6

I am trying to analyse which group policies are inflating the bootup time. What's the best way to do so?

Something like gpresult including timestamps/periods would be really helpfull!

5

One technique is documented here:

How to enable GPO logging on windows 7 /2008 R2
https://blogs.technet.com/b/csstwplatform/archive/2010/11/09/how-to-enable-gpo-logging-on-windows-7-2008-r2.aspx

It is similar to the User Environment Debug Logging in Windows XP/2003.

  1. Click Start , click Run , type regedit , and then click OK .

  2. Locate and then click the following registry subkey:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion

  3. On the Edit menu, point to New , and then click Key .

  4. Type Diagnostics , and then press ENTER.

  5. Right-click the Diagnostics subkey, point to New , and then click DWORD Value .

  6. Type GPSvcDebugLevel , and then press ENTER.

  7. Right-click GPSvcDebugLevel , and then click Modify .

  8. In the Value data box, type 0x30002 , and then click OK .

  9. Exit Registry Editor.

  10. At a command prompt, type the following command, and then press ENTER:

    gpupdate /force

  11. View the Gpsvc.log file in the following folder:

    %windir%\debug\usermode

If you are wondering what the hex numbers are on the left, those are thread id's.

If you have multiple domain controllers and a distributed network, pay attention to the domain controller that the GPO is processed from. It's not unusual to pull a GPO from a domain controller that is different from the domain controller that performed authentication, or a domain controller on the other side of the planet.

I have also found that Microsoft Network Monitor 3.4 provides useful information. Typically you would be able to observe each GPO as it is being processed, with a timestamp.

  • This is fantastic. I have been looking and trying to find what those hex values were to no avail on technet. – Brett Larson Oct 7 '14 at 17:11
  • There's a good new blog post from April 2015 now that mentions what they're all about. blogs.technet.com/b/askds/archive/2015/04/17/… "What are those? As an example I took “GPSVC(31c.328)”, where the first number is 31c, which directly relates to the PID. The second number is 328, which relates to the TID. " – Daniel.S Apr 28 '15 at 14:01
7

In Windows 7, one good way of looking at all aspects of Group Policy is via the client's event log.

  • Open the event log (eventvwr.exe from the search/command box).
  • Open Event Viewer (Local)
  • Open Applications and Services Logs
  • Open Microsoft
  • Open Windows
  • Open GroupPolicy and click on Operational

Events 4016 and 5016 show the start and end of processing of groups of policies, including how long it took to apply each one in the end event.

Event 5312 shows policies that will be applied, and 5317 shows policies that are explicitly filtered out.

Events 8000 and 8001 respectively show the total processing time for computer boot and user boot GP processing, and 8006 and 8007 show the same for interim/periodic GP processing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.