Using Group Policy Log View

GPLogView.exe is a command-line troubleshooting tool that you can use to export Group Policy-related events logged in the System Event Log channel and the Group Policy Operational Event Log channel into a text, HTML or XML file. GPLogView.exe works only on Windows Vista and later; it is not included with Windows 7 or Windows Server 2008 R2, but it is available as a separate download from http://go.microsoft.com/fwlink/?LinkId=75004. The command-line options for this tool are the following:

• -? Shows this usage message.
• -o output_filename Output filename required for text, XML, or HTML; not valid if -m is specified.
• -n Do not output the activity ID.
• -p Dump the process ID and thread ID associated with each event.
• -a activity_ID_GUID Shows only events matching the given activity ID.
• -m Runs the tool in monitor mode displaying events in real time.
• -x Dumps the event in XML; the only other options allowed with this option are -m and -a, but not both together.
• -h Dumps the events in HTML format; the -m or -x option is not allowed, and -a and -n are allowed, but not both together. Also must specify the -o option.
• -q query_filename Uses the query specified by the query file.
• -l publisher_name If -q is specified, the publisher name must be specified.

The following examples illustrate the use of this tool:

• GPLogView.exe -o GPEvents.txt
• GPLogView.exe -n -o GPEvents.txt
• GPLogView.exe -a ea276341-d646-43e0-866c-e7cc35aecc0a -o GPEvents.txt
• GPLogView.exe -p -o GPEvents.txt
• GPLogView.exe -x -o GPEvents.xml
• GPLogView.exe -x -m
• GPLogView.exe -x -a ea276341-d646-43e0-866c-e7cc35aecc0a -o GPEvents.xml
• GPLogView.exe -h -o GPEvents.html
• GPLogView.exe -h -a ea276341-d646-43e0-866c-e7cc35aecc0a -o GPEvents.html
• GPLogView.exe -h -q somequeryFile.txt -l Microsoft-Windows-GroupPolicy -oGPEvents.html