Weekend Scripter: Use PowerShell to Troubleshoot Group Policy Part 2

Doctor Scripto

Summary: Guest blogger, Alex Verboon, continues his series about using Windows PowerShell to troubleshoot Group Policy.

Microsoft Scripting Guy, Ed Wilson, is here. Welcome back guest blogger, Alex Verboon. Today Alex adds to his previous blog about using Windows PowerShell to troubleshoot Group Policy. He provides a script that automates this process. You can read his blog at Anything about IT.

Take it away Alex…

In my previous post, Use PowerShell to Troubleshoot Group Policy, I shared a script that retrieves the Group Policy processing time. As shown here, when specifying the optional –ShowDetails switch, the Get-GPProcessingTime script output also displays the Correlation:ActivityID that represents one instance of Group Policy processing.

To get all the details of what happened during that Group Policy processing cycle, we simply retrieve all events that have the corresponding ActivityID:

Get-GPEventByCorrelationID -Computer TestClient1 -CorrelationID f7cb68e1-f6da-4d23-8fca-c4cb85158de2

Here is the script output:

Image of command output

Following is the full script. You can download this script from the Script Center Repository at Get-GPEventByCo​rrelationID.

function Get-GPEventByCorrelationID




   Get Group Policy Eventlog entries by Correlation ID


   This function retrieves Group Policy event log entries filtered by Correlation ID from the specified computer


   Get-GPEventByCorrelationID -Computer TestClient -CorrelationID A2A621EC-44B4-4C56-9BA3-169B88032EFD


TimeCreated                     Id LevelDisplayName Message                                                         

———–                     — —————- ——-                                                         

7/28/2014 5:31:31 PM          5315 Information      Next policy processing for CORP\CHR59104$ will be attempted in…

7/28/2014 5:31:31 PM          8002 Information      Completed policy processing due to network state change for co…

7/28/2014 5:31:31 PM          5016 Information      Completed Audit Policy Configuration Extension Processing in 0…









        HelpMessage="Enter Computername(s)",


        [String]$Computer = "localhost",

        # CorrelationID



        HelpMessage="Enter CorrelationID",







        $Query = '<QueryList><Query Id="0" Path="Application"><Select Path="Microsoft-Windows-GroupPolicy/Operational">*[System/Correlation/@ActivityID="{CorrelationID}"]</Select></Query></QueryList>'

        $FilterXML = $Query.Replace("CorrelationID",$CorrelationID)




        $orgCulture = Get-Culture

        [System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"

        $gpevents = Get-WinEvent -FilterXml $FilterXML -ComputerName $Computer

        [System.Threading.Thread]::CurrentThread.CurrentCulture = $orgCulture




        [System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object "System.Globalization.CultureInfo" "en-US"

        $gpevents | Format-Table -Wrap -AutoSize -Property TimeCreated, Id, LevelDisplayName, Message

        [System.Threading.Thread]::CurrentThread.CurrentCulture = $orgCulture



In addition to what I have posted here and in the Script Center Repository, I found the following script written by Thomas Bouchereau (PFE), which is similar: Group Policy processing events collection with PowerShell.


Thank you, Alex, for sharing your time and knowledge. This is an awesome script and I wanted to make sure we shared it with the community. Join me tomorrow when Windows PowerShell MVP, Richard Siddaway, begins a great series about working with the registry. You will not want to miss it.

I invite you to follow me on Twitter and Facebook. If you have any questions, send email to me at scripter@microsoft.com, or post your questions on the Official Scripting Guys Forum. See you tomorrow. Until then, peace.

Ed Wilson, Microsoft Scripting Guy


Discussion is closed.

Feedback usabilla icon