In this video from ITFreeTraining I will look at some Group Policy tools that can be used
with troubleshooting Group Policy and testing new settings. These tools include, Group Policy
Results, Group Policy Modeling and GPResult. Determining which settings have been applied
on a client computer can be a tricky process. It is not always a simple matter to look at
what settings have been configured in Group Policy to determine which settings will ultimately
be applied. When Group Policy is applied, settings may not be applied due to factors
like security stings and WMI filters. When trying to determine the end result a
user or computers would receive from Group Policy, you essentially want to find the net
effect of the Group Policy. This is known as Resultant Set of Policy or RSOP. The Group
Policy results tools that I will look at rely on this data in order to determine which settings
are being applied. In order to run these tools you need to meet
a few requirements. First you need administrator rights on the computer. The computer must
also be running Windows XP or above. If you are planning on connecting to the computer
from remote, the computer requires port 135 and port 445 to be opened and the WMI service
to be running. I will now change to my Windows Server 2008
R2 Domain Controller to look at how to use some of these tools.
First of all, I will open Group Policy Management from the start menu. The first feature that
I will look at is Group Policy Results. This will allow me to see what settings will be
applied even if WMI filters and security have been configured.
To start the wizard, right click on Group Policy Results and select Group Policy Results
Wizard. Once you are past the welcome screen, the next screen will ask which computer you
want to display the Group Policy results on. In this case I will select a remote computer
rather than the local computer. Notice that there is also a tick box which
will only generate results for user configuration. This speeds up the process if you only require
user settings. Notice that when I press next I get an error
message telling me the RPC server is unavailable. This is because the other computer has not
yet been configured to allow the connection. I will now change to my Windows 8 client computer
to configure it for use with Group Policy Results.
On my Windows 8 client, I will first open the control panel. To do this, I will open
Windows Charms by moving my mouse to the top right hand comer, selecting settings at the
bottom and then selecting control panel at the top.
Once the control panel is open, I will use the search option to search the control panel
for services. I will then select the option, “view local services” to open the services
control panel. The service that I want to start is called WMI Performance Adapter.
Once I have the WMI service selected, I will open the properties for it. In this case I
will change the start up to automatic delayed start. When the computer starts up, services
configured as automatic will start first. Services configured for delayed start will
start shortly after the computer has finished booting. This helps lessen the load on the
computer when it first starts up making it more responsive. Not essential service should
be configured to delayed start while essential services should be configured to automatic.
This option will not take effect until the computer is rebooted, so I will press the
button “start” to start the service up now.
Now that the service has been configured, I will close services and go back to the control
panel. I next need to make changes to the Windows firewall, so I will enter in “firewall”
in the control panel search and select the option Windows Firewall.
In this case I cannot configure the ports that I need opened in the standard interface
so I will select the option on the right, advanced settings. To configure the four rules
required, select the option on the left, Inbound Rules.
The first 3 rules that I need to enable are found under Remote Log Management. Before
enabling the rule, check to make sure the profile is the one you want. In this case
the profile that I want is the Domain profile so I have the rule that I want to select.
To enable it, right click on it and select enable rule.
I next need to enable the other two Remote Event Log Management ensuring that I select
the ones that are for the domain profile. Once these 3 rules are enabled, the last rule
that I need to enable is Windows Management Instrumentation. There are a few different
rules for Windows Management Instrumentation but the only one that you require is the one
ending in WMI-In. Now that I have configured all the rules,
I can close the Windows Firewall and the control panel. Now that the client is configured I
will change back to my Domain Controller. Once I acknowledge the error and press next,
notice the wizard will now be able to communicate with the client and thus will continue.
On the next screen I can choose which user will be used to generate the user results.
In order for a user to appear here, that user needs to have logged in the computer at least
once, however they do not need to be logged in when you run the wizard.
Notice at the bottom you have the option to disable user configuration and only generate
results from computer settings. This will speed up the process if you only need to look
at computer settings. The next screen of the wizard will show you
the settings that were selected. Once I press “next” I will be able to press “finish”
and finish the wizard. Notice the results have been generated. At
the top is the computer configuration and at the bottom the user configuration. If I
expand “general”, notice that the computer name, domain, site, and last Group Policy
processing time are listed. Under Group Policy Objects you will notice
that this lists which GPOs were applied and which were denied. Under the applied GPOs,
notice that the Default Domain Policy is listed and the New York Policy is listed. Under Denied
GPOs, notice the local Group Policy has been denied.
This may seem strange that it was denied until you see the reason that it was denied was
because the local Group Policy is empty and thus there was no point applying it.
Under Security Group Membership, when Group Policy was applied to the client, this shows
which group the computer account was a member of when this report was generated. This is
useful information if you find that a particular Group Policy has not been applied. The reason
may be as simple as the user or computer is not a member of the correct group.
If you have any WMI Filters they will be listed here, in this case no WMI filters were applied.
Lastly you can see which components were used with Group Policy.
If I select the settings tab, this will list the individual Group Policy settings that
would be applied. If I expand down into Administrative Templates, notice I can see that two settings
that were applied from the Default Domain Policy. The benefit with using this method
to view the settings is that it takes into account WMI filter and security filtering
and thus gives you a true indication of which settings were applied to that client.
The last tab is Policy events. This shows any Group Policy related events. You will
notice that the event at the top states that Group Policy was successfully applied, which
is what you want. If I scroll down to the bottom, notice that
a warning event was generated. If I open the event it is stating that software could not
be installed as it required a foreground refresh. This kind of error is generally fixed by rebooting
the computer and allowing Group Policy to be reapplied at system start up.
