However, in Windows Vista, the Group Policy engine no longer records information in the userenv.log. Instead, detailed logging of Group Policies can be located using Event Viewer. The log for group policy processing can be found in the Event Viewer under Applications and Services Logs\Microsoft\Windows\Group Policy\Operational - a sample is shown below.
As you can see, each of the policy processing events that occur on the client are logged in this event viewer channel. This is an administrator-friendly replacement for the userenv.log. When looking at these events in the event viewer, there are some event ranges to be aware of:
|4000 - 4299||Scenario Start Events|
|5000 - 5299||Corresponding Success Scenario End Events (scenario start event + 1000)|
|5300 - 5999||Informational Events|
|6000 - 6299||Corresponding Warning Scenario End Events (scenario start event + 2000)|
|6300 - 6999||Warning Events (Corresponding Informational Event + 1000)|
|7000 - 7299||Corresponding Error Scenario End Events (Scenario Start Event + 3000)|
|7300 - 7999||Error Events (Corresponding Informational Event + 2000)|
|8000 - 8999||Policy Scenario Success Events|
Administrative events relating to Group Policy are still logged in the System Event Log, similar to pre-Windows Vista platforms. The difference is that the event source for the event is now Group Policy instead of USERENV. In Windows Vista, the Group Policy script processing errors are also now logged through the same mechanism as the rest of the Group Policy errors.
And that brings us to the end of this quick post on Group Policy Logging on Windows Vista. Until next time ...
|Share this post :|
3/11: Removed last paragraph (applied to server, not client OS), added additional Technet links and re-published article
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.