Group Policy History Stored in Registry

ID: Q201453

The information in this article applies to:

Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server

IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

SUMMARY

As Group Policy Objects (GPOs) are read and applied when the computer starts or when a user logs on, information about each of the GPOs applied is written to the registry. This information includes which Group Policy Extensions applied policy, the order in which the GPOs were applied, version data, and options defined for each GPO. This data is also used to determine changes that have been made to the GPO since the last time policy was applied.

The administrator can optionally configure diagnostic logging of the application of Group Policy by modifying a registry entry on the client computer. These events are recorded in the Application Log of the client computer, which can be filtered by specifying "Userenv" for the "Source" field.

This article describes each of the registry values that may be found in the stored data for each of the applied GPOs. For additional information about enabling diagnostic logging, please see the following article in the Microsoft Knowledge Base:

Q186454 How to Enable User Environment Event Logging in Windows 2000

MORE INFORMATION

Group Policy Extensions are components that are clients to the Group Policy infrastructure and have a server-side and client-side component. The administrator uses the server-side component and the Group Policy Editor (GPE) to define the policy. When a GPO is applied to a client computer, the client-side component is responsible for applying the policy previously configured.

In the registry, the history of the application of GPOs is broken down by Group Policy Extension.

To Locate the Group Policy History

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).
Open Regedt32.exe and locate the following key in the system registry:

For Group Policy Objects applied to the local computer:


      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
      \Group Policy\History

For Group Policy Objects applied to the currently logged on user:


      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
      \Group Policy\History

Underneath each of the keys that represent installed Group Policy Extensions, there will be keys for each of the Group Policy Objects applied. Each of these is assigned a number that equates to the order in which they were applied. The first GPO applied is given the number 0 and, as GPOs are applied, the value assigned to the key is incremented.

Below is an explanation of each of the registry values that may be used.

DisplayName

DisplayName is the friendly name of the Group Policy Object as displayed in the Active Directory Management and Group Policy Editor administration tools.

DSPath

DSPath is the Distinguished Name (DN) of the path to the Group Policy Object stored in the Active Directory. For example: LDAP://CN=Machine,CN={GUID of GPO},CN=Policies,CN=System,DC=<Domain>...

This attribute will not be present for Local Group Policy Objects as there is no Active Directory storage locally.

FileSysPath

FileSysPath is the path to the Group Policy Template (GPT), or file-based policy, contained in the Group Policy. If this is a GPO from the domain, the path will be a UNC path to the SYSVOL share on the domain controllers. If this is a Local Group Policy Object, this will be a local path that points to the structure beginning with the path:

%SystemRoot%\system32\GroupPolicy

GPOLink

The GPOLink value identifies what scope the Group Policy Object was applied to, therefore affecting the computer or user. The following values are valid:

0= No link information
1= The GPO is linked to a machine (local)
2= The GPO is linked to a Site
3= The GPO is linked to a Domain
4= The GPO is linked to an Organizational Unit

GPOName

The GPOName value contains the name of the GPO as it is referenced. For Group Policy Objects associated with computers, this name will be the friendly name of the GPO. For Group Policy Objects stored in the Active Directory, this will be the GUID of the GPO.

lParam

The lParam value is used to perform various functions on GPOs. This value can be customized by Group Policy Extensions.

Options

The Options value represents the options selected by the administrator when configuring the Group Policy Object Link, such as whether or not to disable the Group Policy Object or to force the settings defined in the GPO on subcontainers.

Version

The Version registry value specifies the version number of the GPO when it was applied last. The number is used to determine if the GPO has changed since it was last applied.

Additional query words: order execute

Keywords :
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbinfo