{"id":788,"date":"2014-08-24T00:01:00","date_gmt":"2014-08-24T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2014\/08\/24\/weekend-scripter-use-powershell-to-troubleshoot-group-policy\/"},"modified":"2014-08-24T00:01:00","modified_gmt":"2014-08-24T00:01:00","slug":"weekend-scripter-use-powershell-to-troubleshoot-group-policy","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-use-powershell-to-troubleshoot-group-policy\/","title":{"rendered":"Weekend Scripter: Use PowerShell to Troubleshoot Group Policy"},"content":{"rendered":"<p><b style=\"font-size:12px\">Summary<\/b><span style=\"font-size:12px\">: Guest blogger, Alex Verboon, talks about using Windows PowerShell to troubleshoot delays in Group Policy performance.<\/span><\/p>\n<p>Microsoft Scripting Guy, Ed Wilson, is here. Today we have a new guest blogger, Alex Verboon. I was reading Alex&rsquo;s blog page. I liked what he had to say and I invited him to contribute a guest blog post here. You can read his blog at <a href=\"http:\/\/www.verboon.info\/\" target=\"_blank\">Anything about IT<\/a>.<\/p>\n<p>Now, here is Alex&#8230;<\/p>\n<p>For years, I have been reading and consuming content from the Hey, Scripting Guy! Blog, so it&#039;s a big pleasure to give something back. Today I want to share with you a Windows PowerShell script I put together recently that collects the Group Policy processing time on a client. The script might come in handy when you are troubleshooting or reviewing system startup performance or to prove that it&#039;s not Group Policy that&#039;s causing delays.<\/p>\n<p>If you are not familiar with troubleshooting Group Policy, I recommend that you read the TechNet article <a href=\"http:\/\/technet.microsoft.com\/library\/cc749336.aspx\" target=\"_blank\">Troubleshooting Group Policy Using Event Logs<\/a>.<\/p>\n<p>The script accepts multiple computer names as input, so you can specify multiple computers that are located in different locations if you&#039;re interested to find out what the Group Policy processing time is within the different locations of the company.<\/p>\n<p>Here is what the script does for each computer specified and when online:<\/p>\n<ul>\n<li>Retrieves the last end policy processing event of the user that logged on to that computer<\/li>\n<li>Retrieves the last end policy processing event for the computer<\/li>\n<li>Gets the unique activity ID for the instance of the user Group Policy processing cycle<\/li>\n<li>Retrieves the domain controller name from event 5308 from the user processing cycle<\/li>\n<li>Retrieves network information from event 5314 from the user processing cycle<\/li>\n<li>Gets the unique activity ID for the instance of the computer Group Policy processing cycle<\/li>\n<li>Retrieves the domain controller name from event 5308 from the computer processing cycle<\/li>\n<li>Retrieves network information from event 5314 from the computer processing cycle<\/li>\n<\/ul>\n<p>The script also writes the following computer information to a custom object:<\/p>\n<ul>\n<li>Computer end policy processing event ID<\/li>\n<li>Event ID description<\/li>\n<li>Event message<\/li>\n<li>Time stamp<\/li>\n<li>Activity ID<\/li>\n<li>Policy processing time (in seconds)<\/li>\n<li>Computer name<\/li>\n<li>Bandwidth (in Kbps)<\/li>\n<li>Slow link (yes or no)<\/li>\n<li>Domain controller used<\/li>\n<\/ul>\n<p>And it writes the following user information to a custom object:<\/p>\n<ul>\n<li>User end policy processing event ID<\/li>\n<li>Event ID description<\/li>\n<li>Event message<\/li>\n<li>Time stamp<\/li>\n<li>Activity ID<\/li>\n<li>Policy processing time (in seconds)<\/li>\n<li>Bandwidth (in Kbps)<\/li>\n<li>Slow link (yes or no)<\/li>\n<li>Domain controller used<\/li>\n<\/ul>\n<p>If the script is launched with the <b>&ndash;Computer<\/b> parameter, the script output is:<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/4403.1.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/4403.1.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>When specifying the optional <b>&ndash;ShowDetails<\/b> switch, the script output is:<\/p>\n<p><a href=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/1325.2.PNG\"><img decoding=\"async\" src=\"https:\/\/msdnshared.blob.core.windows.net\/media\/TNBlogsFS\/prod.evol.blogs.technet.com\/CommunityServer.Blogs.Components.WeblogFiles\/00\/00\/00\/76\/18\/1325.2.PNG\" alt=\"Image of command output\" title=\"Image of command output\" \/><\/a><\/p>\n<p>Following is the full script. You can download this script from the Script Center Repository: <a href=\"http:\/\/gallery.technet.microsoft.com\/scriptcenter\/Get-GPProcessingTime-a124aaf5\" target=\"_blank\">Get-GPProcessingTime<\/a>.<\/p>\n<p style=\"margin-left:30px\"><b>function Get-GPProcessingtime<\/b><\/p>\n<p style=\"margin-left:30px\">{<\/p>\n<p style=\"margin-left:30px\">&lt;#<\/p>\n<p style=\"margin-left:30px\">.Synopsis<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp; Get Group Policy processing time from the Group Policy event log on local and remote computers<\/p>\n<p style=\"margin-left:30px\">.DESCRIPTION<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp; The Get-GPProcessingtime cmdlet gets Group Policy processing time for the user and computer related<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp; Group Policies that are processed on the specified computer(s).<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp; The last user and computer Group Policy processing event is used.<\/p>\n<p style=\"margin-left:30px\">.EXAMPLE<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp; Get-GPProcessingtime -Computer TestClient1,TestClient2,TestClient3<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp; Lists additional details of the Group Policy processing duration information<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_PrincipalSamName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Cmp_PolicyElaspedTimeInSeconds&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Usr_PolicyElaspedTimeInSeconds&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; CORP\\TestClient1$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; CORP\\TestClient2$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; CORP\\TestClient3$&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 12&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 49<\/p>\n<p style=\"margin-left:30px\">.EXAMPLE<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Get-GPProcessingtime -Computer TestClient1 -ShowDetails<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_ID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 8004<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_EventTypeDescription&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : Successful computer manual refresh event<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_Message &nbsp;: Completed manual processing of policy for computer CORP\\TestClient1$ in 1 second.<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_TimeCreated&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 8\/1\/2014 8:13:40 PM<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_ActivityID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : e872d44e-1b89-434a-bf79-b1875ec810cf<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_PolicyElaspedTimeInSeconds : 1<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_PrincipalSamName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : CORP\\TestClient1$<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_BandwidthInkbps&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 185508<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_IsSlowLink&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : false<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Cmp_DomainController&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : dc01.corp.com<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_ID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 8001<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_EventTypeDescription&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : Successful user end event<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_Message&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : Completed user logon policy processing for CORP\\User1 in 2 seconds.<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_TimeCreated&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 7\/30\/2014 4:55:42 PM<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_ActivityID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : 43ca8a03-2b98-4e92-8613-aad67990bca3<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_PolicyElaspedTimeInSeconds : 2<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_PrincipalSamName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : CORP\\User1<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_BandwidthInkbps &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: 1200750<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_IsSlowLink&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : false<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Usr_DomainController&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; : dc01.corp.com<\/p>\n<p style=\"margin-left:30px\">.PARAMETER Computer<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer.<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; The default value is the local computer.<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; To get Group Policy processing information from remote computers, the firewall port for the event log service must be configured to allow remote access.<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; This cmdlet does not rely on Windows PowerShell remoting. You can use the ComputerName parameter even if your computer is not configured to run remote commands.<\/p>\n<p style=\"margin-left:30px\">.PARAMETER ShowDetails<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; The ShowDetails switch is optional. When set, additonal Group Policy processing information is listed,&nbsp;&nbsp;&nbsp; such as the type of the Group Policy processing event (periodic, manual), the Activity ID network bandwidth, and the domain controller being contacted.