WinPolicies - Policy Spy

 Winpolicies

Winpolicies allows you to keep track of what policies are being applied to your user account and machine account. It also allows for trouble shooting group policy problems, by allowing you to see what policies are applied after making changes to the Active Directory, edit registry setting settings for logging, view group policy information stored in the registry.


Notify when policies are applied

 Check this section to have a dialog box be displayed when a new policy, either a user policy or machine policy is applied.


Save Current Output to File

 Choose this option to save all the text in the window to a text file. You will get to choose the file name through the Common File Save Dialog. See also New Ouput to File.


Hide in Systray

 If you choose this Winpolicies will hide in the Systray and will display Balloons when new policies are applied. If Notify when policies are applied you will recieve those as well. While it is hidden you can use its context menu to access a subset of its features. See Context Menu.


Clear All Entries

 Choose this option to erase all data displayed in the window. No warning is given that the data will be lost.


Change Font

 Choose this option to display the Choose Font Common Dialog. Changes are save between sessions.


Set Font To Courier

 This option allows an easy way to set to the font to Fixed Pitch 10 point Courier.


Exit

 Exits WinPolicies.


Machine_Police (Enforced)

 This option forces the machine section of your policy to be refresh using either SECEDIT.EXE or GPUPDATE.EXE, depending on the version of Windows you are running.


User_Police (Enforced)

 This option forces the user section of your policy to be refresh using either SECEDIT.EXE or GPUPDATE.EXE, depending on the version of Windows you are running.


User Policy (NOT Enforced)

 This option refreshed the user selection of your policy, but only applies new changes.


Edit Group Policies

 This selection alows you to edit the group policies that are being applied to your account.
If alternate credentials are required choose the radio button before double clicking on the policy you wish to edit.


Refresh User/Computer DN

 This selection refreshes the DN of the user and computer account that are used for the Group Policy applied lists.
NOTE: The changes are not immediately visiible after changing the accounts in the domain.


Verify All Polices (Lengthy)

 This option will perfom multiple tests on all the DCs in a domain.
Current tests are:
Gets DC List:
Checks for the existence of the server.
Check for the existence of the SysVol share.


Open Event Viewer

 Opens the event viewer. Group policy is saved to the application log when verbose logging is enabled.
The system log will also contain errors that may effect Group Policy application.


Print GPO Information (When Cycled)

 This is the information shown when this option is checked.
Policy Display Name: Default Domain Policy
  Attrributes:
     Options: 2
          Do not override the settings in this GPO with settings in a subsequent GPO.
     Version: 131074
         Computer Version: 2
         User Version    : 2
     DSPath: LDAP://CN=User,CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=reeftank,DC=com
     FileSysPath: \\reeftank.com\sysvol\reeftank.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\User
     GPOName: {31B2F340-016D-11D2-945F-00C04FB984F9}
     Extensions:
       Folder Redirection handled these Snapins:
          {88E729D6-BDC1-11D1-BD2A-00C04FB9603F}
       Folder Redirection handled these Snapins:
          {3060E8CE-7020-11D2-842D-00C04FA372D4}
     lParam: (null)
     lParam2: (null)
     Link: LDAP://DC=reeftank,DC=com
     The GPO is linked to a domain.


Log New Output to File

 This option saves all new output to a text file that you chose.


User

 This selection will show you what policies are currently being applied to your user account.
NOTE: Your logon token is passed to the GPO Engine so that only policies that are applied to you are reported.


Computer

 This selection will show you what policies are currently being applied to your computer account.


Dump GPO Registry Entries

 Displays the Group Policy Refresh data stored in the registry.
Dumping HKEY_LOCAL_MACHINE Group Policy Registry Keys:
     GroupPolicyRefreshTimeDC Not Found Default.......................5 minutes
     GroupPolicyRefreshTimeOffsetDC Not Found Default.....................0 minutes
     GroupPolicyRefreshTimeOffset.....................................0 minutes
     GroupPolicyRefreshTime.............................................5 minutes
Dumping HKEY_CURRENT_USER Group Policy Registry Keys:
     GroupPolicyRefreshTime Not Found Default.........................90 minutes
     GroupPolicyRefreshTimeOffset Not Found Default...................30 minutes


Dump GP Extension Keys

 This option lists all the possible DLLs that tcan process policies.

Dumping the keys at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions
{08925A79-8E14-483B-BFB3-3351CC293B51}
     Default (Name): Jlambert
     DllName: jlambert.dll
     MaxNoGPOListChangesInterval: 0
     Status: 0
     LastPolicyTime: 11193075
     NoSlowLink: 1
     New Value #1: jlambert.dll
     PrevSlowLink: 0
     NoGPOListChanges: 0
     GenerateGroupPolicy: ProcessGroupPolicy

{25537BA6-77A8-11D2-9B6C-0000F8080861}
     Default (Name): Folder Redirection
     ProcessGroupPolicy: ProcessGroupPolicy
     DllName: fdeploy.dll
     NoMachinePolicy: 1
     NoSlowLink: 1
     NoBackgroundPolicy: 1
     PerUserLocalSettings: 1
     NoGPOListChanges: 0

