GpoTool Examples

Example 1: Verbose Output

The following example analyzes the output of the Group Policy Verification Tool run with the /verbose switch.

c:\>gpotool.exe /verbose

The first part of the output provides a complete list of the domain controllers in your domain that are currently online and available to serve requests.

Domain: domain1.microsoft.com
Validating DCs...
NTDSDC4: down
NTDSDC5.domain1.microsoft.com: OK 
NTDSDC.domain1.microsoft.com: OK 
NTDSDCB.domain1.microsoft.com: OK 
NTDSDC0: down
Available DCs:
NTDSDC5.domain1.microsoft.com
NTDSDC.domain1.microsoft.com
NTDSDCB.domain1.microsoft.com

The next portion of the output provides the number of unique Group Policy objects (different GUIDs) that can be found across all available domain controllers.

Searching for policies...
Found 23 policies

Following this output, the tool outputs the health of each unique GPO. A healthy Group Policy object passes all tests run by this tool, generating the following output:

============================================================
Policy {372B5AB3-A991-11D2-9BEB-00A024070A22}
Policy OK
Details:
------------------------------------------------------------

Output details:

The Group Policy object is specified by its GUID.
"Policy OK" indicates that the Group Policy object passed all tests.

A Group Policy object that does not pass all tests:

============================================================
Policy {29021088-BF90-11D2-8614-00C04FF621C4}
gpotool: e 	ERROR: Err: CreateTime different between Applications

Error: NTDSDC5.domain1.microsoft.com - NTDSDC.domain1.microsoft.com sysvol mismatch
Details:
------------------------------------------------------------

Output details:

The Group Policy object is specified by its GUID.
gpotool: e, does not provide any additional information.
ERROR: provides information on the test failed by the Group Policy object.
Error: provides details of the domain controllers that are effected.

Following this, detailed information on the GPO is displayed individually for each domain controller that contains a copy of the Group Policy object. Therefore, if you have five domain controllers, and each has a copy of the Group Policy object, then the data below will be detailed five times in the output to cover each of the five copies. The status information looks something like this:

------------------------------------------------------------
DC: NTDEV-01.domain1.microsoft.com
Friendly name: EU-SlowLinkPolicy
Created: 2/8/99 7:55:04 PM
Changed: 6/24/99 7:58:08 PM
DS version:     7(user) 2(machine)
Sysvol version: 7(user) 2(machine)
Flags: 0
User extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}]
Machine extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957D-509E-11D1-A7CC-0000F87571E3}]
Functionality version: 2
------------------------------------------------------------

Output details:

DC: specifies the domain controller where this copy of the Group Policy object resides.
Friendly name: specified the friendly name of the Group Policy object. This is what you see in the Active Directory Users and Computers snap-in.
Created: specifies when the Group Policy object was created.
Changed: specifies the last time the GPO was changed.
DS version: specifies Group Policy object version (directory services portion of the Group Policy object).
Sysvol version: specifies Group Policy object version (SYSVOL portion of the Group Policy object).
Flags: indicates if the Group Policy object has been fully or partially disabled by the administrator.
User extensions: specifies Group Policy user-based extensions by GUID that have been included and configured in the Group Policy object.
Machine extensions: specifies Group Policy computer-based extensions that have been included and configured in the Group Policy object.
Functionality version: specifies the version of the Group Policy object. The version number must be equal to 2 or higher to work correctly on Windows 2000. Upgrading Group Policy objects is not supported.

Example 2: A Corrupt Policy

This is a sample output for a corrupt policy missing the template directory and version number property. The policy is found based on a partial match of friendly name.

c:\>gpotool.exe /gpo:Corrupt

Error: Property versionNumber not found on BOGDANT4
Error: Cannot access sysvol template on BOGDANT4, error 2
============================================================
Policy {9A89E00A-CB92-11D2-9348-00A0C9220C09}
------------------------------------------------------------
DC: BOGDANT4
Friendly name: Test Corruption Policy
Created: 2/24/99 2:42:47 AM
Changed: 2/24/99 3:01:27 AM
DS version: not found
Sysvol version: not found
Flags: 0
User extensions: not found
Machine extensions: not found
Functionality version: 2
------------------------------------------------------------

Errors found.