Search This Blog

Wednesday, February 2, 2011

Where are the GPO logs?

Client Log Files
Log files can be generated by the core client engine (Userenv) and by every CSE except the Scripts CSE. Scripts processing is logged in the Application log on the client with source=UserInit. Use Event Viewer to view the Application log on the client, or look for these entries on the Policy Events tab of the Group Policy Results report.
The Policy Events tab in Group Policy Results reports generated in GPMC displays the Group Policy–related events that you would see if you used Event Viewer to view these events in the Application log on the client for which you generated the report.
The following table lists several log files you can generate at the client that relate to Group Policy troubleshooting.
Client Log Files for Troubleshooting Group Policy

Note   The UserEnv logs entries pertaining to profiles as well as Group Policy core processing and registry (.adm) processing on the client. The entries pertaining to profiles are intermingled with the Group Policy entries and not easily distinguished from them. Use Wilogutl.exe to analyze the Windows Installer log files. For more information, see Wilogutl.exe on the Microsoft Web site (  
Server Log Files
You can enable logging of events generated by the Group Policy Object Editor on the Server. There are two different log files, one for events relating to core Group Policy processing and the registry CSE, and another for events relating to all other CSEs.
The following table lists several log files you can generate at the server that relate to Group Policy troubleshooting.

Userenv Logging
Because Userenv tracks the Group Policy engine and registry-based Group Policy, it is the most frequently used log file for Group Policy troubleshooting. Userenv is especially useful in a Windows 2000 environment because you don't have the benefit of using Resultant Set of Policy (RSoP). Most of the questions that RSoP answers, are in the userenv log.
To use userenv.log you need to first enable verbose logging.
To enable verbose logging
    1. Log onto the client computer as the administrator and run Regedit.
    2. Locate the following key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.
    3. Right click Winlogon, select New, and then click DWORD Value.
    4. Enter the following name for the DWORD Value: UserEnvDebugLevel.
    5. Enter 30002 as the hexadecimal value. This writes the userenv into userenv.log, located in the \%windir%\debug directory.
    6. Run "gpupdate /force" to ensure a full listing of total Group Policy processing.

No comments:

Post a Comment