11-Troubleshooting Group Policy Issues

<span class='text_page_counter'>(1)</span><div class='page_container' data-page=1></div>
<span class='text_page_counter'>(2)</span><div class='page_container' data-page=2>

Module Overview

•

Introduction to Group Policy Troubleshooting

•

Troubleshooting Group Policy Application

</div>
<span class='text_page_counter'>(3)</span><div class='page_container' data-page=3>

Lesson 1: Introduction to Group Policy

Troubleshooting

•

Scenarios for Group Policy Troubleshooting

•

Preparing to Troubleshoot Group Policies

•

Tools for Troubleshooting Group Policies

</div>
<span class='text_page_counter'>(4)</span><div class='page_container' data-page=4>

Scenarios for Group Policy Troubleshooting

<b>Common scenarios that require troubleshooting:</b>

<b> Policies are applied but settings are inconsistent</b>





<b> Polices not applied</b>



</div>
<span class='text_page_counter'>(5)</span><div class='page_container' data-page=5>

Preparing to Troubleshoot Group Policies

<b>Basic troubleshooting steps:</b>

<b> Perform basic checks to test network connectivity: use </b>
<b> diagnostic tools like netdiag, ping </b>





<b> Check Event Viewer entries</b>





<b> Ensure that DNS is functioning: use NSlookup </b>





<b> Check that the domain controller is functioning and reachable: </b>
<b> use diagnostic tools like dcdiag, the set command, Kerbtray </b>



</div>
<span class='text_page_counter'>(6)</span><div class='page_container' data-page=6>

Tools for Troubleshooting Group Policies

<b>Group Policy troubleshooting tools: </b>

 Group Policy reporting – RSOP
 GPResult

 Gpotool
• Gpupdate

• Dcgpofix

• GPOLogView

• Group Policy log files

</div>
<span class='text_page_counter'>(7)</span><div class='page_container' data-page=7>

Demonstration: Using Group Policy

Diagnostic Tools

In this demonstration, the instruction will demonstrate the

use of:

•

GPResult in regular and verbose mode

•

GPOTool

•

Gpupdate

</div>
<span class='text_page_counter'>(8)</span><div class='page_container' data-page=8>

Lesson 2: Troubleshooting Group

Policy Application

•

Troubleshooting Group Policy Inheritance

•

Troubleshooting Group Policy Filtering

•

Troubleshooting Group Policy Replication

•

Troubleshooting Group Policy Refresh

</div>
<span class='text_page_counter'>(9)</span><div class='page_container' data-page=9>

Troubleshooting Group Policy Inheritance

<b>Sales</b>

<b>Production</b>
<b>Domain</b>

<b>No GPO </b>
<b>settings </b>

<b>apply</b>

<b>No GPO </b>
<b>settings </b>

<b>apply</b>
<b>GPOs</b>

</div>
<span class='text_page_counter'>(10)</span><div class='page_container' data-page=10>

Troubleshooting Group Policy Filtering

<b>Sales</b>
<b>Production</b>
<b>Domain</b>
<b>Mengph</b>
<b>Kimyo</b>
<b>Group</b> <b>Apply </b>

<b>Group Policy</b>
<b>Apply </b>
<b>Group PolicyDeny</b>

<b>Read and </b>
<b>Apply </b>
<b>Group Policy</b>

<b>Read and </b>
<b>Apply </b>
<b>Group PolicyAllow</b>
<b>GPO</b>

<b>WMI </b>
<b>filter</b>

<b>Group Policy filtering </b>
<b>may affect only </b>

</div>
<span class='text_page_counter'>(11)</span><div class='page_container' data-page=11>

<b>GPT</b>

<b>GPT</b>

<b>GPC</b>

<b>GPC</b>

Troubleshooting Group Policy Replication

• <b>Group Policy objects consist of Group Policy templates</b>

<b>and Group Policy containers</b>

• <b>GPTs and GPOs replicate using different mechanisms</b>

• <b>Replication issues can cause domain controllers to </b>
<b>have inconsistent versions of Group Policies</b>

• <b>The GPOTool can check for policy consistency </b>
<b>across all domain controllers</b>

<b>DC1</b> <b>GPO1</b> <b>DC2</b>

<b>Version 3</b>

<b>GPO1</b>

<b>Version 2</b>

<b>Active Directory Replication</b>
<b>File Replication Service</b>

<b>GPT</b>

<b>GPT</b>

<b>GPC</b>

</div>
<span class='text_page_counter'>(12)</span><div class='page_container' data-page=12>

Troubleshooting Group Policy Refresh

<b>If the Group Policy is not refreshing as expected:</b>

• Check refresh intervals for users and computers

• Verify that the user has logged off and on, or that the
computer has been restarted

