Enabling Logging for Group Policy Editor

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

You can enable logging of events generated by the Group Policy Object Editor for its core operations on the administrative computer.

When To Enable Group Policy Object Editor Logging

Group Policy Object Editor logging, by default, is set to only log errors. To avoid using unnecessary disk space, you should leave Group Policy Object Editor logging at the default setting. You can enable Group Policy Object Editor logging to gather verbose troubleshooting information when a Group Policy Object editing task causes errors.

Enabling Group Policy Object Editor Logging

Warning

This section contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, see Description of the Microsoft Windows Registry on the Microsoft Web site (https://go.microsoft.com/fwlink/?LinkId=35500).

To enable GPedit logging on the administrative computer

  1. Log on to the client computer as the administrator.

  2. Click Start, Run, and then run Regedit to add the following registry value (or, if the value already exists, modify it):

    Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

  3. Enter the following:

    Value: GPEditDebugLevel

    Value Type: REG_DWORD

    Value Data: 10002 (Hexadecimal)

GPEditDebugLevel can have the following values:

  • NONE 0x00000000

  • NORMAL 0x00000001

  • VERBOSE 0x00000002

  • LOGFILE 0x00010000

  • DEBUGGER 0x00020000

The default value is NORMAL|LOGFILE (0x00010001).

To disable logging, select NONE (0X00000000).

You can also combine the GPEditDebugLevel values. For example, you can combine VERBOSE 0x00000002 and LOGFILE 0x00010000 to get 0x00010002. If you set DGPEditDebugLevel to 0x00010002, you turn on both LOGFILE and VERBOSE. By combining these values, you achieve the same effect as using an OR statement as follows:

0x00010000 OR 0x00000002 = 0x00010002

The log file is written to the GPEdit.log file in the %Systemroot%\Debug\UserMode\ folder.

See Also

Concepts

Enable Logging for Group Policy Object Editor Client Side Extensions