1.
Group
Policy troubleshooting tools
Group Policy processing typically involves complex sets of
actions. These apply the necessary policies to users, user groups, and
computers within one or more domains in your organization.
Due to the number and complexity of the various overlapping Group Policy
processes, Group Policy can be difficult to troubleshoot. So you need a good
idea of the processes that are involved and the tools you can use for problem
solving.
When a client machine begins to process Group Policy with
Windows Server 2008, processing takes place in two phases – core
processing, followed by client side extension (CSE)
processing.
Core Group Policy processing occurs each time a user logs onto their computer
to determine whether the domain controller can be reached, whether changes have
been made to any of the Group Policy objects (GPOs), or to verify which policy
settings need to be processed.
Once core processing is complete, the core Group Policy
engine – responsible for performing core processing tasks – calls on CSEs to
start processing the settings that apply to a client. Each CSE then uses its
own set of rules to process the various settings in each of the policy setting
categories. These categories include Security Settings, Administrative
Templates, and Software Settings.
Because Group Policy applies to both computers and users,
Group Policy processes typically repeat. For example, a process may occur once
for an individual computer, and again for both the computer and the user
currently logged onto the system. Each time a process runs on a computer, the
process can have a different set of policies that it refers to.
There are typically a number of overlapping policies for
each process that Group Policy performs. So you may need to use various tools
to find the cause of a Group Policy-related problem on the network or within a
domain.
Group Policy
Management Console (GPMC)
You use the GPMC to perform management tasks related to
Group Policy. This console is included as a snap-in with Windows Server
2008.You can also use the GPMC to find the cause of problems on your network.
You can use several tools to ensure that your Group Policy
settings are consistently available:
GPOTool
You
can use the GPOTool if you suspect that Group Policy information is not being
replicated correctly within your domain. It is a command-line tool that is part
of the Windows Server 2008 Resource Kit and checks your domain controllers for
consistency. You can only use this tool if your domain has more than one domain
controller.
GPMC reports
You
can use GPMC reports to review all the defined settings in a GPO. The IE
Maintenance section of reports indicates whether content ratings and
connections are deployed and whether Preference Mode is specified. It also
displays the core information for wireless and Internet Protocol Security (IPsec).
You can also use GPMC reports to review Resultant Set of Policy (RSoP) that are
being applied on a computer to determine a GPO's impact.
GPUPDATE
command
You can use the gpupdate
command to force Windows to refresh local Group Policy settings – including
security settings – and Group Policy settings stored in the Active Directory.
By using the gpupdate command, you ensure
that any changes that were made to GPOs are applied to the network immediately
in order to update clients. This can resolve Group Policy issues, such as
security-related GPOs that were causing problems because they weren't being
applied.
The two kinds of reports you can generate by using the GPMC
are Group Policy Results reports and Group Policy Modeling reports.
When using the gpupdate command to update your Group Policy
settings, you can use various parameters with the command.
For instance, using the /force parameter ignores all
processing optimizations and reapplies all settings. By using the /boot
parameter with the gpupdate command, you can restart the computer automatically
once the Group Policy settings have been refreshed.
2.
Using
the gpresult.exe command
When checking
Group Policy for errors, you can use the GPResult tool to gather RSoP data for
computers running Windows Server 2008 in your organization. The information you
get as a result of using the GPResult tool is similar to using a Group Policy
Results report in the GPMC.
Traditionally,
running the gpresult command to troubleshoot a specific user or computer's
Group Policy settings redirected the output to a text file. With Group Policy
in Windows Server 2008, you can now run gpresult and display the output in HTML
or XML format.
This enables you
to generate an RSoP report, similar to GPMC reports, which include headings to
make the results easier to review.
You can run the
gpresult command on any computer to which you have access. And by default the
command will display results for all the Group Policy settings that are being
applied for the computer on which you run the command.
You can use
parameters, such as /F, /H, and /X, with the gpresult command to create an RSoP
report.
/F You
add the /F parameter if you want to force Group Policy to overwrite any files
that exist as a result of previous instances in which the gpresult.exe command
had been used.
/H You
use the /H parameter to instruct Group Policy to display the results of running
the gpresult command in HTML format. This automatically changes the file
extension of the resulting file to .html.
/X You
use the /X parameter to ensure that the results of running the gpresult command
display in XML format. This automatically changes the file extension to .xml.