• Check if there are cached credentials because they may
delay the effect of Group Policy

• Check to see if the Loopback policy is enabled

<b>Use gpupdate to:</b>

• Manually refresh updated Group Policy settings

• Force the refresh of all Group Policy settings

</div>
<span class='text_page_counter'>(13)</span><div class='page_container' data-page=13>

Discussion: Troubleshooting Group

Policy Configuration

</div>
<span class='text_page_counter'>(14)</span><div class='page_container' data-page=14>

Lesson 3: Troubleshooting Group Policy Settings

•

How Client Side Extension Processing Works

•

Troubleshooting Administrative Template Policy Settings

•

Troubleshooting Security Policy Settings

•

Troubleshooting Script Policy Settings

</div>
<span class='text_page_counter'>(15)</span><div class='page_container' data-page=15>

How Client Side Extension Processing Works

• Client side extensions are DLLs that process group
policy settings

• Some CSEs do not process if a slow link is detected

• Some CSEs are always applied and cannot be turned off

<b>List of client side extensions:</b>

• Security Settings

• Administrative Templates

• Software installation

• Scripts

• Folder redirection

</div>
<span class='text_page_counter'>(16)</span><div class='page_container' data-page=16>

Troubleshooting Administrative Template

Policy Settings

<b>When troubleshooting Administrative Templates, </b>

<b>consider that:</b>

<b> Administrative Templates are either true polices or preferences</b>





<b> Settings that are preferences will tattoo the registry </b>
<b> and remain in effect until they are specifically reversed </b>





<b> Settings that are true policies are reversed when the </b>
<b> policy no longer applies </b>





<b> The operating system and service pack level determine </b>
<b> if the computer can accept a policy setting </b>



</div>
<span class='text_page_counter'>(17)</span><div class='page_container' data-page=17>

Troubleshooting Security Policy Settings

<b>When troubleshooting security policy settings, </b>

<b>consider that:</b>

<b> Account policies are passed to clients from the domain controller</b>





<b> Security settings come from the GPO that have the highest priority</b>





<b> The domain controller receives account policies from a domain </b>
<b> level policy</b>



</div>
<span class='text_page_counter'>(18)</span><div class='page_container' data-page=18>

Troubleshooting Script Policy Settings

<b>When troubleshooting script policy settings, consider </b>

<b>the following:</b>

<b> Validate the script</b>





<b> Ensure that Group Policy is configured correctly </b>





<b> Ensure that users and computer have access to the script</b>





<b> Ensure the script is replicating properly</b>





<b> Use the Group Policy tools to ensure that Group Policy </b>
<b> is applied correctly</b>



</div>
<span class='text_page_counter'>(19)</span><div class='page_container' data-page=19>

Lab: Troubleshooting Group Policy Issues

•

Exercise 1: Troubleshooting Group Policy Scripts

•

Exercise 2: Troubleshooting GPO Lab-11B

•

Exercise 3: Troubleshooting GPO Lab-11C

•

Exercise 4: Troubleshooting GPO Lab-11D

Logon information

Virtual machine

<b>NYC-DC1, NYC-_CL1</b>

User name

<b>Administrator</b>

Password

<b>Pa$$w0rd</b>

</div>
<span class='text_page_counter'>(20)</span><div class='page_container' data-page=20>

Lab Review

•

If a policy at the domain level is set for enforcement, while

another policy at the OU level with a conflicting setting

also is set to be enforced, which policy setting will the OU

clients receive?

</div>
<span class='text_page_counter'>(21)</span><div class='page_container' data-page=21>

Module Review and Takeaways

•

Considerations

•

Tools

</div>
<span class='text_page_counter'>(22)</span><div class='page_container' data-page=22>

Beta Feedback Tool

•

Beta feedback tool helps:

 Collect student roster information, module feedback, and

course evaluations.

 Identify and sort the changes that students request, thereby

facilitating a quick team triage.

 Save data to a database in SQL Server that you can later

query.

</div>
<span class='text_page_counter'>(23)</span><div class='page_container' data-page=23>

Beta Feedback

•

<b>Overall flow of module:</b>

 Which topics did you think flowed smoothly, from topic to

topic?

 Was something taught out of order?

•

<b>Pacing:</b>

 Were you able to keep up? Are there any places where the

pace felt too slow?

 Were you able to process what the instructor said before

moving on to next topic?

 Did you have ample time to reflect on what you learned? Did

you have time to formulate and ask questions?

•

<b>Learner activities:</b>

 Which demos helped you learn the most? Why do you think

that is?

 Did the lab help you synthesize the content in the module?

Did it help you to understand how you can use this
knowledge in your work environment?

 Were there any discussion questions or reflection questions

</div>

<!--links-->