Transcript Module 11: Troubleshooting Group Policy Issues Module Overview • Introduction to Group Policy Troubleshooting • Troubleshooting Group Policy Application • Troubleshooting Group Policy Settings.

Module 11:
Troubleshooting Group
Policy Issues
Module Overview
• Introduction to Group Policy Troubleshooting
• Troubleshooting Group Policy Application
• Troubleshooting Group Policy Settings
Lesson 1: Introduction to Group Policy
Troubleshooting
• Scenarios for Group Policy Troubleshooting
• Preparing to Troubleshoot Group Policies
• Tools for Troubleshooting Group Policies
• Demonstration: Using Group Policy Diagnostic Tools
Scenarios for Group Policy Troubleshooting
Common scenarios that require troubleshooting:

Polices not applied

Policies are applied but settings are inconsistent
Preparing to Troubleshoot Group Policies
Basic troubleshooting steps:

Check Event Viewer entries

Perform basic checks to test network connectivity: use
diagnostic tools like netdiag, ping

Ensure that DNS is functioning: use NSlookup

Check that the domain controller is functioning and reachable:
use diagnostic tools like dcdiag, the set command, Kerbtray
Tools for Troubleshooting Group Policies
Group Policy troubleshooting tools:
 Group Policy reporting – RSOP
 GPResult
 Gpotool
• Gpupdate
• Dcgpofix
• GPOLogView
• Group Policy log files
• Group Policy Management Scripts
Demonstration: Using Group Policy
Diagnostic Tools
In this demonstration, the instruction will demonstrate the
use of:
• GPResult in regular and verbose mode
• GPOTool
• Gpupdate
• GPLogView
Lesson 2: Troubleshooting Group
Policy Application
• Troubleshooting Group Policy Inheritance
• Troubleshooting Group Policy Filtering
• Troubleshooting Group Policy Replication
• Troubleshooting Group Policy Refresh
• Discussion: Troubleshooting Group Policy Configuration
Troubleshooting Group Policy Inheritance
Domain
Production
GPOs
Blocked inheritance prevents high
level policies from applying to entire
subtrees of OUs
No GPO
settings
apply
Sales
Troubleshooting Group Policy Filtering
Domain
GPO
Production
WMI
filter
Group Policy filtering
may affect only
certain users or
computers in OUs
Sales
Mengph
Kimyo
Group
Read and
Apply
Allow
Group
Policy
Apply
Deny
Group
Policy
Troubleshooting Group Policy Replication
• Group Policy objects consist of Group Policy templates
and Group Policy containers
• GPTs and GPOs replicate using different mechanisms
• Replication issues can cause domain controllers to
have inconsistent versions of Group Policies
• The GPOTool can check for policy consistency
across all domain controllers
GPT
GPC
DC1
File Replication Service
Active Directory Replication
GPT
GPC
GPO1
GPO1
Version 3
Version 2
DC2
Troubleshooting Group Policy Refresh
If the Group Policy is not refreshing as expected:
• Check refresh intervals for users and computers
• Verify that the user has logged off and on, or that the
computer has been restarted
• Check if there are cached credentials because they may
delay the effect of Group Policy
• Check to see if the Loopback policy is enabled
Use gpupdate to:
• Manually refresh updated Group Policy settings
• Force the refresh of all Group Policy settings
• Force a reboot or logoff, if required, to refresh
the settings
Discussion: Troubleshooting Group
Policy Configuration
In this discussion, you will create a flow chart for
troubleshooting Group Policy
Lesson 3: Troubleshooting Group Policy Settings
• How Client Side Extension Processing Works
• Troubleshooting Administrative Template Policy Settings
• Troubleshooting Security Policy Settings
• Troubleshooting Script Policy Settings
• Troubleshooting Software Installation Policy Settings
How Client Side Extension Processing Works
• Client side extensions are DLLs that process group
policy settings
• Some CSEs do not process if a slow link is detected
• Some CSEs are always applied and cannot be turned off
List of client side extensions:
• Security Settings
• Administrative Templates
• Software installation
• Scripts
• Folder redirection
• Internet Explorer maintenance
Troubleshooting Administrative Template
Policy Settings
When troubleshooting Administrative Templates,
consider that:

Administrative Templates are either true polices or preferences

Settings that are true policies are reversed when the
policy no longer applies

Settings that are preferences will tattoo the registry
and remain in effect until they are specifically reversed

The operating system and service pack level determine
if the computer can accept a policy setting
Troubleshooting Security Policy Settings
When troubleshooting security policy settings,
consider that:

Account policies are passed to clients from the domain controller

The domain controller receives account policies from a domain
level policy

Security settings come from the GPO that have the highest priority
Troubleshooting Script Policy Settings
When troubleshooting script policy settings, consider
the following:

Validate the script

Ensure that users and computer have access to the script

Ensure that Group Policy is configured correctly

Ensure the script is replicating properly

Use the Group Policy tools to ensure that Group Policy
is applied correctly
Lab: Troubleshooting Group Policy Issues
• Exercise 1: Troubleshooting Group Policy Scripts
• Exercise 2: Troubleshooting GPO Lab-11B
• Exercise 3: Troubleshooting GPO Lab-11C
• Exercise 4: Troubleshooting GPO Lab-11D
Logon information
Virtual machine
NYC-DC1, NYC-CL1
User name
Administrator
Password
Pa$$w0rd
Estimated time: 60 minutes
Lab Review
• If a policy at the domain level is set for enforcement, while
another policy at the OU level with a conflicting setting
also is set to be enforced, which policy setting will the OU
clients receive?
• If you use group policy to configure the slow-link detection
threshold to be zero, what does that indicate?
Module Review and Takeaways
• Considerations
• Tools
• Review questions
Beta Feedback Tool
Beta feedback tool helps:
•



•
Collect student roster information, module feedback, and
course evaluations.
Identify and sort the changes that students request, thereby
facilitating a quick team triage.
Save data to a database in SQL Server that you can later
query.
Walkthrough of the tool
Beta Feedback
Overall flow of module:
•


Which topics did you think flowed smoothly, from topic to
topic?
Was something taught out of order?
Pacing:
•



Were you able to keep up? Are there any places where the
pace felt too slow?
Were you able to process what the instructor said before
moving on to next topic?
Did you have ample time to reflect on what you learned? Did
you have time to formulate and ask questions?
Learner activities:
•



Which demos helped you learn the most? Why do you think
that is?
Did the lab help you synthesize the content in the module?
Did it help you to understand how you can use this
knowledge in your work environment?
Were there any discussion questions or reflection questions
that really made you think? Were there questions you
thought weren’t helpful?