Sometime is not immediately obvious where to start when troubleshooting GPO delivery issues. NetTools provides a number of features that will let confirm the GPO configuration and then verify which GPOs have been applied to the computer and user by reading the results directly from the machine.
To start troubleshooting we need to find the computer in the Active Directory and confirm which GPO will be applied to the machines. In the quick search box enter the name of the computer that you want to troubleshoot.
In this case we are searching for the W2k19 which is a domain controller, click on the search button.
The search results will show all objects that match the search name. Now if we right click on the required item and select Use With->GPO Allocation from the context menu.
The view will change to the GPO Explorer and automatically navigate to the OU that contains the computer object. It will also display which GPOs have been assigned to the OU. In this view you can confirm which policies have the links enabled and any WMI filters that have been applied.
By clicking a policy the details of the policy are displayed in a split screen, so you can review the settings or configuration without leaving the OU view. While here check the version numbers of policy on the general tab, if the version number is zero, the policy will not apply as the policy engine will think its empty.
GPO Explorer tab views
The Inherited Policies tab will show which policies have been inherited down the OU structure and the order in which the policies will be applied. This view also supports the split view capability. Confirm that the policy you are troubleshooting is listed.
Now if we select the Content tab the list of object that are in the OU are displayed. If there is more than 2000 objects in the OU, you will need to adjust the max entries field to display more.
Find your machine in the list and click on the machines and select GPO Results from the context menu.
This will open a separate window and display what policies have been applied to the machine. The icons indicate if the policy was successfully applied to the machine or not. Policies that were successfully applied will have a green indicator, while policies that failed to be applied will have a red indicator. If you expand the policy item in the list the details why the policy failed to apply will be displayed, items that red indicator that is the reason why the policy was not applied.
For the GPO Results to be displayed the machine must be on and connected to the network.
Once the GPO Result window is populated, using the Quick Search field on the main form, you can now search for the user and repeat the steps to see the GPO Allocation for the user object. You can to expand the users policies tree in the GPO Results window to see which policies were applied to the user.
For more details on the information displayed in the GPO Results window see the GPO Viewer page