Update: GPDBPA-tool on localized Windows

Comments Off

I asked the question if they were going to change this tool so it also is runnable on localized versions of Windows.

The answer is that it won’t install on a localized version but you can install it on an English Windows XP and then transfer the files to your localized version and then run it. The files are located at %ProgramFiles%\GPDBPA\

They don’t guarantee success but you might want to try it (in LAB-environment first of course).

Technorati Tags: ,

My first test of GPDBPA

Comments Off

It took me some time more than just last weekend to checkout the tool delivered from MS but here are my first thoughts about this tool.

First a print screen of the program:

Until today I have only run the program on two domain controllers so I haven’t really tested the tool completely but I have found some parts which you might find interesting.

First of all you should check the page named Critical Issues of course.
For me I got two errors here when I tried on my DC.

  1. Incorrect permissions on Default Domain Controller Policy
  2. DFS service not running on [MACHINE]

About the first error it complained about “Enterprise Domain Controllers” security group didn’t have the “Apply Group Policy” access which was correct so I now recieved this information and could open GPMC and correct the error.

Second error I’m a bit confused about since on Windows 2003 (and earlier) normally don’t have DFS running (if you don’t configure it of course). It’s using FRS for replication of SYSVOL and not DFS. I think this is a mistake from MS because I suspect the tool also has been designed with Windows Server 2008 kept in mind since it’s using DFS-R and not FRS and I think that’s why it’s watching the status of this service.

If you continue at “All Issues” you can find even more information. Some parts are information and some parts errors. I got a lot of errors which I don’t really understand. For example it complained about that:

  • I’m not using Roaming profiles!?!?
  • Offline Files disabled using reg-key (on a Domain Controller)!?!?
  • It complained that two out of four of my group policies (which affects my DC’s) had their user settings disabled!?!?

However the tool has also “Tree reports” which tells you a lot about your GPO’s so if you know what you are doing you can find some useful information about your GPO’s in this tool instead of searching for it using AdsiEdit for example.

As conclusion you can say that the tool has some improvements that need to be done before you can fully benefit from it but it’s a great start if you aren’t using anything today and I would recommend everyone to check it out and at least see if it tells you if you have any errors. :)

There are some other tools available on the market which you might want to check you if you don’t find this tool useful enough. You can find links on the Group Policy homepage

Technorati Tags: , , ,