Debugging group policies

Question

Begginer with windows servers here How can i find which group policy is applied when i click on something and get blocked?

I currently can't check for windows updates unless i deactivate the GPOs applied to that computer. Ofcourse i tried resetting any windows update relevant policies to "Not Configured". Is there any way to have the event viewer show something along the lines of "action x blocked by policy "Configure Automatic Updates"" for example?

Anything i can find on google is how to log errors in group policies.

Answer 1

gpresult.exe and rsop.msc are the two main tools for GPO debugging and troubleshooting.

Answer 2

You don't mention the OS you're trying to troubleshoot, but you can run gpresult /r for a Windows 7 machine or gpresult for a Windows XP machine (from the cmd prompt). Keep in mind for Windows 7, if you don't run an elevated cmd prompt (Run as Admin), you will only see policies for the logged on user.

You can also use rsop from the cmd prompt for Windows 7 machines, which will give you a GUI view of the settings applied and which policies they came from. Getting RSOP for Windows XP is a bit more involved. You need to first open a custom MMC console (mmc.msc from the run command). Then you'll need to add the Resultant Set of Policy Snap-in. You can then right click on the RSOP and gather the data.

You could also use the Group Policy Results wizard from within the Group Policy Management Console if you have rights to do so.