Okay.
Now, what I want to do is enable some trace logging.
So let's go ahead and bring up the registry.
And I'm going to go in under Hkeylocalmachine software.
Microsoft Windows 90.
Current version.
And I need to add a new key called Diagnostics.
This key doesn't exist by default.
So I'm going to go ahead and add the key called diagnostics.
Go ahead and hit a five.
So it puts it in order here.
And then I'm going to add a new reg underscore DWORD value with the name of SBC debug level.
And I'm going to set its value to 30,000 and to as I mentioned in my slide.
And now what I can do is come in and do a pop date slash force.
And once I do that, I should be able to go into the file system.
Let that run for a second.
So now I'm going to go in under file explorer.
On the local computer.
See Windows Debug user mode and here is my SDK log file.
One thing to note is that depending on the version of Windows, you may actually need to restart the
system after adding the registry key for service trace logging.
So that's less the case on newer versions like Windows ten and Server 2019 and more so on Windows seven
and earlier.
And once it's open, you'll see I've got the thread values that I talked about and lots of different
threads going on here at the same time.
The thing to note about the SBC log file, there's a lot of stuff in here that isn't necessarily related
to group policy.
So this log includes both policy and user profile trace logging.
So you sort of have to sift through it.
You'll notice here.
This is related to group policy.
There's a bunch of other very detailed calls in the log file that don't have anything to do with group
policy.
But once in a while we'll get to a section where we can see.
Here it is.
Searching the marking o you for the GPOs that are applied to that marketing o u that are linked to the
o u.
So it's going through the core face of policy processing, searching for each GPO and figuring out its
version or its found whether it's got any client side extensions associated with it.
All of that sort of information is being evaluated on a per share basis.
So, you know, again, it's not an altogether obvious log file to work with, but it can provide some
clues if you're running into specific errors and trying to figure out where those errors are coming
from.
So now let's talk about the trace logging for preferences.
So if I go ahead and bring up the GMP, see?
And if I come down here into the marketing for you, I'm just going to look at the GPOs that I have
linked to marketing.
And I had this policy and preference GPO.
And what I'm going to do is I'm going to go ahead and edit this GPO.
And I know that my machine account is in this marketing.
Oh, you.
So I'm going to turn on some trace logging for one of the computer specific client side extensions in
preferences.
So if I come in under policies admin templates system.
Let's expand that out a little bit.
Group policy.
You notice a subfolder called logging and tracing.
And you'll see here that I've got a bunch of different entries for the various group policy preferences
extensions.
So I'm going to come in under local user and group preference logging.
And I'm going to go ahead and enable this.
So I'm going to click that to enabled and I'm going to tell it.
I want only warnings and errors and I want to turn tracing on and I'll leave the default locations the
same.
So I've got this app data folder that all my tracing files are going to go to and I'll go ahead and
click.
Okay.
And then I'm going to come to the machine that I'm on and open up the command prompt.
And I'll do a pub date.
And I'm just going to update the computer because that's where I made the change.
That will make it go a little quicker.
Now again, I've enabled trace logging in a GPO that's being processed by this computer that I'm working
on.
And I happen to know that I am receiving some local users and groups preference settings, so I chose
to enable that particular extension.
But I could have enabled any other extension.
Really?
And then if I come in under.
Under Group Policy in program data preference trace.
You'll see there is the log trace file that I just created for computer.
And now you'll see the trace file for processing user.
Local user and group policy for this particular computer.
So I've got all the tracing going on for the local users and groups.
This is the data that the group policy preferences trace provides.
And again, you're going to have to sift through a lot of stuff in order to get to the meat of it.
Getting to the right timestamp.
That's of interest today, but it will tell me some useful information.
Assuming I'm having some kind of problem, it will essentially tell me what it's what it's processed
out of that preference file.
So again, you know, the tracing is sort of catch as catch can you don't necessarily guarantee.
You can't be guaranteed that you're going to get the data that you need.
But it can be a last resort to sort of sniff out problems that have come up.
And I definitely recommend it as a last resort rather than a first resort, because it is rather arcane.
But it can be a solution if you've sort of hit a dead end in your troubleshooting.