error message we can confirm that the problem is caused by a Group Policy call 42B5FAAE-6536-11D2-AE5A-0000F87571E3, so we need to find the corresponding GPO. Check all Group Policies from ADSI Edit, search by attribute Gpcuserextensionnames, and discover that there are 5 Group policies that have this extension
Each of them is:
Route add 10.18.1.0 (it.com/management/computers/client)
Test
Weboa (AutoStart it.com/fund)
Script Single Sign-on
Explorer (no Group Policy settings link to ad domain)
Then, based on the link of these group policies, we lock the target on the Explorer Group Policy. This is because the Explorer Group Policy is linked to domain, and it is the OU that inherits the settings of this Group Policy.
But the problem is that the Explorer Group Policy does not have any settings, but because it applies to the IT OU, and then calls the 42b5faae-6536-11d2-ae5a-0000f87571e3, this extension, which leads to the problems we encountered above.
The solution is to clear the value of Gpcuserextensionnames in this Group Policy in ADSIEdit.
Once cleared, run Gpupdate/force again, problem solved
Windows Server r2/User policy could not be issued script