| Author | Messages | |
pamarths
Posts:48
 | | 06/09/2009 6:24 AM |
| I have 100 policies at domain level and my ID is denied from
reading/applying that policy as they are not applicable to me(and most of
them are computer policies). In my RSOP all the policies are marked as
denied
Now my question is, still my login will take some extra time for processing
these denied GPOs? or will be the same time if I don't have any of the 100
policies defined in my hierarchy?
Let me know if my question is not clear
| | | |
| dmarelia
Posts:441
| | 06/09/2009 2:59 PM |
| Sitaram-
Yes, even though the GPOs are denied to you, Windows has to take the time to
enumerate all the GPOs that could apply, and then evaluate their ACLs to
determine if you are a member of one of the groups or not. So, the
processing will be greater than if those 100 GPOs were not in the path of
your user object at all.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Sitaram Pamarthi
Sent: Monday, June 08, 2009 10:24 PM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] Question on GPOs
I have 100 policies at domain level and my ID is denied from
reading/applying that policy as they are not applicable to me(and most of
them are computer policies). In my RSOP all the policies are marked as
denied
Now my question is, still my login will take some extra time for processing
these denied GPOs? or will be the same time if I don't have any of the 100
policies defined in my hierarchy?
Let me know if my question is not clear
| | | |
| pamarths
Posts:48
| | 06/10/2009 6:04 AM |
| Thanks for the reply Darren.
Do you suggest any tools which can analyz the userenv.log file and report
GPO processing time per each GPO and on whole?. I want to verify how much
time is really consumed by GPOs during login.
Thanks,
Sitaram
On Tue, Jun 9, 2009 at 7:27 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>wrote:
> Sitaram-
>
> Yes, even though the GPOs are denied to you, Windows has to take the time
> to enumerate all the GPOs that could apply, and then evaluate their ACLs to
> determine if you are a member of one of the groups or not. So, the
> processing will be greater than if those 100 GPOs were not in the path of
> your user object at all.
>
>
>
> Darren
>
>
>
> *From:* xxxxxxxxxxxxxxxx [mailto:
> xxxxxxxxxxxxxxxx] *On Behalf Of *Sitaram Pamarthi
> *Sent:* Monday, June 08, 2009 10:24 PM
> *To:* xxxxxxxxxxxxxxxx
> *Subject:* [gptalk] Question on GPOs
>
>
>
> I have 100 policies at domain level and my ID is denied from
> reading/applying that policy as they are not applicable to me(and most of
> them are computer policies). In my RSOP all the policies are marked as
> denied
>
> Now my question is, still my login will take some extra time for processing
> these denied GPOs? or will be the same time if I don't have any of the 100
> policies defined in my hierarchy?
>
> Let me know if my question is not clear
>
| | | |
| wbarnes
Posts:2
| | 06/10/2009 11:31 AM |
| I use Policy Reporter to look at group policy processing times.
http://www.sysprosoft.com/policyreporter.shtml
Thanks!
--Bill
*************************************************************************
* Bill Barnes, RHCE
* Manager of Technology Support Services
* and Library Network Administrator
* Technology Support Services
* Bloomsburg University
* ph: 570-389-2813
* e-mail: xxxxxxxxxxxxxxxx<mailto:xxxxxxxxxxxxxxxx>
*************************************************************************
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Sitaram Pamarthi
Sent: Wednesday, June 10, 2009 1:02 AM
To: xxxxxxxxxxxxxxxx
Subject: Re: [gptalk] Question on GPOs
Thanks for the reply Darren.
Do you suggest any tools which can analyz the userenv.log file and report GPO processing time per each GPO and on whole?. I want to verify how much time is really consumed by GPOs during login.
Thanks,
Sitaram
On Tue, Jun 9, 2009 at 7:27 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx<mailto:xxxxxxxxxxxxxxxx>> wrote:
Sitaram-
Yes, even though the GPOs are denied to you, Windows has to take the time to enumerate all the GPOs that could apply, and then evaluate their ACLs to determine if you are a member of one of the groups or not. So, the processing will be greater than if those 100 GPOs were not in the path of your user object at all.
