Module 11: Troubleshooting Group Policy Issues

1

• Module 11 Troubleshooting Group Policy Issues

2
Module Overview

• Introduction to Group Policy Troubleshooting
• Troubleshooting Group Policy Application
• Troubleshooting Group Policy Settings

3
Lesson 1 Introduction to Group Policy
Troubleshooting

• Scenarios for Group Policy Troubleshooting
• Preparing to Troubleshoot Group Policies
• Tools for Troubleshooting Group Policies
• Demonstration Using Group Policy Diagnostic
  Tools

4
Scenarios for Group Policy Troubleshooting

• Common scenarios that require troubleshooting

Polices not applied
ü
Policies are applied but settings are
inconsistent
ü
5
Preparing to Troubleshoot Group Policies

• Basic troubleshooting steps

Check Event Viewer entries
ü
Perform basic checks to test network
connectivity use diagnostic tools like
netdiag, ping
ü
Ensure that DNS is functioning use NSlookup
ü
Check that the domain controller is functioning
and reachable use diagnostic tools like
dcdiag, the set command, Kerbtray
ü
6
Tools for Troubleshooting Group Policies

• Group Policy troubleshooting tools

• Group Policy reporting RSOP
• GPResult
• Gpotool
• Gpupdate
• Dcgpofix
• GPOLogView
• Group Policy log files
• Group Policy Management Scripts

7
Demonstration Using Group Policy Diagnostic
Tools

• In this demonstration, the instruction will
  demonstrate the use of
• GPResult in regular and verbose mode
• GPOTool
• Gpupdate
• GPLogView

8
Lesson 2 Troubleshooting Group Policy
Application

• Troubleshooting Group Policy Inheritance
• Troubleshooting Group Policy Filtering
• Troubleshooting Group Policy Replication
• Troubleshooting Group Policy Refresh
• Discussion Troubleshooting Group Policy
  Configuration

9
Troubleshooting Group Policy Inheritance
Domain
Production
GPOs
Blocked inheritance prevents high level policies
from applying to entire subtrees of OUs
Sales
No GPO settings apply
10
Troubleshooting Group Policy Filtering
Domain
Production
GPO
Group Policy filtering may affect only certain
users or computers in OUs
WMI filter
Sales
Read and Apply Group Policy
Mengph
Allow
Kimyo
Apply Group Policy
Group
Deny
11
Troubleshooting Group Policy Replication

• Group Policy objects consist of Group Policy
  templatesand Group Policy containers
• GPTs and GPOs replicate using different
  mechanisms
• Replication issues can cause domain controllers
  to have inconsistent versions of Group Policies
• The GPOTool can check for policy consistency
  across all domain controllers

File Replication Service
GPT
GPT
GPC
GPC
Active Directory Replication
GPO1 Version 2
GPO1 Version 3
DC1
DC2
12
Troubleshooting Group Policy Refresh
If the Group Policy is not refreshing as expected

• Check refresh intervals for users and computers
• Verify that the user has logged off and on, or
  that the computer has been restarted
• Check if there are cached credentials because
  they may delay the effect of Group Policy
• Check to see if the Loopback policy is enabled

Use gpupdate to

• Manually refresh updated Group Policy settings
• Force the refresh of all Group Policy settings
• Force a reboot or logoff, if required, to refresh
  the settings

13
Discussion Troubleshooting Group Policy
Configuration

• In this discussion, you will create a flow chart
  for troubleshooting Group Policy

14
Lesson 3 Troubleshooting Group Policy Settings

• How Client Side Extension Processing Works
• Troubleshooting Administrative Template Policy
  Settings
• Troubleshooting Security Policy Settings
• Troubleshooting Script Policy Settings
• Troubleshooting Software Installation Policy
  Settings

15
How Client Side Extension Processing Works

• Client side extensions are DLLs that process
  group policy settings
• Some CSEs do not process if a slow link is
  detected
• Some CSEs are always applied and cannot be turned
  off

• List of client side extensions

• Security Settings
• Administrative Templates
• Software installation
• Scripts
• Folder redirection
• Internet Explorer maintenance

16
Troubleshooting Administrative Template Policy
Settings

• When troubleshooting Administrative Templates,
  consider that

Administrative Templates are either true
polices or preferences
ü
Settings that are true policies are reversed
when the policy no longer applies
ü
Settings that are preferences will tattoo the
registry and remain in effect until they are
specifically reversed
ü
The operating system and service pack level
determine if the computer can accept a policy
setting
ü
17
Troubleshooting Security Policy Settings

• When troubleshooting security policy settings,
  consider that

Account policies are passed to clients from the
domain controller
ü
The domain controller receives account policies
from a domain level policy
ü
Security settings come from the GPO that have
the highest priority
ü
18
Troubleshooting Script Policy Settings

• When troubleshooting script policy settings,
  consider the following

Validate the script
ü
Ensure that users and computer have access to
the script
ü
Ensure that Group Policy is configured
correctly
ü
Ensure the script is replicating properly
ü
Use the Group Policy tools to ensure that Group
Policy is applied correctly
ü
19
Lab Troubleshooting Group Policy Issues

• Exercise 1 Troubleshooting Group Policy Scripts
• Exercise 2 Troubleshooting GPO Lab-11B
• Exercise 3 Troubleshooting GPO Lab-11C
• Exercise 4 Troubleshooting GPO Lab-11D

Logon information
Estimated time 60 minutes
20
Lab Review

• If a policy at the domain level is set for
  enforcement, while another policy at the OU level
  with a conflicting setting also is set to be
  enforced, which policy setting will the OU
  clients receive?
• If you use group policy to configure the
  slow-link detection threshold to be zero, what
  does that indicate?

21
Module Review and Takeaways

• Considerations
• Tools
• Review questions

22
Beta Feedback Tool

• Beta feedback tool helps
• Collect student roster information, module
  feedback, and course evaluations.
• Identify and sort the changes that students
  request, thereby facilitating a quick team
  triage.
• Save data to a database in SQL Server that you
  can later query.
• Walkthrough of the tool

23
Beta Feedback

• Overall flow of module
• Which topics did you think flowed smoothly, from
  topic to topic?
• Was something taught out of order?
• Pacing
• Were you able to keep up? Are there any places
  where the pace felt too slow?
• Were you able to process what the instructor said
  before moving on to next topic?
• Did you have ample time to reflect on what you
  learned? Did you have time to formulate and ask
  questions?
• Learner activities
• Which demos helped you learn the most? Why do you
  think that is?
• Did the lab help you synthesize the content in
  the module? Did it help you to understand how you
  can use this knowledge in your work environment?
• Were there any discussion questions or reflection
  questions that really made you think? Were there
  questions you thought werent helpful?