• Microsoft Windows Grouppolicy 1058
• Microsoft Windows Group Policy Operational Management
• Microsoft Windows Group Policy Operational Plan
• Microsoft-windows-grouppolicy/operational
• Microsoft-windows-grouppolicy/operational 7017

Sep 24, 2012  The required information is stored within Microsoft-Windows-GroupPolicy/ Operational however I have been having issues getting the message string. It appears to get truncated when I use Powershell commandlets, Get-EventLog (deprecated).

Use the following steps to collect data that can be used to troubleshoot 802.1X authentication issues. When you have collected data, see Advanced troubleshooting 802.1X authentication.

Capture wireless/wired functionality logs

Use the following steps to collect wireless and wired logs on Windows and Windows Server:

1. Create C:MSLOG on the client machine to store captured logs.

2. Launch an elevated command prompt on the client machine, and run the following commands to start a RAS trace log and a Wireless/Wired scenario log.

   Wireless Windows 8.1 and Windows 10:

   
   Wireless Windows 7 and Windows 8:

   
   Wired client, regardless of version

3. Run the following command to enable CAPI2 logging and increase the size :

4. Create C:MSLOG on the NPS to store captured logs.

5. Launch an elevated command prompt on the NPS server and run the following commands to start a RAS trace log and a Wireless/Wired scenario log:

   Windows Server 2012 R2, Windows Server 2016 wireless network:

   
   Windows Server 2008 R2, Windows Server 2012 wireless network

   
   Wired network

6. Run the following command to enable CAPI2 logging and increase the size :

7. Run the following command from the command prompt on the client machine and start PSR to capture screen images:

   Note

   When the mouse button is clicked, the cursor will blink in red while capturing a screen image.

8. Repro the issue.

9. Run the following command on the client PC to stop the PSR capturing:

10. Run the following commands from the command prompt on the NPS server.

    • To stop RAS trace log and wireless scenario log:

    • To disable and copy CAPI2 log:

11. Run the following commands on the client PC.

    • To stop RAS trace log and wireless scenario log:

    • To disable and copy the CAPI2 log:

12. Save the following logs on the client and the NPS:

    Client

    • C:MSLOG%computername%_psr.zip
    • C:MSLOG%COMPUTERNAME%_CAPI2.evtx
    • C:MSLOG%COMPUTERNAME%_wireless_cli.etl
    • C:MSLOG%COMPUTERNAME%_wireless_cli.cab
    • All log files and folders in %Systemroot%Tracing

    NPS

    • C:MSLOG%COMPUTERNAME%_CAPI2.evtx
    • C:MSLOG%COMPUTERNAME%_wireless_nps.etl (%COMPUTERNAME%_wired_nps.etl for wired scenario)
    • C:MSLOG%COMPUTERNAME%_wireless_nps.cab (%COMPUTERNAME%_wired_nps.cab for wired scenario)
    • All log files and folders in %Systemroot%Tracing

Save environment and configuration information

On Windows client

1. Create C:MSLOG to store captured logs.

2. Launch a command prompt as an administrator.

3. Run the following commands.

   • Environment information and Group Policy application status
   • Event logs
   • For Windows 8 and later, also run these commands for event logs:
   • Certificates Store information:
   • Wireless LAN client information:
   • Wired LAN Client information

4. Save the logs stored in C:MSLOG.

Microsoft Windows Grouppolicy 1058

On NPS

Microsoft Windows Group Policy Operational Management

1. Create C:MSLOG to store captured logs.

2. Launch a command prompt as an administrator.

3. Run the following commands.

   • Environmental information and Group Policies application status:
   • Event logs:
   • Run the following 3 commands on Windows Server 2012 and later:
   • Certificates store information
   • NPS configuration information:

4. Take the following steps to save an NPS accounting log.

   1. Open Administrative tools > Network Policy Server.
   2. On the Network Policy Server administration tool, select Accounting in the left pane.
   3. Click Change Log File Properties.
   4. On the Log File tab, note the log file naming convention shown as Name and the log file location shown in Directory box.
   5. Copy the log file to C:MSLOG.

5. Save the logs stored in C:MSLOG.

Certification Authority (CA) (OPTIONAL)

1. On a CA, launch a command prompt as an administrator. Create C:MSLOG to store captured logs.

2. Run the following commands.

   • Environmental information and Group Policies application status
   • Event logs
   • Run the following 3 lines on Windows 2012 and up
   • Certificates store information
   • CA configuration information

3. Copy the following files, if exist, to C:MSLOG: %windir%CAPolicy.inf

4. Log on to a domain controller and create C:MSLOG to store captured logs.

5. Launch Windows PowerShell as an administrator.

6. Run the following PowerShell cmdlets. Replace the domain name in ';.. ,DC=test,DC=local'; with appropriate domain name. The example shows commands for ';test.local'; domain.

7. Save the following logs.

   • All files in C:MSLOG on the CA
   • All files in C:MSLOG on the domain controller

Microsoft Windows Group Policy Operational Plan

As many of you know Group Policy troubleshooting can be a bit of a challenge. If you have not made use of the Group Policy operational logs that were introduced in Windows Vista, you are missing out on an extremely handy troubleshooting tool. On any Vista or newer system, open the event viewer (eventvwr from the run command) and browse to Applications and Services Logs/Microsoft/Windows/GroupPolicy. Under this folder you will find very detailed event logs associated with Group Policy. The information that formerly was found in userenv.log is now available here. Among many other advantages this new format allows you to easily see all events that relate only to GP. To get you started, the categories of events that you will be found are as follows:

Microsoft-windows-grouppolicy/operational

Hopefully you all find this helpful.

Microsoft-windows-grouppolicy/operational 7017

MarkG
Group Policy PM