If you are not sure what the error means, you can always perform an internet search
on the Event ID shown here. If you cannot find information on the particular event ID,
try combing the search with part of the text from the description.
If I go back now and open the error event above this, this particular event indicates
an install problem. It is indicating a file could not be found so it is most likely the
computer could not access the install files when it attempted to install the application.
Perhaps there was a permission problem or the file server was not available.
I will now close out of here and look at the next feature, Group Policy Modeling. Once
again all you need to do is right click Group Policy Modeling and select the option Group
Policy Modeling Wizard. Once I go past the welcome screen, the next
screen will ask which Domain Controller you wish to connect to. You can choose any Domain
Controller that is above Windows Server 2003. Windows Server 2003 adds additional features
in order to support Group Policy Modeling. The client could use a Windows Sever 2000
Domain Controller to login without issue. The feature is only required for modeling
or, to think of it another way, to run this wizard required Windows Server 2003 Domain
Controller. On the next screen you can select which container
or user that you want to perform the modeling with. In this case I will select the user
“trainer” and the computer “WS4”. Both the user and computer account are located
under the OU New York. On the next screen I can choose some additional
simulation options. At the top I can choose to enable slow network connection. This means
the Group Policy setting will be processed as if the computer detected a slow network
connection. The next option allows you to configure loopback
processing. If you are thinking about using loopback processing, it is a good idea to
test the configuration out in Group Policy Modeling before you configure it in case there
are any potential problems. Below this you can choose the site that will
be used. If you have users that travel, this is a good way to test the site related Group
Policies and correct any problems before the user leaves the office. In this case, I will
choose the Washington site and move on. On the next screen you can choose where you
want the simulation to consider the user and computer account to be located. In this case
the user and computer accounts are located under the New York OU, however in this example
I will choose the Washington Users and Computers OU. This will allow me to test what would
happen if the user and computer account were moved in Active Directory without having to
move the accounts around. On the next screen I can choose which security
group the user is a member of. This is useful to test out group changes if you are using
security filtering. Once again, this is done without changing or modifying the user.
The next screen is very simpler to the last, but this time you can select a security group
for the computer account. In this case I do not want to test any group changes so I will
press next and move on. On the next screen you can configure which
WMI filters will be used for the user. If I select only these filters I can select which
filters to use. In this case, there are no WMI filters being used on these Group Polices
so I cannot select any. On the next screen you have the same options
for WMI filters except this apply to computer configuration. I am not using any WMI filters
so I will move on. The next screen will provide a summary of
the options I chose. Once I press next I will be taken to the finish screen of the wizard.
Now that the wizard has completed, notice that a report has been generated with all
the settings in it. If expand the general section, notice that the computer name has
come up as WS4 which is currently located in New York. However, since I changed the
location of the computer account in the wizard, the report has been generated as if the computer
was in the Washington computers OU. This tab only gives general information, if
I select the settings tab, I can see the settings that would be applied if the user and computer
accounts were moved to Washington. All this is done without making any changes to Group
Policy or Active Directory. You can see that if I expand Administrative
templates I can see that only two settings have been applied from the Default Domain
Policy. No Group Policy settings having been configured for Washington. Before I move the
user and computer accounts I should consider configuring some Group Policy settings and
applying these to Washington. Once this is done, I should rerun this wizard to see if
this is the result I want before moving the user and computer accounts from New York.
The last tab query shows the settings that were used to generate the report. I can
also achieve simpler results from the command line. To look at how to do this, I will change
to my Windows 8 client. From Windows 8, I will first open the search
option. From here I will go down to the command prompt icon and right click it. Right clicking
and icon will display additional options at the bottom of the screen. The option that
I am interested in is “runs as administrator”. Once I have a command prompt open with administrator
rights, the first command that I will run is GPResult with the /r switch. The /r switch
displays a summary of the Resultant Set of Policy data or RSOP data. This is the same
information that I was able to obtain using the Group Policy Result tool in Group Policy
Management Console that I demonstrated earlier. For this command and other commands that I will
demonstrate in this video I will add a broken bar followed by more to the command line.
This tells Windows to transfer the output from one command to anther is a processing
called piping. The more command will take the output from the first command and pause
the screen when it is full making it easier to read.
You can see that the /r switch gives you basic information about the Group Polices that were
applied to this computer. For basic troubleshooting it is a fast way to determine which Group
Polices have been applied, which OU the user and computer account it is in, and which settings,
such as slow link, have been enabled. If you want additional information you can
use the /v switch for verbose mode. In this case I have also added the /Scope switch with
the user option to limit output to user configuration only. If I did not add the scope switch, the
amount of data given would be quite large. I can also use the Scope option to limit
the output to computer configuration only. You will notice that toward the end is additional
information that was not shown with the /r switch, however the start of the output is
pretty much the same.
If you prefer the output to be in a report format, you can output the results to an HTML
or XML file using the /h or /x switches. In this case I will output the report into HTML
format. Once complete, notice that when I open the report using Internet Explorer, the
report is the same report that I viewed earlier using Group Policy Management Console.
You can see that using GPResult you can achieve the same results as using Group Policy Results
in the Group Policy Management Console. You can see that using this tools will not
only help you troubleshoot Group Policy related problems in your domain, but will also help
you implement new Group Policy changes. Thanks for watching this video from ITFreeTraining.
If you would like to see more videos from us please subscribe to us on YouTube. See
you next time.