Before Vista and Windows Server 2008, if you wanted to perform detailed logging of Group Policy events beyond what you could get in the RSOP console (Resultant Set of Policy), you had to turn on the debug feature in the USERENV.DLL module, which would generate a file USERENV.LOG in the windowsdebugusermode folder.
With the new Windows Server 2008 operating systems, the System event log contains “actionable” Group Policy events, which is certainly more convenient. (This is one more side effect of the shift to Group Policy being implemented as a service.) These events are now more English-like and more informative. The source is “Group Policy Service” and Microsoft promises to keep making the logs better, for example, with links to online knowledge base articles.
The Operational event logs (you have to dig down further in the Event Viewer to see these) contain a lot of the detail that the old USERENV.LOG file would provide. These log entries provide details that you could use to examine policy processing performance from the speed standpoint, for example. (If you still want to view the USERENV trace log, you can, but the Registry key is now HKLMSoftwareMicrosoftWindows NTCurrentVersionDiagnostics, the DWORD value is GpSvcDebugLevel, and you can set it to 10002. Oh, and the filename is now named GPSVCLOG.LOG instead of USERENV.LOG.)
A downloadable tool from Microsoft (search on GPLogView.MSI) is handy for collecting Group Policy related events from the event logs and exporting those events into TXT, HTML, or XML formats. (This tool requires that your system participate in the Genuine Windows program before you can download it.)
Finally, if you want to view Group Policy events from multiple computers in one place (e.g., on your own Vista workstation), you can do it, as long as you and those other systems are running Vista or Windows server 2008 Server. I don’t have room to go through all the details here, but in a nutshell, you activate the Windows Remote Management service on all the relevant machines, and then you set up a “subscription” in the Event Viewer console (EVENTVWR.MSC). Note that when you do this, you must provide administrative credentials with which to authenticate to the remote systems.
See recent blog posts…
Network Location Awareness
New Status as a Service
A step by step on how to add a role to Server Core
Server Core – A minimalist approach to managing WS2008
