Troubleshooting Group Policy Jeremy Moskowitz, Group Policy MVP Chief Propeller-Head: GPanswers.com Founder: PolicyPak Software (policypak.com)

Our Trouble Spot Road Map New Areas – New potential problems Updated “under the hood” changes The Central Store. The “Why” and “Problems” Updated logging model RSoP differences for Windows XP vs. Windows Vista+ clients Troubleshooting Group Policy Preference Extensions 2

Under the hood changes “No Brain energy required” Group Policy runs as a “hardened” service 3rd party CSEs are isolated Changes in behavior when clients are offline for a while… (next slide) 3

Network Location Awareness: NLA 2.0 Offline for a while? Get Group Policy next time you connect. No more “ping”/ ICMP requirement Key takeaway: Group Policy refreshes only if you missed your last refresh cycle 4

NLA / Reporting Look for NLA events with slow ? fast link transitions 5

Group Policy Internals Group Policy has two “halves” GPC: Group Policy Container Record in Active Directory GPT: Group Policy Template “Downloadable” bits from SYSVOL 6

Group Policy Troubleshooting (for the GPO iteself) GPOtool Determines general GPO health Litmus Tests: Creating new user in Active Directory Users & Computers Creating new.txt file in SYSVOL Deeper SYSVOL / DFS problems Sonar Ultrasound “Troublehsooting FRS” 7

Why did Microsoft move away from ADM files? ADM files Conf.adm Inetres.adm System.adm Wmplayer.adm Wuau.adm Simple But … problems (next page) 8

Problems to Solve 1: How do we prevent burning 4MB within each Group Policy Object? 2A: How do we deal with multiple languages and 2B: …preventing “write overlaps”? 3: How do we distribute new definitions updates to all admins? 9

Central Store Success / Problems 10 Central Store not created properly ADML language files not in precise place SYSVOL replication is damaged Older clients are used to manage/edit GPOs

Why you need a Windows 7 management machine

Our Trouble Spot Road Map New Areas – New potential problems Updated “under the hood” changes The Central Store. The “Why” and “Problems” Updated logging model RSoP differences for Windows XP vs. Windows Vista+ clients Troubleshooting Group Policy Preference Extensions 12

Quick Review of XP Troubleshooting Major events in the Event log Step-by-step events in the \windows\debug\usermode\Userenv.log Tip: Use SysProSoft PolicyReporter to make more “meaningful”

Breakdown of Stuff in Userenv.log Same Process Different Thread ID Timestamp Clues Red Herrings

Windows 7 Group Policy Troubleshooting Userenv.log—going away… (Next slide) “Basic news”—in System log

Windows 7 Group Policy Troubleshooting “Micro-news” in the GroupPolicy Operational Log Replaces UserEnv log

Making Lemonade from Logs Focus in on ONE “Group Policy Event Cycle” Use the Operational logs  Get ActivityID  and…

Make an Event Filter {INSERT ACTIVITY ID HERE}']

GPlogview Tool Download: Log one cycle Gplogview -a -o output.txt Gplogview -a 9A FF-4625-B7D1-6DEB763E2DCA -o output.txt Monitor incoming cycle (two windows) Gplogview –m Caveats Must be run in “admin” command shell

DEMO Eventing and GPlogview

Our Trouble Spot Road Map New Areas – New potential problems Updated “under the hood” changes The Central Store. The “Why” and “Problems” Updated logging model RSoP differences for Windows XP vs. Windows Vista+ clients Troubleshooting Group Policy Preference Extensions 21

GPresult on Windows 7

Gpresult Wackiness Why can’t I see computer-side RSOP? Totally frustrating (as the error is about the user, not the computer)

Permissions Delegation for Seeing Own Computer RSOP Domain Level or OU level

Our Trouble Spot Road Map New Areas – New potential problems Updated “under the hood” changes The Central Store. The “Why” and “Problems” Updated logging model RSoP differences for Windows XP vs. Windows Vista+ clients Troubleshooting Group Policy Preference Extensions 25

Troubleshooting Group Policy Prefs Reporting… Eventing… Tracing…

Reporting GPRESULT: /H shows GPPrefs output GPMC: Multiple items at a level can be tricky Rename your pref items for clarity

Events App Log on all platforms shows the bad news Windows 7 has own “source” So you can filter “bad news” based on just the problem area Windows 7 Operational log: Not for GPPEs Rather, just for GPOs overall

Tracing Used for final troubleshooting Planning (RSoP.msc) logging is not used Logs go to %COMMONAPPDATA%\GroupPolicy\Preference\Trace\Com puter.log and User.log (usually c:\ProgramData\...)

Group Policy Prefs Tracing Example

31 Tracing Gotchas Win7 RSAT doesn’t contain the ADMX settings. Option 1: Copy the WS08 or R2 “GroupPolicyPreferences.admx/adml” to central store Option 2: Install the ADMX/ADML from MSI Installs to C:\Program Files\Microsoft Group Policy\Preferences\ Move up to Central Store

Stay up to date with TechNet Belux Register for our newsletters and stay up to date: Technical updates Event announcements and registration Top downloads Join us on Facebook LinkedIn: Download MSDN/TechNet Desktop Gadget

TechDays 2011 On-Demand Watch this session on-demand via TechNet Edge Download to your favorite MP3 or video player Get access to slides and recommended resources by the speakers

Do MORE with Group Policy

THANK YOU