Nexthink Recognized by SIIA as the Best Digital Employee Experience Platform Learn more

Learn more

Learn more

cookie alert

We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

Nexthink Library

Group Policy Management

Back

Group Policy Management

Latest Version: 3.2.2.1
|
Updated on March 20, 2024
Install
Configuration

Description

Problem

Information pertaining to the time taken for user and computer group policies to be applied can be relevant when trying to investigate GPO-related issues. This information is not readily available in one location. As a result, it can be tedious to find such information.

Solution

To relieve the aforementioned problem, you can use the Get Gpo Startup Impact Remote Action to attain the following information:

  • The amount of time taken for computer policy GPOs to be applied
  • The amount of time taken for user policy GPOs to be applied
  • The amount of time taken for the domain controller to be discovered
  • The DNS name and IP of the domain controller used at logon to retrieve policies

Versions

  • 3.2.2.1 - 20 Mar 2024 - Fixing bug causing broken metrics and investigations
  • 3.2.2.0 - 04 Nov 2022 - Updated OS requirements
  • 3.2.1.0 - 22 Jul 2022 - Documented KB Fix URL for "Get Startup Impact" Remote Action v4.2.1.0
  • 3.2.0.0 - 19 May 2020 - Added compatibility for Windows 8.1 devices on "Get Startup Impact" Remote Action
  • 3.1.0.0 - 19 May 2020 - Renamed "Test Computer Group Policy Applied" by "Request VPN Connection for Compliance" and updated features
  • 3.0.1.0 - 19 Dec 2019 - Fixed documentation
  • 3.0.0.0 - Dashboard, metrics and investigation to gain visibility on GPO processing time that could impact logon duration
  • 2.0.0.0 - Remote Action added - Get-GpoStartupImpact
  • 1.1.1.0 - Adjusted execution frequency in Test-ComputerGroupPolicyApplied
  • 1.1.0.0 - New Remote Action - Test-ComputerGroupPolicyApplied
  • 1.0.0.0 - Initial release

Content

Campaigns - 1
Dashboards - 1
Investigations - 3
Metrics - 3
Remote actions - 3
Request VPN Connection for Compliance Update Group Policy Settings Get Gpo Startup Impact

Required Products

Nexthink Act
Nexthink Engage

Platforms

Windows 7 and newer

Compatibility

V6.14 and later

This Might Interest You

Workflow: Windows 11 migration
New

Orchestrate the Windows 11 migration process with automated compatibility checks and pre-to-post migration user engagement.

Released on April 11, 2024
View Library Pack

Workflow: Device assignment verification
New

Orchestrate the verification and update of device assignee information in the ServiceNow Hardware Asset Management database through a dedicated workflow.

Released on April 10, 2024
View Library Pack

Request VPN Connection for Compliance

Script Description

Compares last time Computer Group Policies were applied on target device against provided time range.By providing a list of corporate DNS domains, in case of the device being connected to the corporate network the script schedules a Group Policies update with 1 minute of delay.If the device is not in a corporate network, the script launches a campaign to encourage the user to connect to the corporate VPN and then it schedules the Group Policies update with 5 minutes of delay.The script offers the possibility of enforcing the Group Policies update in any case without notifying the user.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 720 seconds is recommended.

Parameters

Label Description
Enforce Policy Update Provide values true or false in case you want to force Group Policies to be updated in any case, when the user is connected to corporate network and when it is not
Campaign Id CampaignId to encourage the user to connect the VPN to the corporate network. Empty value is not allowed, in case of you want to force Group Policies update without asking the user, use the EnforcePolicyUpdate parameter
Corporate Dns Domains Comma-separated list of corporate DNS names. Example "dc.nexthink.com, intranet.nexthink.com"
Days Since Last Group Policies Update Number of days in range of conducted search, must be between (1-180). 1 indicate range 0-24h ago, 2 indicate range 0-48h ago and so on

Outputs

Label Type Description
Corporate Network Bool Whether or not the user is connected to a corporate network based on the provided DNS domains
User Will Connect To Corporate Network Bool Whether or not the user will connect to the VPN to enable Group Policies update

Restrictions

Further Information

Only Computer Group Policies last update is checked.
It is recommended that the device be restarted for some applied policies to take effect, to achieve that you could use Restart Device Remote Action.
Updating Group Policies may be resources consuming, be aware of the user impact before executing it.