{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
     Default (Name): Registry Settings
     Status: 0
     LastPolicyTime: 11204184
     PrevSlowLink: 0

{3610eda5-77ef-11d2-8dc5-00c04fa31a66}
     Default (Name): Microsoft Disk Quota
     NoMachinePolicy: 0
     NoUserPolicy: 1
     NoSlowLink: 1
     NoBackgroundPolicy: 1
     NoGPOListChanges: 1
     PerUserLocalSettings: 0
     RequiresSuccessfulRegistry: 1
     EnableAsynchronousProcessing: 0
     DllName: dskquota.dll
     ProcessGroupPolicy: ProcessGroupPolicy

{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
     Default (Name): Scripts
     ProcessGroupPolicy: ProcessScriptsGroupPolicy
     DllName: gptext.dll
     NoSlowLink: 1
     NoGPOListChanges: 1
     NotifyLinkTransition: 1

{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
     Default (Name): Security
     NoUserPolicy: 0
     NoGPOListChanges: 1
     EnableAsynchronousProcessing: 1
     MaxNoGPOListChangesInterval: 1
     Status: 0
     LastPolicyTime: 11217251
     PrevSlowLink: 0
     ProcessGroupPolicy: SceProcessSecurityPolicyGPO
     DllName: scecli.dll

{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}
     ProcessGroupPolicy: ProcessGroupPolicy
     Default (Name): Internet Explorer Branding
     NoSlowLink: 1
     NoBackgroundPolicy: 0
     NoGPOListChanges: 0
     NoMachinePolicy: 0
     DllName: iedkcs32.dll

{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
     ProcessGroupPolicy: SceProcessEFSRecoveryGPO
     DllName: scecli.dll
     Default (Name): EFS recovery
     NoUserPolicy: 1
     NoGPOListChanges: 1
     RequireSuccessfulRegistry: 1
     Status: 0
     LastPolicyTime: 11216321
     PrevSlowLink: 0

{c6dc5466-785a-11d2-84d0-00c04fb169f7}
     Default (Name): Application Management
     DllName: appmgmts.dll
     ProcessGroupPolicy: ProcessGroupPolicyObjects
     NoBackgroundPolicy: 1
     RequiresSucessfulRegistry: 0
     NoSlowLink: 1
     PerUserLocalSettings: 1
     NoUserPolicy: 1

{e437bc1c-aa7d-11d2-a382-00c04f991e27}
     Default (Name): IP Security
     ProcessGroupPolicy: ProcessIPSECPolicy
     DllName: gptext.dll
     NoUserPolicy: 1
     NoGPOListChanges: 1


Dump Machine History

 This option dumps the history of applied policies. They are stored here so they can be removed.
Dumping the keys at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions
{08925A79-8E14-483B-BFB3-3351CC293B51}
     Default (Name): Jlambert
     DllName: jlambert.dll
     MaxNoGPOListChangesInterval: 0
     Status: 0
     LastPolicyTime: 11193075
     NoSlowLink: 1
     New Value #1: jlambert.dll
     PrevSlowLink: 0
     NoGPOListChanges: 0
     GenerateGroupPolicy: ProcessGroupPolicy

{25537BA6-77A8-11D2-9B6C-0000F8080861}
     Default (Name): Folder Redirection
     ProcessGroupPolicy: ProcessGroupPolicy
     DllName: fdeploy.dll
     NoMachinePolicy: 1
     NoSlowLink: 1
     NoBackgroundPolicy: 1
     PerUserLocalSettings: 1
     NoGPOListChanges: 0

{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
     Default (Name): Registry Settings
     Status: 0
     LastPolicyTime: 11204184
     PrevSlowLink: 0

{3610eda5-77ef-11d2-8dc5-00c04fa31a66}
     Default (Name): Microsoft Disk Quota
     NoMachinePolicy: 0
     NoUserPolicy: 1
     NoSlowLink: 1
     NoBackgroundPolicy: 1
     NoGPOListChanges: 1
     PerUserLocalSettings: 0
     RequiresSuccessfulRegistry: 1
     EnableAsynchronousProcessing: 0
     DllName: dskquota.dll
     ProcessGroupPolicy: ProcessGroupPolicy

{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
     Default (Name): Scripts
     ProcessGroupPolicy: ProcessScriptsGroupPolicy
     DllName: gptext.dll
     NoSlowLink: 1
     NoGPOListChanges: 1
     NotifyLinkTransition: 1

{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
     Default (Name): Security
     NoUserPolicy: 0
     NoGPOListChanges: 1
     EnableAsynchronousProcessing: 1
     MaxNoGPOListChangesInterval: 1
     Status: 0
     LastPolicyTime: 11217251
     PrevSlowLink: 0
     ProcessGroupPolicy: SceProcessSecurityPolicyGPO
     DllName: scecli.dll

{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}
     ProcessGroupPolicy: ProcessGroupPolicy
     Default (Name): Internet Explorer Branding
     NoSlowLink: 1
     NoBackgroundPolicy: 0
     NoGPOListChanges: 0
     NoMachinePolicy: 0
     DllName: iedkcs32.dll

