Slow GPG performance (NETIQKB49892)

  • 7749892
  • 02-Feb-2007
  • 15-Mar-2013


NetIQ Group Policy Guardian 2.0



NetIQ Group Policy Guardian 2.0


Slow Group Policy Guardian (GPG) performance

EventAudit.exe consuming significant CPU resources

Thousands or even millions of messages stored in MSMQ (Microsoft Messaging Queue)


Performance issues may be due to inefficient WMI queries that take longer to complete when there are high numbers of events in the event log.


You may be able to resolve GPG performance or EventAudit.exe CPU resource issues by applying Group Policy Guardian (GPG) 2.0 SP1 to your GPG Collector computers and Microsoft hotfix 902346 to any Windows Server 2003 domain controllers that the Collectors are monitoring. Applying the GPG service pack and the Microsoft hotfix enables GPG to utilize optimized WMI queries when examining domain controller event logs. Microsoft hotfix 902346 requires Windows Server 2003 SP1 or later.

For more information about GPG 2.0 SP1, see: NETIQKB50131. To obtain hotfix 902346, which is unpublished at this time, contact Microsoft for Windows 2003 Server support by email or phone using the contact information available at

If you have a mixed environment of Windows 2000 and Windows 2003 domain controllers, you can still apply GPG 2.0 SP1 and Microsoft hotfix 902346 to any Windows 2003 domain controllers you are monitoring.

You may also be able to address performance issues by reviewing your event auditing policies. Reducing the number of events you are auditing will reduce the number of messages stored in MSMQ and also reduce the number of events that EventAudit.exe must evaluate.

For more information, please contact NetIQ Technical Support at .

Additional Information

Formerly known as NETIQKB49892