Darren
From: xxxxxxxxxxxxxxxx<mailto:xxxxxxxxxxxxxxxx> [mailto:xxxxxxxxxxxxxxxx<mailto:xxxxxxxxxxxxxxxx>] On Behalf Of Sitaram Pamarthi
Sent: Monday, June 08, 2009 10:24 PM
To: xxxxxxxxxxxxxxxx<mailto:xxxxxxxxxxxxxxxx>
Subject: [gptalk] Question on GPOs
I have 100 policies at domain level and my ID is denied from reading/applying that policy as they are not applicable to me(and most of them are computer policies). In my RSOP all the policies are marked as denied
Now my question is, still my login will take some extra time for processing these denied GPOs? or will be the same time if I don't have any of the 100 policies defined in my hierarchy?
Let me know if my question is not clear
| | | |
| dmarelia
Posts:441
| | 06/10/2009 3:20 PM |
| Yep, Policy Reporter is good at looking at the userenv.log file and getting
timings. You can also download my command-line gptime.exe utility
(http://www.gpoguy.com/FreeTools/FreeToolsLibrary/tabid/67/agentType/View/Pr
opertyID/80/Default.aspx) which will tell you total time elapsed for
computer and user GP processing.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Barnes, William
Sent: Wednesday, June 10, 2009 3:28 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Question on GPOs
I use Policy Reporter to look at group policy processing times.
http://www.sysprosoft.com/policyreporter.shtml
Thanks!
--Bill
*************************************************************************
* Bill Barnes, RHCE
* Manager of Technology Support Services
* and Library Network Administrator
* Technology Support Services
* Bloomsburg University
* ph: 570-389-2813
* e-mail: xxxxxxxxxxxxxxxx
*************************************************************************
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Sitaram Pamarthi
Sent: Wednesday, June 10, 2009 1:02 AM
To: xxxxxxxxxxxxxxxx
Subject: Re: [gptalk] Question on GPOs
Thanks for the reply Darren.
Do you suggest any tools which can analyz the userenv.log file and report
GPO processing time per each GPO and on whole?. I want to verify how much
time is really consumed by GPOs during login.
Thanks,
Sitaram
On Tue, Jun 9, 2009 at 7:27 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>
wrote:
Sitaram-
Yes, even though the GPOs are denied to you, Windows has to take the time to
enumerate all the GPOs that could apply, and then evaluate their ACLs to
determine if you are a member of one of the groups or not. So, the
processing will be greater than if those 100 GPOs were not in the path of
your user object at all.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Sitaram Pamarthi
Sent: Monday, June 08, 2009 10:24 PM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] Question on GPOs
I have 100 policies at domain level and my ID is denied from
reading/applying that policy as they are not applicable to me(and most of
them are computer policies). In my RSOP all the policies are marked as
denied
Now my question is, still my login will take some extra time for processing
these denied GPOs? or will be the same time if I don't have any of the 100
policies defined in my hierarchy?
Let me know if my question is not clear
| | | |
| pamarths
Posts:48
| | 06/10/2009 3:50 PM |
| Thanks for the utility darren. Can you tell me how you(tool) are able to
fetch start and end timings?(registry?).
On Wed, Jun 10, 2009 at 7:50 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>wrote:
> Yep, Policy Reporter is good at looking at the userenv.log file and
> getting timings. You can also download my command-line gptime.exe utility (
> http://www.gpoguy.com/FreeTools/FreeToolsLibrary/tabid/67/agentType/View/PropertyID/80/Default.aspx)
> which will tell you total time elapsed for computer and user GP processing.
>
>
>
> Darren
>
>
>
> *From:* xxxxxxxxxxxxxxxx [mailto:
> xxxxxxxxxxxxxxxx] *On Behalf Of *Barnes, William
> *Sent:* Wednesday, June 10, 2009 3:28 AM
> *To:* xxxxxxxxxxxxxxxx
> *Subject:* RE: [gptalk] Question on GPOs
>
>
>
> I use Policy Reporter to look at group policy processing times.
>
> http://www.sysprosoft.com/policyreporter.shtml
>
>
>
>
>
> Thanks!
