Now let's say that group policy results or are so B doesn't give you the answers that you need in terms
of figuring out where the problem is.
And, you know, it's not a replication issue.
Where do you go next?
Well, group policy logging is your next step in that troubleshooting cycle.
And this is where you can get some additional information from the client that's processing policy about
what might be going on.
And this can often lead to a solution, if not lead you in the right direction for a solution.
So let's look at what's available in the box.
So there is a number of logs that you can look at on the client to determine what's going on with group
policy.
And it's unfortunately not really consistent.
It will depend a lot on the version of Windows you're on and the client side extension that's doing
the reporting.
But there are essentially three logs that I typically look in when I'm looking for group policy related
events.
The first two are the Windows system and application event logs, and they will provide typically high
level events, in other words, not detailed events about a particular part of group policy processing
or a client side extension that happens to report its data up to those event logs.
By far the most detailed you're going to get is in the group policy operational log, which since Windows
seven and next client versions has delivered more and more detail.
So Windows seven delivered a bunch of detail in the operational log around each step of group policy
processing.
Windows 8.1 and Server 2012 are two and next server versions delivered that much more detail.
And so now, you know, with current versions of Windows, the operational log is a great place to go
to get a view of what's going on.
And as if you'll remember from my previous demo about group policy results or group policy logging.
I showed you that view log option that let you see the step by step.
And that was actually coming out of the group policy operational log.
So lots of details about what's happening during a processing cycle in a really step by step fashion.
So again, not all cases report up to system or application.
So it's kind of hit and miss.
The operational law does provide that step by step logging.
And I would say that the best combination of instrumentation that you can get is from a Windows 8.1
and next client versions like Windows ten or 11 or Server 2012 or to Windows Server 2016, 19 or 2022.
Admin station reporting against a Windows ten or server 2022 client.
So again, you do get a lot of detail out of older Windows clients, but for sure the the instrumentation
and the interpretation of the instrumentation is strongest on those newer versions of the operating
system.
Now, in order to use the operational log, you need to know where it is.
And it's not altogether obvious.
But if you're in the event viewer, it's under this this subtree called applications and services logs.
Microsoft Windows Group policy.
And this kind of shows you where it is in The View.
So you'll see under group policy there's a folder called operational and on the right or in the middle
pane you see all the events and the different things that are going on in the events.
So this is once you find it, it's really your friend when it comes to figuring out what's going on
with group policy during a given cycle.
Let's look a little bit into the operational log and the event logs and see what kind of information
we can get on them.