No, verbose userenv logging simply tells you what is happening during each step of GP processing. It doesn't log what is happening as the user is executing commands that may run into policy. We actually had a conversation with the GP team at MS about this particular issue because it is very difficult to troubleshoot. I don't think a network trace is going to help since the problem is not during policy application but when the policy has already been applied and there is some unexpected reaction between an application and what could be a totally unrelated (usually) shell restriction. For example, back in the NT 4 days I spent hours trying to troubleshoot why a particular 16-bit app would throw weird errors whenever we tried starting it. Through a process of elimination, I figured that it was choking on the "Hide Drives" policy that hid certain drive letters from Explorer. This was primarily due to the fact that the particular API the app was using was relying on the visibility of the drive letter, rather than a more standard way of accessing that information. So, its really hard to pin this kind of stuff down unless you get lucky with Regmon or just remove one policy item at a time until you find the problematic one.
Darren Darren Mar-Elia For comprehensive Windows Group Policy Information, check out www.gpoguy.com-- the best source for GPO FAQs, video training, tools and whitepapers. Also check out the Windows Group Policy Guide, the definitive resource for Group Policy information. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ernesto Nieto Sent: Monday, August 21, 2006 8:52 AM To: [email protected] Subject: RE: [ActiveDir] Viewing GPO processing Darren, Thanks yes, that's what I want to find out. I did read something in previous emails about using network trace on the group policy, but I have no clue on how to do that. Would enabling verbose userenv logging help, you think? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darren Mar-Elia Sent: Monday, August 21, 2006 10:23 AM To: [email protected] Subject: RE: [ActiveDir] Viewing GPO processing Assuming its XP, then you can use GPMC to get a GP Results report that tells you what GPOs and what settings were applied to a given user or computer. However, I think what you're asking is, is there any log that tells you when a particular operation gets blocked by a particular GPO setting, and the answer to that is no. Depending upon what the operation is, you may be able to see what registry values are getting queried (assuming it's an admin. Template policy that is causing the problem) by using Sysinternals Regmon to spy on the registry I/O while you are doing the particular operation described below. However, outside of that its trial and error to find why the operation is getting stopped. Darren Darren Mar-Elia For comprehensive Windows Group Policy Information, check out www.gpoguy.com-- the best source for GPO FAQs, video training, tools and whitepapers. Also check out the Windows Group Policy Guide, the definitive resource for Group Policy information. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ernesto Nieto Sent: Monday, August 21, 2006 8:05 AM To: [email protected] Subject: [ActiveDir] Viewing GPO processing Is there anyway to see when a GPO is being applied. Is there a log somewhere that shows what was applied and what wasn't? Like the log that's created when one logs into w2k in safe mode. In that log, you can see what drivers are loaded. I need to see what policy is causing an error when users log on. The error is about installing an .INF file, access is denied. Thank you List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ml/threads.aspx List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ml/threads.aspx List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ml/threads.aspx List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ml/threads.aspx