> --Bill
> *************************************************************************
> * Bill Barnes, RHCE
>
> * Manager of Technology Support Services
>
> * and Library Network Administrator
> * Technology Support Services
> * Bloomsburg University
> * ph: 570-389-2813
> * e-mail: xxxxxxxxxxxxxxxx
>
> *************************************************************************
>
>
>
>
>
> *From:* xxxxxxxxxxxxxxxx [mailto:
> xxxxxxxxxxxxxxxx] *On Behalf Of *Sitaram Pamarthi
> *Sent:* Wednesday, June 10, 2009 1:02 AM
> *To:* xxxxxxxxxxxxxxxx
> *Subject:* Re: [gptalk] Question on GPOs
>
>
>
> Thanks for the reply Darren.
>
> Do you suggest any tools which can analyz the userenv.log file and report
> GPO processing time per each GPO and on whole?. I want to verify how much
> time is really consumed by GPOs during login.
>
> Thanks,
> Sitaram
>
> On Tue, Jun 9, 2009 at 7:27 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>
> wrote:
>
> Sitaram-
>
> Yes, even though the GPOs are denied to you, Windows has to take the time
> to enumerate all the GPOs that could apply, and then evaluate their ACLs to
> determine if you are a member of one of the groups or not. So, the
> processing will be greater than if those 100 GPOs were not in the path of
> your user object at all.
>
>
>
> Darren
>
>
>
> *From:* xxxxxxxxxxxxxxxx [mailto:
> xxxxxxxxxxxxxxxx] *On Behalf Of *Sitaram Pamarthi
> *Sent:* Monday, June 08, 2009 10:24 PM
> *To:* xxxxxxxxxxxxxxxx
> *Subject:* [gptalk] Question on GPOs
>
>
>
> I have 100 policies at domain level and my ID is denied from
> reading/applying that policy as they are not applicable to me(and most of
> them are computer policies). In my RSOP all the policies are marked as
> denied
>
> Now my question is, still my login will take some extra time for processing
> these denied GPOs? or will be the same time if I don't have any of the 100
> policies defined in my hierarchy?
>
> Let me know if my question is not clear
>
>
>
| | | |
| dmarelia
Posts:441
| | 06/10/2009 4:18 PM |
| Magic J
But seriously, yes, it is the registry.
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Sitaram Pamarthi
Sent: Wednesday, June 10, 2009 7:49 AM
To: xxxxxxxxxxxxxxxx
Subject: Re: [gptalk] Question on GPOs
Thanks for the utility darren. Can you tell me how you(tool) are able to
fetch start and end timings?(registry?).
On Wed, Jun 10, 2009 at 7:50 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>
wrote:
Yep, Policy Reporter is good at looking at the userenv.log file and getting
timings. You can also download my command-line gptime.exe utility
(http://www.gpoguy.com/FreeTools/FreeToolsLibrary/tabid/67/agentType/View/Pr
opertyID/80/Default.aspx) which will tell you total time elapsed for
computer and user GP processing.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Barnes, William
Sent: Wednesday, June 10, 2009 3:28 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Question on GPOs
I use Policy Reporter to look at group policy processing times.
http://www.sysprosoft.com/policyreporter.shtml
Thanks!
--Bill
*************************************************************************
* Bill Barnes, RHCE
* Manager of Technology Support Services
* and Library Network Administrator
* Technology Support Services
* Bloomsburg University
* ph: 570-389-2813
* e-mail: xxxxxxxxxxxxxxxx
*************************************************************************
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Sitaram Pamarthi
Sent: Wednesday, June 10, 2009 1:02 AM
To: xxxxxxxxxxxxxxxx
Subject: Re: [gptalk] Question on GPOs
Thanks for the reply Darren.
Do you suggest any tools which can analyz the userenv.log file and report
GPO processing time per each GPO and on whole?. I want to verify how much
time is really consumed by GPOs during login.
Thanks,
Sitaram
On Tue, Jun 9, 2009 at 7:27 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>
wrote:
Sitaram-
Yes, even though the GPOs are denied to you, Windows has to take the time to
enumerate all the GPOs that could apply, and then evaluate their ACLs to
determine if you are a member of one of the groups or not. So, the
processing will be greater than if those 100 GPOs were not in the path of
your user object at all.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Sitaram Pamarthi
Sent: Monday, June 08, 2009 10:24 PM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] Question on GPOs
I have 100 policies at domain level and my ID is denied from
reading/applying that policy as they are not applicable to me(and most of
them are computer policies). In my RSOP all the policies are marked as
denied
Now my question is, still my login will take some extra time for processing
these denied GPOs? or will be the same time if I don't have any of the 100
policies defined in my hierarchy?
