Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-GroupPolicy%4Operational.evtx
LogRisk: Caution

Microsoft-Windows-GroupPolicy%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Microsoft-Windows-GroupPolicy%4Operational.evtx: the Group Policy client's Operational log, with the detail of each processing cycle and each extension.

Updated on By AltF4 Formation

What it’s for

Channel Microsoft-Windows-GroupPolicy/Operational. It follows a computer’s policy processing step by step: domain controller discovery, GPO list, then each client-side extension. It is the first place to look when a GPO does not apply, before turning on gpsvc.log. In the file name, %4 stands for the / of the channel name.

What it contains

  • Event IDs 4016 and 5016 bracket the processing of a client-side extension (Registry, scripts, security…), with the duration in the closing message.
  • Event ID 5312 shows the list of GPOs applicable to that processing.
  • Errors reading SYSVOL or the network mostly surface in the System log (Group Policy source): ID 1058 if GPT.INI is unreadable, 1129 without a connection to a domain controller.
  • Each processing shares a correlation identifier (ActivityID) that lets you follow one complete cycle.

Risks and best practices

  • The log is circular by default: collect it soon after a logon problem, or a refresh cycle overwrites it.
  • Filter by ActivityID rather than reading everything: a computer runs several cycles a day (startup, logon, refresh about every 90 minutes).
  • Export before any cleanup with wevtutil epl.

Useful commands

Fenêtre de terminal
# Last 50 events
Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 50


# Extension start and end over the last two hours
Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-GroupPolicy/Operational'; Id=4016,5016; StartTime=(Get-Date).AddHours(-2) }


# Group Policy client errors and warnings in the System log
Get-WinEvent -FilterHashtable @{ LogName='System'; ProviderName='Microsoft-Windows-GroupPolicy'; Level=2,3 } -MaxEvents 30
Fenêtre de terminal
:: As administrator: export the log
wevtutil epl Microsoft-Windows-GroupPolicy/Operational C:\Temp\gpo-operational.evtx

Format

Binary .evtx file of the Windows event log, read with Event Viewer or Get-WinEvent.

Rotation and archiving

“Applications and Services Logs” channel: the oldest events are overwritten once the maximum size is reached. Check size and mode with wevtutil gl Microsoft-Windows-GroupPolicy/Operational, and archive with wevtutil epl.

How to read it

In Event Viewer, open Applications and Services Logs, Microsoft, Windows, GroupPolicy, Operational. Sort by time, pick the cycle you want by its ActivityID (Details tab), then look for the first failing extension or the GPO missing from the list. Cross-check with gpresult /h and the System log.

Report a mistake