Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. debug
  4. usermode
  5. gpsvc.log
LogRisk: Safe

gpsvc.log C:\Windows\debug\usermode\gpsvc.log

gpsvc.log: detailed debug log of the Group Policy client, absent until the GPSvcDebugLevel value is created in the Registry.

Updated on By AltF4 Formation

What it’s for

gpsvc.log is the finest trace of Group Policy processing, with the detail of every client-side extension (Registry, scripts, security, preferences). Use it when the Group Policy Operational log does not explain why a setting is not applied. It replaces userenv.log, which was used before Windows Vista.

The file does not exist by default. It appears once the DWORD value GPSvcDebugLevel = 0x30002 is created under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics (create the Diagnostics key if it is missing). It takes effect at the next policy processing, for example after gpupdate /force.

What it contains

Lines carry the GPSVC(pid.tid) prefix and a precise time, then the function and the message: domain controller discovery, GPT.INI read, list of accepted or filtered GPOs, processing of each extension, Win32 error codes.

Risks and best practices

  • Turn it on only long enough to reproduce the problem, then delete the GPSvcDebugLevel value: verbose logging slows processing and makes the file grow.
  • The log mixes computer and user processing. Note the time before running gpupdate /force so you can find your run.
  • It names GPOs, accounts and shares: review it before sending it to a third party.

Useful commands

Fenêtre de terminal
:: As administrator: turn on verbose logging
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /t REG_DWORD /d 0x30002 /f


:: Replay the processing
gpupdate /force


:: As administrator: turn it off afterwards
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /f
Fenêtre de terminal
# End of the log and error lines
Get-Content "$env:windir\debug\usermode\gpsvc.log" -Tail 80
Select-String -Path "$env:windir\debug\usermode\gpsvc.log" -Pattern 'error|failed|0x8007' | Select-Object -Last 30

Format

Text file. Each line starts with GPSVC(process ID.thread ID) followed by the time (hh:mm:ss:ms), then the function and the message.

Rotation and archiving

Microsoft documents nothing about rotation for this file. Copy it before turning logging off if you need to analyze it later.

How to read it

Find the time of your gpupdate, then follow the processing: domain controller found, GPT.INI read, GPOs listed, extensions run. Go back to the first error line and translate the code (net helpmsg <decimal number>). A failure to read GPT.INI points at SYSVOL, a filtered GPO at its permissions or WMI filter.

Report a mistake