Let me know if my question is not clear
| | | |
| pamarths
Posts:48
| | 06/10/2009 4:45 PM |
| Darren....I know your magic now :-)
http://technet.microsoft.com/en-us/magazine/2008.01.gpperf.aspx
And the key behind the screens is
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group
Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}
Thanks for your technet post.
Thanks,
Sitaram
On Wed, Jun 10, 2009 at 8:47 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>wrote:
> Magic J
>
>
>
> But seriously, yes, it is the registry.
>
>
>
>
>
>
>
> *From:* xxxxxxxxxxxxxxxx [mailto:
> xxxxxxxxxxxxxxxx] *On Behalf Of *Sitaram Pamarthi
> *Sent:* Wednesday, June 10, 2009 7:49 AM
>
> *To:* xxxxxxxxxxxxxxxx
> *Subject:* Re: [gptalk] Question on GPOs
>
>
>
> Thanks for the utility darren. Can you tell me how you(tool) are able to
> fetch start and end timings?(registry?).
>
>
> On Wed, Jun 10, 2009 at 7:50 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>
> wrote:
>
> Yep, Policy Reporter is good at looking at the userenv.log file and getting
> timings. You can also download my command-line gptime.exe utility (
> http://www.gpoguy.com/FreeTools/FreeToolsLibrary/tabid/67/agentType/View/PropertyID/80/Default.aspx)
> which will tell you total time elapsed for computer and user GP processing.
>
>
>
> Darren
>
>
>
> *From:* xxxxxxxxxxxxxxxx [mailto:
> xxxxxxxxxxxxxxxx] *On Behalf Of *Barnes, William
> *Sent:* Wednesday, June 10, 2009 3:28 AM
>
>
> *To:* xxxxxxxxxxxxxxxx
>
> *Subject:* RE: [gptalk] Question on GPOs
>
>
>
> I use Policy Reporter to look at group policy processing times.
>
> http://www.sysprosoft.com/policyreporter.shtml
>
>
>
>
>
> Thanks!
> --Bill
> *************************************************************************
> * Bill Barnes, RHCE
>
> * Manager of Technology Support Services
>
> * and Library Network Administrator
> * Technology Support Services
> * Bloomsburg University
> * ph: 570-389-2813
> * e-mail: xxxxxxxxxxxxxxxx
>
> *************************************************************************
>
>
>
>
>
> *From:* xxxxxxxxxxxxxxxx [mailto:
> xxxxxxxxxxxxxxxx] *On Behalf Of *Sitaram Pamarthi
> *Sent:* Wednesday, June 10, 2009 1:02 AM
> *To:* xxxxxxxxxxxxxxxx
> *Subject:* Re: [gptalk] Question on GPOs
>
>
>
> Thanks for the reply Darren.
>
> Do you suggest any tools which can analyz the userenv.log file and report
> GPO processing time per each GPO and on whole?. I want to verify how much
> time is really consumed by GPOs during login.
>
> Thanks,
> Sitaram
>
> On Tue, Jun 9, 2009 at 7:27 PM, Darren Mar-Elia <xxxxxxxxxxxxxxxx>
> wrote:
>
> Sitaram-
>
> Yes, even though the GPOs are denied to you, Windows has to take the time
> to enumerate all the GPOs that could apply, and then evaluate their ACLs to
> determine if you are a member of one of the groups or not. So, the
> processing will be greater than if those 100 GPOs were not in the path of
> your user object at all.
>
>
>
> Darren
>
>
>
> *From:* xxxxxxxxxxxxxxxx [mailto:
> xxxxxxxxxxxxxxxx] *On Behalf Of *Sitaram Pamarthi
> *Sent:* Monday, June 08, 2009 10:24 PM
> *To:* xxxxxxxxxxxxxxxx
> *Subject:* [gptalk] Question on GPOs
>
>
>
> I have 100 policies at domain level and my ID is denied from
> reading/applying that policy as they are not applicable to me(and most of
> them are computer policies). In my RSOP all the policies are marked as
> denied
>
> Now my question is, still my login will take some extra time for processing
> these denied GPOs? or will be the same time if I don't have any of the 100
> policies defined in my hierarchy?
>
> Let me know if my question is not clear
>
>
>
>
>
| | | |
|
|