<\/p>\n<p style=\"margin-left:30px\">.LINKS<\/p>\n<p style=\"margin-left:30px\"># http:\/\/technet.microsoft.com\/library\/cc749336.aspx&nbsp;&nbsp;&nbsp;<\/p>\n<p style=\"margin-left:30px\">#&gt;<\/p>\n<p style=\"margin-left:30px\">[CmdletBinding()]<\/p>\n<p style=\"margin-left:30px\">&nbsp;Param(<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; [Parameter(Mandatory=$False,<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; ValueFromPipelineByPropertyName=$true,HelpMessage=&quot;Enter Computername(s)&quot;,<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Position=0)]<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; [Alias(&quot;ipaddress&quot;,&quot;host&quot;)]<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; [String[]]$Computer = &quot;localhost&quot;,<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; [switch]$ShowDetails<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; )<\/p>\n<p style=\"margin-left:30px\">begin{<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; # User Event IDs<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; $ugeventcodes = @{<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;8001&quot; = &quot;Successful user end event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;8003&quot; = &quot;Successful user network change event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;8005&quot; = &quot;Successful user manual refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;8007&quot; = &quot;Successful user periodic refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;7001&quot; = &quot;Error during user end event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;7003&quot; = &quot;Error during user network change event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;7005&quot; = &quot;Error during user manual refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;7007&quot; = &quot;Error during user periodic refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;6001&quot; = &quot;Warnings during user end event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;6003&quot; = &quot;Warnings during&nbsp; user network change event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;6005&quot; = &quot;Warnings during&nbsp; user manual refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;6007&quot; = &quot;Warnings during&nbsp; user periodic refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; # Computer Event IDs<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; $cgeventcodes = @{<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;8000&quot; = &quot;Successful computer end event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;8002&quot; = &quot;Successful computer network change event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;8004&quot; = &quot;Successful computer manual refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;8006&quot; = &quot;Successful computer periodic refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;7000&quot; = &quot;Error duing computer end event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;7002&quot; = &quot;Error during computer network change event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;7004&quot; = &quot;Error during computer manual refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;7006&quot; = &quot;Error during computer periodic refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;6000&quot; = &quot;Warnings during computer end event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;6002&quot; = &quot;Warnings during computer network change event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;6004&quot; = &quot;Warnings during&nbsp; computer manual refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &quot;6006&quot; = &quot;Warnings during&nbsp; computer periodic refresh event&quot;;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">}<\/p>\n<p style=\"margin-left:30px\">Process{<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; $compcount = $Computer.count<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; $si=1<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; $gpprocessresult = @()<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; ForEach ($comp in $Computer)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; {<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; If (Test-Connection -ComputerName &quot;$comp&quot; -Count 1 -Quiet)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $orgCulture = Get-Culture<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [System.Threading.Thread]::CurrentThread.CurrentCulture = New-Object &quot;System.Globalization.CultureInfo&quot; &quot;en-US&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# variable that holds all user related event IDs<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ueventids = $ugeventcodes.Keys<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Get last user GP processing event<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $uevent = Get-WinEvent -ComputerName $Comp -filterHashTable @{<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Providername = &quot;Microsoft-Windows-GroupPolicy&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID = $($ueventids)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } -ErrorAction SilentlyContinue | select -first 1 -ErrorAction SilentlyContinue<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # variable that holds all computer related IDs<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ceventids = $cgeventcodes.Keys<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Get last computer GP processing event<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $cevent = Get-WinEvent -ComputerName $Comp -filterHashTable @{<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Providername = &quot;Microsoft-Windows-GroupPolicy&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ID = $($ceventids)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } -ErrorAction SilentlyContinue | select -first 1 -ErrorAction