Windows tip: Understanding Group Policy Event Logs in Vista
My last couple of tips have dealt with troubleshooting Group Policy processing in Windows Vista and later. Understanding how to do this is important for enterprises since Group Policy is a key tool for managing both client and server systems across an organization.
Checking your Event logs is usually the first step in troubleshooting any issue on Windows-based networks, so it's important to understand how logging of Group Policy events has changed in Vista compared to previous versions of Windows. For example, in Windows XP, administrative events relating to Group Policy were logged to the System log, and the event source for such events was displayed as "USERENV" since they were generated by Userenv.dll, the Group Policy engine on earlier Windows platforms. If you tried to troubleshoot a policy processing issue on Windows XP and found that the USERENV events in the System log didn't provide enough info, you could configure Userenv debug logging by setting UserEnvDebugLevel, a REG_DWORD registry value found at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, to one of the following data values depending on how verbose you wanted to make the log:
0x00000001 (normal—the default)
0x00000002 (verbose)
0x00010000 (logfile)
0x00020000 (debugger)
You could also turn off logging entirely by setting UserEnvDebugLevel to 0x00000000, and you could combine the above four logging levels for greater detail. For example, setting UserEnvDebugLevel to 0x00030002 would provide the greatest level of detail in the log.
Things have changed in Vista however, and Events generated by the Group Policy engine as well as information previously logged in the Userenv log are now logged in the Application event log, while events generated by Group Policy extension DLLs are now logged to the Group Policy Operational event log. In addition, the event source for Application log events has now changed from "USERENV" (used in the System event log previously) to "Group Policy".
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
Esther Schindler
If the comments are ugly, the code is ugly
claird
SVG a graphics format for 21st century
pasmith
Take Chrome OS for a test spin
Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?
jfruh
Android fragments vs. the iPhone monolith
mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.
