Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. debug
  4. usermode
FolderRisk: Caution

usermode C:\Windows\debug\usermode

Folder for user-mode debug logs, notably Group Policy processing logs (gpsvc.log, userenv.log) when enabled.

Updated on By AltF4 Formation

What it’s for

This folder holds debug logs from components that run in user mode, mostly those of the Group Policy client. It does not exist until verbose logging has been turned on.

What it contains

  • gpsvc.log: detailed log of the Group Policy client service (gpsvc). It only appears if you enable its debug level in the registry, the GPSvcDebugLevel value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics, for example 0x30002. This is the one to read on current versions.
  • userenv.log: old log of profile and policy processing, inherited from versions before Windows Vista (see its page).
  • Possibly the logs of other components enabled for a diagnosis.

Risks and best practices

  • Nothing essential lives here, so you can delete everything. But turn verbose logging off as soon as the diagnosis is done: gpsvc.log grows fast and slows policy processing.
  • The logs name users, computers and policies: review them before sharing.
  • Before enabling this debug level, check the Group Policy Operational log: it is enough in most cases.

Useful commands

Fenêtre de terminal
# Turn on verbose Group Policy client logging (as administrator)
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /t REG_DWORD /d 0x30002 /f


# Turn it off again once the diagnosis is done
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /f


# Group Policy operational log
Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 30 |
    Select-Object TimeCreated, Id, Message


# Policy application result
gpresult /r

Folder contents

Logs 2

Report a mistake