Windows Server 2008 and Windows Vista : Common GPO Troubleshooting Tools (part 1) - GPLogView

When you are troubleshooting a tough Group Policy processing problem, you have several tools to help you. The following tools are either built in to the operating system or can be quickly downloaded and installed from the Microsoft Web site.

GPLogView

If you need to archive Group Policy logs or troubleshoot a computer in a remote location, it might be easier to do so using a text output of the log, instead of trying to use Event Viewer. If you want to generate and view Group Policy logs in text, HTML, or XML format, you can use the GPLogView utility. You can use GPLogView to export Group Policy event data from the system and Group Policy operational log.

Export All Group Policy Events

You can use GPLogView to export all Group Policy–related events from the system log and the operational log. The –o switch is used to specify the output file name.

gplogview -o c:\gpevents.txt

Export Group Policy Events with a Specific ActivityID

GPLogView filters Group Policy–related events by ActivityID, which is useful for troubleshooting a specific instance of Group Policy processing. The –a switch is used in conjunction with the ActivityID.

gplogview -a 8A7C7CE5-F7D0-4d32-8700-57C650A53839 –o c:\gpevents.txt

Tip

Events with the same ActivityID are all color-coded with the same color. This allows you to quickly see which events belong together, optimizing your troubleshooting effort and time.

Run in Monitor Mode

You can use GPLogView to capture Group Policy events in real time, by using the –m switch. GPLogView writes all Group Policy–related events to the command window, as they occur, as shown in Figure 1. Press Ctrl+C to exit monitor mode, or press Q and Enter simultaneously.

gplogview –m

Figure 1. GPLogView allows you to view events in real time for Group Policy processing.

Use an External Event Log for Input

By default, GPLogView reads the event logs on the current computer running Windows Vista. However, you can change the GPLogView input source to an exported event log from another computer running Windows Vista, by using the –i switch. This change gives you the ability to export multiple views of Group Policy processing that happened on another computer.

Gplogview -i savedevents.evtx -o gpevents.txt

Note

The saved event log must come from a computer running Windows Vista. GPLogView does not work with saved event logs from earlier versions of Windows.