Test Scenarios

EnforcingGpoUpdate
Test Case EnforcePolicyUpdate is set to true, Group Policies are updated through a scheduled task.
Environment Windows 10 x64 EN 1909
Results Success - A scheduled task with 1 minute of delay is created to execute gpupdate command.
GpoUpdateNotNeeded
Test Case The last Group Policies update is within the threshold, nothing is updated.
Environment Windows 10 x64 EN 1909
Results Success - Nothing is scheduled and the result is reported to the engine.
DeviceConnectedToCorporateNetwork
Test Case The last Group Policies update is out of the threshold and the device is connected to the corporate network, Group Policies are updated.
Environment Windows 10 x64 EN 1909
Results Success - A scheduled task with 1 minute of delay is created to execute gpupdate command.
DeviceNotConnectedToCorporateNetworkUserAnswersYes
Test Case The last Group Policies update is out of the threshold, the device is not connected to the corporate network and the user answers Yes to the campaign, Group Policies are updated.
Environment Windows 10 x64 EN 1909
Results Success - A scheduled task with 5 minutes of delay is created to execute gpupdate command.
DeviceNotConnectedToCorporateNetworkUserAnswersNo
Test Case The last Group Policies update is out of the threshold and the device is not connected to the corporate network and the user answers No to the campaign, Group Policies are not updated.
Environment Windows 10 x64 EN 1909
Results Success - No scheduled task is created and the result is reported to the engine.

Update Group Policy Settings

Script Description

Refreshes computer or user Group Policy settings using the 'gpupdate' command. The script is designed for Windows 10 and 7.

Execution context and suggested scheduling

Run the script as 'interactive user'. In some environments it might be necessary to run as 'local system'. The script should be executed manually.

A timeout of 1200 seconds is recommended.

Parameters

Label Description
Group Policy Target Group Policy type to be updated. Choose whether to update the "user" or the "computer" policies
Force Reapplies all policy settings. Set it to "true" to apply all policy settings, not just those that have changed, "false" otherwise
Maximum Delay In Seconds Maximum random delay set to avoid domain controller overload. Provide number of seconds

Outputs

Label Type Description
User Name String User who is currently logged in

Restrictions

Further Information

During execution, 'gpupdate' sends a number of queries to domain controller. To reduce server overload, the script contains a random wait function which delays its execution from 0 up to maximum 600 seconds.
Maximum value of random script execution delay can be set in input parameter 'MaximumDelayInSeconds'.
It is recommended that the device be restarted for some applied policies to take effect.

Get Gpo Startup Impact

Script Description

This Remote Action is used to measure the impact of User and Computer GPOs at the point that the device is started (for the Computer GPO) and the point that the first user has logged onto that device following the startup (for the User GPO).

Please be aware that this Remote Action is not supported on Entra ID joined devices, where GPOs are not used. If the Remote Action is executed on an Entra ID joined device it will complete successfully but the status message will reflect that the device was not supported, additionally we will set the output 'entra_id_joined' to True, in order to help you to track these scenarios.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Computer Gpo DC Name String Domain Controller DNS name and IP used during computer logon
Computer Gpo DC Discovery In Seconds Float Elapsed seconds to discover a domain controller during computer logon
Computer Gpo Applied Time In Seconds Float Elapsed seconds to apply all computer policies
User Gpo DC Name String Domain Controller DNS name and IP used during user logon
User Gpo DC Discovery In Seconds Float Elapsed seconds to discover a domain controller during user logon
User Gpo Applied Time In Seconds Float Elapsed seconds to apply all user policies
Entra Id Joined Bool Returns true if the device is joined to Entra ID which means no GPOs can be present

Further Information

The Remote Action fully relies on the Windows Event Viewer information for events 4000 and 4001 from the Windows-GroupPolicy provider.

In case the event 4000 is not available, a message indicating it is not possible to obtain the computer information will be displayed and the outputs will be empty.

In case the event 4001 is not available, a message indicating it is not possible to obtain the user information will be displayed and the outputs will be empty.

Both event IDs 4000 and 4001 are required to make the calculation used in the Remote Action outputs.

In case the GPO application process finishes with an error (events 6000, 6001, 7000 and 7001), a message will be displayed and the outputs will be empty.

Note that when the value -1 is returned for the outputs, it indicates that the information could not be retrieved from the event logs.

If the output is 0, it means that the Group Policy processing time was indeed successfully calculated but the time taken for Windows to process them was less than 1 second.

As on Microsoft Windows, the Event Log is periodically rotated when it reaches the maximum specified file size, to avoid a higher likelihood of the Remote Action missing the required events (when the log is rotated), it is possible to increase the Event Viewer log size limit in /Microsoft/Windows/Microsoft-Windows-GroupPolicy/Operational log properties. The other possibility to decrease the likelihood of this happening is to run the Remote Action regularly (a recommendation is to run it daily at a minimum).

Further information on the events used by the Remote Action can be found here: Microsoft documentation about Group Policy events.