All right.
Now, what I want to do is use Samarra Soapy to do modeling and logging of group policy processing.
So what I'm going to do is I'm going to start with the group policy modeling wizard.
And as you can see, I'm an M.C. beneath the domains node under group policy modeling.
And if I right click start the group policy modeling wizard.
Click next.
I can select the DC that I want to run the simulation on and again I can pick the domain and it'll show
me all the DC is available.
In this case, I only have this one, so I'm going to go ahead and choose the default.
And then I can choose the container where the user object that I want to model.
So what does this mean?
So for the user, I can choose another view that the user is a member of.
So for example, I can come into sales users and we know we've got my good old friend Joe Sales in there
and I can choose the container or the user for the computer object.
So what this is doing is it's telling me that I'm going to model for any users in the users o u under
sales or in the case of the computer, I'm going to model for any computers in the marketing.
All you.
I could have picked a specific user or a specific computer if I wanted to, but in this case, I'm just
going to be generic about it.
Now here is where I can kind of tweak the behavior of processing a little bit.
Let's say, for example, I wanted to simulate.
A slow network connection, which, as we've known from an earlier module, can affect which client
side extensions run.
I can also select to have loopback processing run or at least be simulated to run.
And this, of course, changes what user settings are delivered to the user.
And then I can tell it what site my client is in.
In this case.
I just had this one site, so I'll go ahead and take the default site.
Then what I can do is I can simulate group membership for both the user and the computer.
So, for example, for the selected user, I can say, okay, they're in the sales users group.
So I want to simulate them being a member of the sales users.
And where this comes into play is that remember that security group filtering can affect which GPOs
get processed.
So if you want a model, adding somebody to a group and see what effect that has on the group policy
they receive or or removing them from the group for that matter.
You can do that and I can do the same for computers.
I'll just leave this at the default.
And then I can have either the my filters that are currently linked to the GPOs that are selected or
I can have it be specific to particular filters that I use.
So in this case I don't have any filters, but I'll just choose all linked filters, which leaves the
current linking of whatever w my filters might be in place and it just leaves that at the default.
And I can do the same for computers.
And now I'm ready to run the simulation, so I'm going to go ahead and let it run.
And it's finished.
And it tells me what has happened for users in the sales users.
You and computers in the marketing.
Oh, you.
So it gives me the summary and it tells me this isn't super relevant because it's not actually showing
me what happened on a system.
It's modeling what might have happened.
But it's just saying the fast link is detected because I didn't choose the slow link option.
And what I'm really looking at is in the Details tab, which shows me all of the sort of status of group
policy processing and more interestingly, the settings that have been delivered.
So it shows me that this startup script was delivered via the scripts policy and that these security
settings were delivered to the OR will be delivered to the computers in this IOU based on this winning
policy of default.
Domain policy.
And then I can come down under group policy objects and see which GPOs have been applied and which have
been denied.
And the reason they're denied.
In this case, this one has a disabled link.
And then I can come in under user details and see the same information under user details.
So essentially it shows me all of the settings that are delivered, the GPOs that win, the GPOs that
lose.
Why they win and why they lose.
Now the query tab just shows me the values that I've chosen for this modeling run.
So that's group policy modeling.
And again, that's for figuring out what might be going on ahead of the game, so to speak, with policy
processing.
Group policy results, on the other hand, is giving you information on what's happened in the past.
So I'm going to go ahead and run a query against an actual system.
And this is where it goes out and touches that system over WMD for the for the R to test sales user.
And I'm going to run that model.
And this is telling me what happened during the last GP processing cycle.
And so when, then when the report comes back, what I'll get is data about this particular policy processing.
The summary shows me whether any errors were detected for computer or user refresh and the fast link
was detected.
So that's good.
If I come in under details.
This is how it has broken out.
Similar to GP modelling.
And what it does further is it gives me a lot of detail about what process, how processing happened
on this machine.
So first for the computer.
It'll give me the name, the domain, the site, the organizational unit the computer was detected in,
and the computers group membership at the time the policy was processed.
This is really important for troubleshooting group membership filtering issues because this will show
you what group policy thought the computers, group policy or group membership was.
Then down here under component status.
It's giving me lots of great information about each client side extension that's run and how long it
took.
So group policy infrastructure is the core phase of group policy processing.
That tells me essentially how many are that.
He gives me the phase of group policy processing when it actually determines which GPOs it needs to
process.
And then each subsequent client side extension runs and gives me additional information about how long
it took to run that client side extension.
The last time it was processed.
And this little view log entry, which is really handy.
What it's doing is it's going out and passing the operational, the group policy operational log on
the target system and showing the just the events for this last group policy processing cycle in a step
by step fashion.
And this is super useful for troubleshooting the operational log, which I'm going to talk about in
a little bit through group policy results.
And that, again, it shows me all the settings that were delivered to the client.
You'll see that startup dot, that file that was delivered by the scripts policy and my admin templates
for the computer and the applied GPOs and the denied GPOs.
In this case, I had the Dallas sales office printers, GPO.
That was denied because it's empty.
And the policy and preference GPL.
That was denied because it's empty.
Now my filters were applied.
And then I get into user details.
And here you'll see, for example, that folder redirection is showing is pending because it did not
complete because it needs the user to log on again for the settings to be applied.
So here it is, telling you exactly why folder redirection policy didn't work, which is really handy.
This component status section is super important when it comes to troubleshooting group policy.
And then it shows you installed applications for the user, all the user settings and again all the
users applied and denied GPOs.