Troubleshooting Group Policy

Group Policy is a complicated piece of technology with lots of moving parts that work together to make it do its thing. Typically, problems with Group Policy arise while you're testing a particular policy. More rarely, problems show up that are unrelated to each other and it isn't obvious that Group Policy is involved in all of them. No matter what the reason, when something goes wrong in Group Policy, you often have to look in several places to find the solution.

The key to successful Group Policy troubleshooting is knowing where to look. Because Group Policy processing consists of two phases, you have two main areas in which to start looking for problems. In the first phase, core processing, Windows queries Active Directory (AD) to figure out which Group Policy Object (GPO) applies to the current computer or user, which policy areas (e.g., administrative templates, software installation) need to be processed, and whether the GPO has changed since that computer or user last processed it. Core processing requires the cooperation of several pieces of your infrastructure, including DNS, AD, File Replication Services (FRS), and your network. If any piece goes bad during core processing, all Group Policy processing will typically cease.

The second phase of processing involves client-side extensions, such as security settings, administrative templates, and folder redirection. Client-side extensions implement policies by processing and applying the settings in the GPOs that were found during core processing. Typically, when a problem occurs during client-side extension processing, that problem is confined to a single client-side extension--or even to a single GPO processed by a client-side extension--and other Group Policy processing continues as expected. Client-side extension problems are more difficult to troubleshoot because each extension that implements a GPO performs its tasks in a slightly different way and generates varying degrees of logging.

Logging of both phases of processing is often vital to successful troubleshooting. The log files can often illuminate problems that aren't obvious at first glance. If a Resultant Set of Policy (RSoP) report and a check of infrastructure components don't show the way to a solution, logging can sometimes reveal error messages that point to the exact problem.

There's no single place you can go to enable all available Group Policy logging. You can enable individual logs manually by using the underlying registry values. Web Table 1 lists the logs available for Group Policy and the accompanying registry values. Alternatively, you can use a free shortcut tool I've created—an Administrative Template (.adm) file called gpolog.adm—to enable any or all Group Policy-related logs. You can download gpolog.adm at http://www.gpoguy.com/tools.htm. Regardless of whether a problem occurs during core processing or client-side-extension processing, following the steps I provide here will help you troubleshoot the problem.

Step 1: Review the most recent processing cycle.
The first step in determining why a workstation or server is having Group Policy processing problems is to find out what happened during the last Group Policy processing cycle. To do so, you need Group Policy Management Console (GPMC) for Windows Server 2003 or Windows XP or the gpresult.exe command-line utility that comes with Windows 2000.

GPMC provides the Group Policy Results Wizard, which you can use to query your Windows 2003 and XP systems to get a report of what happened for a given user on that system during the most recent processing cycle. You can use gpresult.exe to get the same data from the command line that the Group Policy Results Wizard provides. However, if you have Windows 2000 machines and are using the version of gpresult.exe that comes in the Microsoft Windows 2000 Resource Kit, you'll get only a subset of the data that Windows 2003 and XP provide. That's because Win2K doesn't have the RSoP that was added to later versions of the OS.

To run the Group Policy Results Wizard, start GPMC, right-click the Group Policy Results node, and run the wizard. The wizard will ask whether you want to gather results from the local computer or a remote computer.

After you specify the computer, you can choose a user account that has logged on to that computer, if you want to gather user-specific policy settings. The wizard then goes to the computer you've selected, uses Windows Management Instrumentation (WMI) to gather the most recent Group Policy processing data, and reports the results in GPMC's results pane.

From a troubleshooting perspective, the most interesting parts of these results are contained on the Summary and Policy Events tabs. The Summary tab provides an overview of the computer and user-specific policy processing actions during the most recent processing cycle. To find out whether any part of either core or client-side–extension processing failed, you can look at the Component Status section on the Summary tab. A status of "Failed" for Group Policy Infrastructure components indicates a problem with core processing. A status of "Failed" for a client-side extension, such as Folder Redirection, indicates a problem with client-side–extension processing, as Figure 1 shows.

The Policy Events tab gives you additional useful troubleshooting information. The events shown on this tab offer a filtered view of the Application event log for the computer that the Group Policy Results Wizard queried. The view is filtered to show only Group Policy-related events, from which you can often glean useful information about what's working and what isn't. For example, suppose your logon script isn't running but the Summary tab's Component Status for the Scripts client-side extension indicates success. If you were to look in the Policy Events tab, you might see an error related to script processing such as the one shown in Figure 2, which tells you that the script file can't be found. This problem could be due to either a missing script file on the server or a permissions problem. In either case, you have a lead you can use to track down the cause of the problem. After you've used the information in the Summary and Policy Events tabs to narrow the problem, you can dig deeper.