1. Module 11: Troubleshooting Group Policy Issues

2. Module Overview Introduction to Group Policy Troubleshooting Troubleshooting Group Policy Application Troubleshooting Group Policy Settings

3. Lesson 1: Introduction to Group Policy Troubleshooting Scenarios for Group Policy Troubleshooting Preparing to Troubleshoot Group Policy Tools for Troubleshooting Group Policy Demonstration: Using Group Policy Diagnostic Tools

4. Scenarios for Group Policy Troubleshooting Common scenarios that require troubleshooting: Policies are applied but settings are inconsistent Polices not applied

5. Preparing to Troubleshoot Group Policy Basic troubleshooting steps: Perform basic checks to test network connectivity: use diagnostic tools such as netdiag or ping Check Event Viewer entries Ensure that DNS is functioning by using NSlookup Check that the domain controller is functioning and reachable: use diagnostic tools such as dcdiag, the set command, or Kerbtray

6. Tools for Troubleshooting Group Policy Group Policy troubleshooting tools: Group Policy reporting – RSOP GPResult Gpotool Gpupdate Dcgpofix GPOLogView Group Policy log files Group Policy Management Scripts

7. Demonstration: Using Group Policy Diagnostic Tools In this demonstration, the instructor will demonstrate the use of: GPResult in regular and verbose mode GPOTool Gpupdate GPLogView

8. Lesson 2: Troubleshooting Group Policy Application Troubleshooting Group Policy Inheritance Troubleshooting Group Policy Filtering Troubleshooting Group Policy Replication Troubleshooting Group Policy Refresh Discussion: Troubleshooting Group Policy Configuration

9. Troubleshooting Group Policy Inheritance Sales Production Domain No GPO settings apply GPOs Blocked inheritance prevents high-level policies from applying to entire OU subtrees

10. Troubleshooting Group Policy Filtering Sales Production Domain Mengph Kimyo Group Apply Group Policy Deny Read and Apply Group Policy Allow GPO WMI filter Group Policy filtering may affect only certain users or computers in OUs

11. GPT GPC Troubleshooting Group Policy Replication Group Policy objects consist of Group Policy templates and Group Policy containers GUID Partition Table (GPT) and GPOs replicate using different mechanisms Replication issues can cause domain controllers to have inconsistent versions of Group Policy The GPOTool can check for policy consistency across all domain controllers DC1DC2 GPO1 Version 3 GPO1 Version 2 AD DS Replication File Replication Service GPT GPC

12. Troubleshooting Group Policy Refresh If the Group Policy is not refreshing as expected: Check refresh intervals for users and computers Verify that the user has logged off and on, or that the computer has been restarted Check if there are cached credentials, because they may delay the effect of Group Policy Check to see if the Loopback policy is enabled Use gpupdate to: Manually refresh updated Group Policy settings Force the refresh of all Group Policy settings Force a reboot or logoff, if required, to refresh the settings

13. Discussion: Troubleshooting Group Policy Configuration In this discussion, you will create a flow chart for troubleshooting Group Policy

14. Lesson 3: Troubleshooting Group Policy Settings How Client Side Extension Processing Works Troubleshooting Administrative Template Policy Settings Troubleshooting Security Policy Settings Troubleshooting Script Policy Settings

15. How Client Side Extension Processing Works Client side extensions are DLLs that process group policy settings Some CSEs do not process if a slow link is detected Some CSEs are always applied and cannot be turned off List of client side extensions: Security settings Administrative Templates Software installation Scripts Folder redirection Internet Explorer maintenance

16. Troubleshooting Administrative Template Policy Settings When troubleshooting Administrative Templates, consider that: Administrative Templates are either true polices or preferences Settings that are preferences will tattoo the registry and remain in effect until they are specifically reversed Settings that are true policies are reversed when the policy no longer applies The operating system and service pack level determine if the computer can accept a policy setting

17. Troubleshooting Security Policy Settings When troubleshooting security policy settings, consider that: Account policies are passed to clients from the domain controller Security settings come from the GPO that have the highest priority The domain controller receives account policies from a domain level policy

18. Troubleshooting Script Policy Settings When troubleshooting script policy settings, consider the following: Validate the script Ensure that Group Policy is configured correctly Ensure that users and computer have access to the script Ensure that the script is replicating properly Use the Group Policy tools to ensure that Group Policy is applied correctly

19. Lab: Troubleshooting Group Policy Issues Exercise 1: Troubleshooting Group Policy Scripts Exercise 2: Troubleshooting GPO Lab-11B Exercise 3: Troubleshooting GPO Lab-11C Exercise 4: Troubleshooting GPO Lab-11D Logon information Virtual machine NYC-DC1, NYC-CL1 User nameAdministrator Password Pa$$w0rd Estimated time: 60 minutes

20. Lab Review If a policy at the domain level is set for enforcement while another policy at the OU level with a conflicting setting also is set to be enforced, which policy setting will the OU clients receive? If you use group policy to configure the slow-link detection threshold to be zero, what does that indicate?

21. Module Review and Takeaways Considerations Tools Review questions