Microsoft KB Archive/201453

= Group Policy History Stored in Registry =

Article ID: 201453

Article Last Modified on 2/20/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Datacenter Server

-



This article was previously published under Q201453



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SUMMARY
As Group Policy Objects (GPOs) are read and applied when the computer starts or when a user logs on, information about each of the GPOs applied is written to the registry. This information includes which Group Policy Extensions applied policy, the order in which the GPOs were applied, version data, and options defined for each GPO. This data is also used to determine changes that have been made to the GPO since the last time policy was applied.

The administrator can optionally configure diagnostic logging of the application of Group Policy by modifying a registry entry on the client computer. These events are recorded in the Application Log of the client computer, which can be filtered by specifying "Userenv" for the "Source" field.

This article describes each of the registry values that may be found in the stored data for each of the applied GPOs.



MORE INFORMATION
Group Policy Extensions are components that are clients to the Group Policy infrastructure and have a server-side and client-side component. The administrator uses the server-side component and the Group Policy Editor (GPE) to define the policy. When a GPO is applied to a client computer, the client-side component is responsible for applying the policy previously configured.

In the registry, the history of the application of GPOs is broken down by Group Policy Extension.

To Locate the Group Policy History
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

Open Regedt32.exe and locate the following key in the system registry:

  For Group Policy Objects applied to the local computer:

     HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion \Group Policy\History   For Group Policy Objects applied to the currently logged on user:

     HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Group Policy\History 

Underneath each of the keys that represent installed Group Policy Extensions, there will be keys for each of the Group Policy Objects applied. Each of these is assigned a number that equates to the order in which they were applied. The first GPO applied is given the number 0 and, as GPOs are applied, the value assigned to the key is incremented.

Below is an explanation of each of the registry values that may be used.

DisplayName
DisplayName is the friendly name of the Group Policy Object as displayed in the Active Directory Management and Group Policy Editor administration tools.

DSPath
DSPath is the Distinguished Name (DN) of the path to the Group Policy Object stored in the Active Directory. For example: LDAP://CN=Machine,CN={GUID of GPO},CN=Policies,CN=System,DC=...

This attribute will not be present for Local Group Policy Objects as there is no Active Directory storage locally.

FileSysPath
FileSysPath is the path to the Group Policy Template (GPT), or file-based policy, contained in the Group Policy. If this is a GPO from the domain, the path will be a UNC path to the SYSVOL share on the domain controllers. If this is a Local Group Policy Object, this will be a local path that points to the structure beginning with the path:

%SystemRoot%\system32\GroupPolicy

GPOLink
The GPOLink value identifies what scope the Group Policy Object was applied to, therefore affecting the computer or user. The following values are valid:

0= No link information

1= The GPO is linked to a machine (local)

2= The GPO is linked to a Site

3= The GPO is linked to a Domain

4= The GPO is linked to an Organizational Unit

GPOName
The GPOName value contains the name of the GPO as it is referenced. For Group Policy Objects associated with computers, this name will be the friendly name of the GPO. For Group Policy Objects stored in the Active Directory, this will be the GUID of the GPO.

lParam
The lParam value is used to perform various functions on GPOs. This value can be customized by Group Policy Extensions.

Options
The Options value represents the options selected by the administrator when configuring the Group Policy Object Link, such as whether or not to disable the Group Policy Object or to force the settings defined in the GPO on subcontainers.

Version
The Version registry value specifies the version number of the GPO when it was applied last. The number is used to determine if the GPO has changed since it was last applied.

Additional query words: order execute

Keywords: kbinfo KB201453

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.