Information Technology Reference
In-Depth Information
Troubleshooting Group Policies
Because of the wide variety of configurations that are possible when you are establishing
GPOs, you should be aware of some common troubleshooting methods. These methods
will help isolate problems in policy settings or GPO links.
One possible problem with GPO configuration is that logons and system startups may
take a long time. This occurs especially in large environments when the Group Policy
settings must be transmitted over the network and, in many cases, slow WAN links. In
general, the number of GPOs should be limited because of the processing overhead and
network requirements during logon. By default, GPOs are processed in a synchronous
manner. This means that the processing of one GPO must be completed before another one
is applied (as opposed to asynchronous processing, where they can all execute at the same
time).
When a group policy gets processed on a Windows-based operating system, client-
side extensions are the mechanisms that interpret the stored policy and then make the
appropriate changes to the operating system environment. When an administrator is
troubleshooting a given extension's application of policy, the administrator can view the
configuration parameters for that extension in the operating system's registry. To view the
extension in the registry, you would view the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows \CurrentVersion\Group Policy
The most common issue associated with Group Policy is the unexpected setting of
Group Policy options. In Windows Server 2000, administrators spent countless hours
analyzing inheritance hierarchy and individual settings to determine why a particular user
or computer was having policy problems. For instance, say a user named wpanek complains
that the Run option is missing from his Start menu. The wpanek user account is stored in
the New Hampshire OU, and you've applied group policies at the OU, domain, and site
levels. To determine the source of the problem, you would have to sift through each GPO
manually to find the Start menu policy as well as to figure out the applicable inheritance
settings.
Windows Server 2012 R2 has a handy feature called Resultant Set of Policy (RSoP)
that displays the exact settings that actually apply to individual users, computers, OUs,
domains, and sites after inheritance and filtering have taken effect. In the example just
described, you could run RSoP on the wpanek account and view a single set of Group
Policy settings that represent the settings that apply to that account. In addition, each
setting's Properties dialog box displays the GPO from which the setting is derived as well
as the order of priority, the filter status, and other useful information, as you will see a bit
later.
RSoP actually runs in two modes.
Logging Mode Logging mode displays the actual settings that apply to users and
computers, as shown in the example in the preceding paragraph.
 
Search WWH ::




Custom Search