none
Which Event Viewer log is specific to GPO events? and Where is this log located within Event Viewer? RRS feed

Answers

  • What version of Windows are you using.  There is the Group Policy Operational log on 2008 systems and the screen shot below is from that.  You can also use system logs.    If you are used to the old userenv logs you can also enable the gpsvc log in 2008   

    http://blogs.technet.com/b/mempson/archive/2010/01/10/userenvlog-for-windows-vista-2008-win7.aspx

    Thanks

    Mike


    http://adisfun.blogspot.com
    Follow @mekline

    • Proposed as answer by VenkatSP Saturday, February 16, 2013 4:39 AM
    • Marked as answer by Cicely FengModerator Monday, February 18, 2013 1:12 AM
    Thursday, January 31, 2013 5:33 PM
  • Below is event range for GPO

    Event ID Range

    Description

    4000–4007

    Group Policy start events: These informational events appear in the event log when an instance of Group Policy processing begins.

    4016–4299

    Component start events: These informational events appear in the event log when a component of Group Policy processing begins the task described in the event.

    5000–5299

    Component success events: These informational events appear in the event log when a component of Group Policy processing successfully completes the task described in the event.

    5300–5999

    Informative events: These informational events appear in the event log during the entire instance of Group Policy processing and provide additional information about the current instance.

    6000–6007

    Group Policy warning events: These warning events appear in the event log when an instance of Group Policy processing completes with errors.

    6017–6299

    Component warning events: These warning events appear in the event log when a component of Group Policy processing completes the task described in the event with errors.

    6300–6999

    Informative warning events: These warning events appear in the event log to provide additional information about possible error conditions with the action described in the event.

    7000–7007

    Group Policy error events: These error events appear in the event log when the instance of Group Policy processing does not complete.

    7017–7299

    Component error events: These error events appear in the event log when a component of Group Policy processing does not complete the task described in the event.

    7300–7999

    Informative error events: These error events appear in the event log to provide additional information about the error condition with the action described in the event.

    8000–8007

    Group Policy success events: These informational events appear in the event log when the instance of Group Policy completes successfully.


    Rgds Vinay

    Thursday, January 31, 2013 6:55 PM
  • Hi,

    You will find the GroupPolicies replated events in Application logs in Event Viewer.

    UserNv and Secli.

    Secli 1704 is the event which confirms all the policies are ok/applied.

    Run:

    gpupdate /force

    to generate new logs.

    Regards,

    Siva.

    Wednesday, February 6, 2013 9:20 PM
  • Hi,

    Earlier instances of Group Policy used the event source name "Userenv". In Windows Vista and above, Group Policy writes all event and logging information to the Event Viewer and uses a source name of "Group Policy." This makes it easier to locate events relevant to Group Policy.

    See this for more information:
    Troubleshooting Group Policy Using Event Logs
    http://technet.microsoft.com/en-us/library/cc749336(v=ws.10).aspx

     


    Best regards,

    Abhijit Waikar.
    MCSA | MCSA:Messaging | MCITP:SA | MCC:2012
    Blog: http://abhijitw.wordpress.com
    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    • Proposed as answer by VenkatSP Saturday, February 16, 2013 4:39 AM
    • Marked as answer by Cicely FengModerator Monday, February 18, 2013 1:12 AM
    Thursday, January 31, 2013 5:28 PM
  • Hi,

    On any Vista or newer system, open the event viewer and browse to Applications and Services Logs/Microsoft/Windows/GroupPolicy, you will find very detailed event logs associated with Group Policy (formerly in userenv.log). Please find the categories of the events in below link:
    Group Policy Troubleshooting – helpful Event log categories
    http://blogs.technet.com/b/grouppolicy/archive/2009/03/04/group-policy-troubleshooting-helpful-event-log-categories.aspx

    Another blog may also be helpful:
    Troubleshooting Group Policy Using Event Logs
    http://blogs.technet.com/b/gpguru/archive/2008/08/29/troubleshooting-group-policy-using-event-logs.aspx

    Regards,
    Cicely

    • Proposed as answer by VenkatSP Saturday, February 16, 2013 4:39 AM
    • Marked as answer by Cicely FengModerator Monday, February 18, 2013 1:12 AM
    Monday, February 4, 2013 2:45 AM
    Moderator
  • I agree with all other experts, other than Applications and Services Logs/Microsoft/Windows/GroupPolicy you will also see some more events in Application event logs. Event IDs like 1503, check the following link for more info.

    http://technet.microsoft.com/en-us/library/dd392614(v=ws.10).aspx

    Saturday, February 16, 2013 4:48 AM

All replies

  • Hi,

    Earlier instances of Group Policy used the event source name "Userenv". In Windows Vista and above, Group Policy writes all event and logging information to the Event Viewer and uses a source name of "Group Policy." This makes it easier to locate events relevant to Group Policy.

