1 Reply Latest reply on Jan 7, 2014 11:26 AM by evanr

    GPO modified?

    ttl

        What is the best way to find out if a GPO was modified and what change was made?  I've tried  PolicyModify and DomainPolicyModify with no luck.

        • Re: GPO modified?
          evanr

          I don't think the actual change that was done in GP will show up in the log will it?  The closest I could come to see changes was by viewing the operational log under Event Viewer -> Applications & Services Log -> Microsoft -> Windows -> GroupPolicy.  The messages still seem very generic to me.

           

          Starting Audit Policy Configuration Extension Processing.

           

           

          List of applicable Group Policy objects: (Changes were detected.)

           

           

          Domain Policy - New

          Default Domain Controllers Policy

           

          I hope you get this figured out as it would be very handy indeed.  We usually uses GroupPolicyModify but mainly to track systems that failed at applying the newest GPO update..etc