Hi, this is Jeremy Moskowitz and today we are going to talk about troubleshooting Windows 7 and Group Policy. The good news is that with Windows 7 there is actually a lot more new stuff to check out. We talked about Group Policy Troubleshooting 101 in the last talk, let’s go ahead and take a look at some new items here.
If you go to Computer | Manage, and I am logged on as administrator to make my job a little easier, there are really several areas that you are going to want to take a look at for core Group Policy troubleshooting. We are going to look right at the Event Viewer folder for things. If we look at the Windows System Log that’s the first big place to look, this is really where the action is at. I must have a lot of events going on right now. You can see that I have a bunch of stuff coming up, and there is a Group Policy Event, and there is an error right there. Let’s go ahead and check it out, “Windows was unable to determine whether new Group Policy settings defined by network administrator should be enforced for this user or computer because the computers clock is not synchronized …”
That is a big problem, if your clock is not synchronized then you cannot get Kerberos and if you cannot get Kerberos then you can’t get Group Policy. So that is defiantly a big deal right there. But look, I got the error inside the Windows System Log. That was the big point that I wanted to show you here, is that the Windows System Log shows big events. There are a bunch of ways to sort this but, if we were to sort on the source here that is a quick way to do that and we can find all the Group Policy Events. You will also see that there is good news here too. In other words, if Group Policy worked correctly you will also, in fact, see those kind of events right here without any trouble and you will also see that I got new Group Policy there as well. The System Log is really the go to place to get started with that.
When it comes to Advanced Logging, there is a new log and it lives under a weird place, it lives under Applications and Services Log, Microsoft, Windows, and then dive down under Group Policy. It is called Group Policy Operational Log. Here, this gets a little hairy, you can see that there are a zillion events here and what you are looking at is actually millisecond by millisecond calls from Windows 7 into the Domain Controller and its walking in lockstep motion of what it is supposed to be doing.
If you think you have a bigger problem, something that requires a lot more troubleshooting, you may want to check out the Group Policy Operational Log on the client machine that you are having the actual problem with. For instance, this machine Windows 7, computer 1 is having a problem. No problem at all, you go to the Group Policy Operational Log and look around the date and time where things were not working and you might be able to step through and figure out what might be going on and see if there is an error in here as well. If there was an overall failure, you would see that overall failure in the System Log that we just saw, but what you would get out of the Group Policy Operational Log is all the steps leading up to that failure and it might just tell you what the problem is.
Thank you very much; this is Jeremy Moskowitz talking to you about Windows 7 and Group Policy Troubleshooting.