SilentlyContinue<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (-not ([string]::IsNullOrEmpty($uevent)))<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # create a variable that holds the user event details<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$ueventXML = [xml]$uevent.ToXml()<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Retrieve Event with EventID 5308 to get the domain controller name used when processing the user<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $Query = &#039; &lt;QueryList&gt;&lt;Query Id=&quot;0&quot; Path=&quot;Application&quot;&gt;&lt;Select Path=&quot;Microsoft-Windows-GroupPolicy\/Operational&quot;&gt;*[System\/Correlation\/@ActivityID=&quot;{CorrelationID}&quot;] and *[System[(EventID=&quot;5308&quot;)]] &lt;\/Select&gt;&lt;\/Query&gt;&lt;\/QueryList&gt;&#039;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $FilterXML = $Query.Replace(&quot;CorrelationID&quot;,$uevent.ActivityID)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $udc = Get-WinEvent -FilterXml $FilterXML -ComputerName $comp -ErrorAction SilentlyContinue | select -First 1 -ErrorAction SilentlyContinue<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (-not ([string]::IsNullOrEmpty($udc)))<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {$udcevent = [xml]$udc.ToXml()<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $udcname = $udcevent.event.EventData.Data[0].&quot;#Text&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }&nbsp;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Retrieve Event with Event ID 5314 to get network information when processing user<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $Query = &#039; &lt;QueryList&gt;&lt;Query Id=&quot;0&quot; Path=&quot;Application&quot;&gt;&lt;Select Path=&quot;Microsoft-Windows-GroupPolicy\/Operational&quot;&gt;*[System\/Correlation\/@ActivityID=&quot;{CorrelationID}&quot;] and *[System[(EventID=&quot;5314&quot;)]] &lt;\/Select&gt;&lt;\/Query&gt;&lt;\/QueryList&gt;&#039;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $FilterXML = $Query.Replace(&quot;CorrelationID&quot;,$uevent.ActivityID)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;$unw = Get-WinEvent -FilterXml $FilterXML -ComputerName $comp -ErrorAction SilentlyContinue | select -First 1 -ErrorAction SilentlyContinue<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (-not ([string]::IsNullOrEmpty($unw)))<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {$unwevent = [xml]$unw.ToXml()<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$uBandwidthInkbps = $unwevent.event.EventData.Data[0].&quot;#Text&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $uIsSlowLink = $unwevent.event.EventData.Data[1].&quot;#Text&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }&nbsp;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (-not ([string]::IsNullOrEmpty($cevent)))<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # create a variable that holds the computer event details<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $ceventXML = [xml]$cevent.ToXml()<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Retrieve Event with EventID 5308 to get the domain controller name when processing the computer<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;$Query = &#039; &lt;QueryList&gt;&lt;Query Id=&quot;0&quot; Path=&quot;Application&quot;&gt;&lt;Select Path=&quot;Microsoft-Windows-GroupPolicy\/Operational&quot;&gt;*[System\/Correlation\/@ActivityID=&quot;{CorrelationID}&quot;] and *[System[(EventID=&quot;5308&quot;)]] &lt;\/Select&gt;&lt;\/Query&gt;&lt;\/QueryList&gt;&#039;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $FilterXML = $Query.Replace(&quot;CorrelationID&quot;,$cevent.ActivityID)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $cdc = Get-WinEvent -FilterXml $FilterXML -ComputerName $comp -ErrorAction SilentlyContinue | select -First 1 -ErrorAction SilentlyContinue<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (-not ([string]::IsNullOrEmpty($cdc)))<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {$cdcevent = [xml]$cdc.ToXml()<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $cdcname = $cdcevent.event.EventData.Data[0].&quot;#Text&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Retrieve Event with EventID 5314 to get network information when processing computer<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $Query = &#039; &lt;QueryList&gt;&lt;Query Id=&quot;0&quot; Path=&quot;Application&quot;&gt;&lt;Select Path=&quot;Microsoft-Windows-GroupPolicy\/Operational&quot;&gt;*[System\/Correlation\/@ActivityID=&quot;{CorrelationID}&quot;] and *[System[(EventID=&quot;5314&quot;)]] &lt;\/Select&gt;&lt;\/Query&gt;&lt;\/QueryList&gt;&#039;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$FilterXML = $Query.Replace(&quot;CorrelationID&quot;,$cevent.ActivityID)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $cnw = Get-WinEvent -FilterXml $FilterXML -ComputerName $comp -ErrorAction SilentlyContinue | select -First 1 -ErrorAction SilentlyContinue<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (-not ([string]::IsNullOrEmpty($unw)))<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {$cnwevent = [xml]$cnw.ToXml()<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $cBandwidthInkbps = $cnwevent.event.EventData.Data[0].&quot;#Text&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $cIsSlowLink = $cnwevent.event.EventData.Data[1].