Backup-GPO Error on Windows Server Core

After migrating some scheduled tasks to a new Windows Server 2016 Core server I discovered that the Backup-GPO cmdlet was throwing an error.

Backup-GPO: The data is invalid. (Exception from HRESULT: 0x8007000D)

I used this quick PowerShell script in order to determine which GPOs in particular were having an issue.

$gpos = Get-GPO -All

foreach ($gpo in $gpos)
{
      Write-Host $gpo.DisplayName.ToString()
      Backup-GPO $gpo.DisplayName.ToString()
}

The policies all had folder redirection in common which narrowed things down but still didn’t explain the behavior. After a bit more research I found this KB article which seems to correlate with this issue even though it’s about AGPM.

https://support.microsoft.com/en-ca/help/2987708/agpm-and-gpresult-not-working-in-windows-server-core

The article states:

Because Windows Server Core does not have the GPMC Interfaces installed, applications that use this interface will fail.

So it appears that the cmdlet will not work on any version of Windows Server Core as I was able to reproduce the issue on Windows Server 2012 R2 Core and Windows Server 2019 Core (I also tried it with the Server Core App Compatibility Feature on Demand).

I ended up having to migrate the task to a server with the desktop experience installed in order for it to work.

Cannot Start Server Service

While scripting a report; I came across an error about being unable to connect.

I examined the server in question and found the server service was not running.

I tried to start it but it stopped immediately with the following error in the system event log:

Windows could not start the Server service on Local Computer Error: 1808: The account used is a computer account. Use your Global user account or local user account to access this server.

However, the service was configured correctly to run as the Local System account.

It’s an odd problem and the error is misleading. The actual cause was that a user had placed a share path in in the system Path variable (ie \servershare)

After removing the offending entry the server service started right away.