    See this for more information:
    Troubleshooting Group Policy Using Event Logs
    http://technet.microsoft.com/en-us/library/cc749336(v=ws.10).aspx

     


    Best regards,

    Abhijit Waikar.
    MCSA | MCSA:Messaging | MCITP:SA | MCC:2012
    Blog: http://abhijitw.wordpress.com
    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

    • Proposed as answer by VenkatSP Saturday, February 16, 2013 4:39 AM
    • Marked as answer by Cicely FengModerator Monday, February 18, 2013 1:12 AM
    Thursday, January 31, 2013 5:28 PM
  • What version of Windows are you using.  There is the Group Policy Operational log on 2008 systems and the screen shot below is from that.  You can also use system logs.    If you are used to the old userenv logs you can also enable the gpsvc log in 2008   

    http://blogs.technet.com/b/mempson/archive/2010/01/10/userenvlog-for-windows-vista-2008-win7.aspx

    Thanks

    Mike


    http://adisfun.blogspot.com
    Follow @mekline

    • Proposed as answer by VenkatSP Saturday, February 16, 2013 4:39 AM
    • Marked as answer by Cicely FengModerator Monday, February 18, 2013 1:12 AM
    Thursday, January 31, 2013 5:33 PM
  • Below is event range for GPO

    Event ID Range

    Description

    4000–4007

    Group Policy start events: These informational events appear in the event log when an instance of Group Policy processing begins.

    4016–4299

    Component start events: These informational events appear in the event log when a component of Group Policy processing begins the task described in the event.

    5000–5299

    Component success events: These informational events appear in the event log when a component of Group Policy processing successfully completes the task described in the event.

    5300–5999

    Informative events: These informational events appear in the event log during the entire instance of Group Policy processing and provide additional information about the current instance.

    6000–6007

    Group Policy warning events: These warning events appear in the event log when an instance of Group Policy processing completes with errors.

    6017–6299

    Component warning events: These warning events appear in the event log when a component of Group Policy processing completes the task described in the event with errors.

    6300–6999

    Informative warning events: These warning events appear in the event log to provide additional information about possible error conditions with the action described in the event.

    7000–7007

    Group Policy error events: These error events appear in the event log when the instance of Group Policy processing does not complete.

    7017–7299

    Component error events: These error events appear in the event log when a component of Group Policy processing does not complete the task described in the event.

    7300–7999

    Informative error events: These error events appear in the event log to provide additional information about the error condition with the action described in the event.

    8000–8007

    Group Policy success events: These informational events appear in the event log when the instance of Group Policy completes successfully.


    Rgds Vinay

    Thursday, January 31, 2013 6:55 PM
  • Hi,

    On any Vista or newer system, open the event viewer and browse to Applications and Services Logs/Microsoft/Windows/GroupPolicy, you will find very detailed event logs associated with Group Policy (formerly in userenv.log). Please find the categories of the events in below link:
    Group Policy Troubleshooting – helpful Event log categories
    http://blogs.technet.com/b/grouppolicy/archive/2009/03/04/group-policy-troubleshooting-helpful-event-log-categories.aspx

    Another blog may also be helpful:
    Troubleshooting Group Policy Using Event Logs
    http://blogs.technet.com/b/gpguru/archive/2008/08/29/troubleshooting-group-policy-using-event-logs.aspx

    Regards,
    Cicely

    • Proposed as answer by VenkatSP Saturday, February 16, 2013 4:39 AM
    • Marked as answer by Cicely FengModerator Monday, February 18, 2013 1:12 AM
    Monday, February 4, 2013 2:45 AM
    Moderator
  • Hi,

    You will find the GroupPolicies replated events in Application logs in Event Viewer.

    UserNv and Secli.

    Secli 1704 is the event which confirms all the policies are ok/applied.

    Run:

    gpupdate /force

    to generate new logs.

    Regards,

    Siva.

    Wednesday, February 6, 2013 9:20 PM
  • I agree with all other experts, other than Applications and Services Logs/Microsoft/Windows/GroupPolicy you will also see some more events in Application event logs. Event IDs like 1503, check the following link for more info.

    http://technet.microsoft.com/en-us/library/dd392614(v=ws.10).aspx

    Saturday, February 16, 2013 4:48 AM
  • Is that still applicable for Windows 10 Group Policy preference ?

    /* Server Support Specialist */

    Thursday, April 13, 2017 1:14 PM