&quot;#Text&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }&nbsp;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object = New-Object -TypeName PSObject<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_ID -Value $cevent.Id<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_EventTypeDescription -Value $cgeventcodes[&quot;$($cevent.Id)&quot;]<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_Message -Value $cevent.Message<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_TimeCreated -Value $cevent.TimeCreated<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_ActivityID -Value $cevent.ActivityId<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_PolicyElaspedTimeInSeconds -Value ($cpe = If ([string]::IsNullOrEmpty($cevent)) {} else {&nbsp; $ceventXML.Event.EventData.Data[0].&#039;#text&#039;})<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_PrincipalSamName -Value ($cpn = If ([string]::IsNullOrEmpty($cevent)) {} else { $ceventXML.Event.EventData.Data[2].&#039;#text&#039; })<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;$object | Add-Member -MemberType NoteProperty -Name Cmp_BandwidthInkbps -Value $cBandwidthInkbps<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_IsSlowLink -Value $cIsSlowLink<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Cmp_DomainController -Value $cdcname<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_ID -Value $uevent.Id<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_EventTypeDescription -Value $ugeventcodes[&quot;$($uevent.Id)&quot;]<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_Message -Value $uevent.Message<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_TimeCreated -Value $uevent.TimeCreated<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_ActivityID -Value $uevent.ActivityId<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_PolicyElaspedTimeInSeconds -Value ($Upe = If ([string]::IsNullOrEmpty($uevent)) {} else {&nbsp; $ueventXML.Event.EventData.Data[0].&#039;#text&#039;})<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_PrincipalSamName -Value ($upn = If ([string]::IsNullOrEmpty($uevent)) {} else { $ueventXML.Event.EventData.Data[2].&#039;#text&#039; })<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_BandwidthInkbps -Value $uBandwidthInkbps<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_IsSlowLink -Value $uIsSlowLink<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $object | Add-Member -MemberType NoteProperty -Name Usr_DomainController -Value $udcname<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $gpprocessresult += $object<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Else<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; write-output &quot;Client $comp is NOT reachable, skipping&quot;<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Write-Progress -Activity &quot;Processing $comp&quot; -Status &quot;Processing $si of $compcount&quot; -PercentComplete (($si \/ $compcount) * 100)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $si++<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">}<\/p>\n<p style=\"margin-left:30px\">End{<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; If ($ShowDetails.IsPresent -eq $false)<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {$gpprocessresult | Select Cmp_PrincipalSamName, Cmp_PolicyElaspedTimeInSeconds,Usr_PolicyElaspedTimeInSeconds}<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; Else<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; {$gpprocessresult}<\/p>\n<p style=\"margin-left:30px\">&nbsp;&nbsp;&nbsp; }<\/p>\n<p style=\"margin-left:30px\">}<\/p>\n<p>~Alex<\/p>\n<p>Thank you, Alex, for an excellent post&mdash;well done.<\/p>\n<p>I invite you to follow me on <a href=\"http:\/\/bit.ly\/scriptingguystwitter\" target=\"_blank\">Twitter<\/a> and <a href=\"http:\/\/bit.ly\/scriptingguysfacebook\" target=\"_blank\">Facebook<\/a>. If you have any questions, send email to me at <a href=\"mailto:scripter@microsoft.com\" target=\"_blank\">scripter@microsoft.com<\/a>, or post your questions on the <a href=\"http:\/\/bit.ly\/scriptingforum\" target=\"_blank\">Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n<p><b>Ed Wilson, Microsoft Scripting Guy<\/b><span style=\"font-size:12px\">&nbsp;<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Summary: Guest blogger, Alex Verboon, talks about using Windows PowerShell to troubleshoot delays in Group Policy performance. Microsoft Scripting Guy, Ed Wilson, is here. Today we have a new guest blogger, Alex Verboon. I was reading Alex&rsquo;s blog page. I liked what he had to say and I invited him to contribute a guest blog [&hellip;]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[532,56,3,61,45],"class_list":["post-788","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-alex-verboon","tag-guest-blogger","tag-scripting-guy","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"<p>Summary: Guest blogger, Alex Verboon, talks about using Windows PowerShell to troubleshoot delays in Group Policy performance. Microsoft Scripting Guy, Ed Wilson, is here. Today we have a new guest blogger, Alex Verboon. I was reading Alex&rsquo;s blog page. I liked what he had to say and I invited him to contribute a guest blog [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=788"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/788\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}