Windows Couldn’t Connect to the GPSVC Service

User cannot logon to the computer due to the GPSVC (Group Policy Client service) connection error on one of the computers running Windows 10. When trying to log on with a domain user account, the following error appears:

Windows couldn't connect to the gpsvc service.
Please consult your system administrator.

Windows could not connect to the Group Policy Client service.

At the same time, if you try to logon under a local account with local administrator privileges, you will be authenticated, the Desktop will be displayed, but this pop-up message will appear in the Windows 10 notification bar:

Failed to connect to a Windows Service
Windows couldn’t connect to the Group Policy Client service. This problem prevents standard users from signing in.

The problem appears because the Group Policy Client service (GPSVC) is not running on the computer. If you open the command prompt and try to start gpsvc manually using the net start gpsvc command, the following error will appear:

System error 5 has occurred.
Access is denied.

The problem occurs if the system image or the registry are damaged, if you set the service permissions using GPO or if user has disabled the Group Policy client service on the computer by changing permissions on the service registry key.

To fix the issue, log on under a local administrator account and change the GPSVC registry keys:

1. Run the Registry Editor (regedit.exe) and make sure that there are entries for gpsvc in the registry. To do so, go to the reg key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Make sure that the gpsvc key exists and has %systemroot%\system32\svchost.exe -k netsvcs –p specified for ImagePath. If the service registry key is missing, you can import the service registry key from another computer, or check and repair the Windows image using these commands:
   DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost and make sure that there is GPSvsGroup in the list of the parameters;
3. If the GPSvsGroup parameter is missing, create it manually. Create a REG_MULTI_SZ parameter with the name GPSvcGroup and the value GPSvc; 
4. Then create a new reg key with the name GPSvcGroup under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost;
5. In the new GPSvcGroup branch, create two DWORD (32bit) parameters:
   • AuthenticationCapabilities – value 0x00003020 (12320)
   • CoInitializeSecurityParam – value 0x00000001 (1) 
6. Restart your computer.

You can simply import the following REG file to the registry:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost]
"GPSvcGroup"=hex(7):47,00,50,00,53,00,76,00,63,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\GPSvcGroup]
"AuthenticationCapabilities"=dword:00003020
"CoInitializeSecurityParam"=dword:00000001

You can check the gpsvc permissions and compare them with those on a computer working normally. You can display current service permissions with this command:

sc sdshow gpsvc

After restarting the computer, the gpsvc connection error will disappear and a user will be successfully logon to Windows 10.