{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
     ProcessGroupPolicy: SceProcessEFSRecoveryGPO
     DllName: scecli.dll
     Default (Name): EFS recovery
     NoUserPolicy: 1
     NoGPOListChanges: 1
     RequireSuccessfulRegistry: 1
     Status: 0
     LastPolicyTime: 11216321
     PrevSlowLink: 0

{c6dc5466-785a-11d2-84d0-00c04fb169f7}
     Default (Name): Application Management
     DllName: appmgmts.dll
     ProcessGroupPolicy: ProcessGroupPolicyObjects
     NoBackgroundPolicy: 1
     RequiresSucessfulRegistry: 0
     NoSlowLink: 1
     PerUserLocalSettings: 1
     NoUserPolicy: 1

{e437bc1c-aa7d-11d2-a382-00c04f991e27}
     Default (Name): IP Security
     ProcessGroupPolicy: ProcessIPSECPolicy
     DllName: gptext.dll
     NoUserPolicy: 1
     NoGPOListChanges: 1

Dumping the keys at: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
0
     Options: 0
     Version: 131074
     FileSysPath: C:\WINNT\System32\GroupPolicy\Machine
     DisplayName: Local Group Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]
     Link: Local
     GPOName: Local Group Policy
     GPOLink: 1
     lParam: 0

1
     Options: 0
     Version: 65537
     DSPath: LDAP://CN=Machine,CN={1310A75E-337C-4074-86C7-B492370B0659},CN=Policies,CN=System,DC=reeftank,DC=com
     FileSysPath: \\reeftank.com\SysVol\reeftank.com\Policies\{1310A75E-337C-4074-86C7-B492370B0659}\Machine
     DisplayName: Domain Policy 2
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957D-509E-11D1-A7CC-0000F87571E3}]
     Link: LDAP://DC=reeftank,DC=com
     GPOName: {1310A75E-337C-4074-86C7-B492370B0659}
     GPOLink: 3
     lParam: 0

2
     Options: 0
     Version: 327685
     DSPath: LDAP://CN=Machine,CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=reeftank,DC=com
     FileSysPath: \\reeftank.com\sysvol\reeftank.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine
     DisplayName: Default Domain Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]
     Link: LDAP://DC=reeftank,DC=com
     GPOName: {31B2F340-016D-11D2-945F-00C04FB984F9}
     GPOLink: 3
     lParam: 0

{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
0
     Options: 2
     Version: 327685
     DSPath: LDAP://CN=Machine,CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=reeftank,DC=com
     FileSysPath: \\REEFTANK.COM\SYSVOL\REEFTANK.COM\POLICIES\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE
     DisplayName: Default Domain Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]
     Link: LDAP://DC=reeftank,DC=com
     GPOName: {31B2F340-016D-11D2-945F-00C04FB984F9}
     GPOLink: 3
     lParam: 0

{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}
0
     Options: 0
     Version: 131074
     FileSysPath: C:\WINNT\System32\GroupPolicy\Machine
     DisplayName: Local Group Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]
     Link: Local
     GPOName: Local Group Policy
     GPOLink: 1
     lParam: 0

1
     Options: 2
     Version: 327685
     DSPath: LDAP://CN=Machine,CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=reeftank,DC=com
     FileSysPath: \\REEFTANK.COM\SYSVOL\REEFTANK.COM\POLICIES\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE
     DisplayName: Default Domain Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}][{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}{53D6AB1B-2488-11D1-A28C-00C04FB94F17}]
     Link: LDAP://DC=reeftank,DC=com
     GPOName: {31B2F340-016D-11D2-945F-00C04FB984F9}
     GPOLink: 3
     lParam: 0

Dumping the keys at: HKEY_CURRENT_USERS\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
0
     Options: 0
     Version: 458759
     FileSysPath: C:\WINNT\System32\GroupPolicy\User
     DisplayName: Local Group Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}][{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
     Link: Local
     GPOName: Local Group Policy
     GPOLink: 1
     lParam: 0

1
     Options: 0
     Version: 131074
     DSPath: LDAP://CN=User,CN={84757F3E-0F51-4B20-A6BF-A7ACB89098F0},CN=Policies,CN=System,DC=reeftank,DC=com
     FileSysPath: \\reeftank.com\SysVol\reeftank.com\Policies\{84757F3E-0F51-4B20-A6BF-A7ACB89098F0}\User
     DisplayName: This is a test of a reallyreallyreallyreallyreallyreallyreallyreallyreallyreallyreallyreally long policy name
     Extensions: [{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}]
     Link: LDAP://DC=reeftank,DC=com
     GPOName: {84757F3E-0F51-4B20-A6BF-A7ACB89098F0}
     GPOLink: 3
     lParam: 0

{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
0
     Options: 0
     Version: 458759
     FileSysPath: C:\WINNT\System32\GroupPolicy\User
     DisplayName: Local Group Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}][{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
     Link: Local
     GPOName: Local Group Policy
     GPOLink: 1
     lParam: 0


Dump User History

 This option dumps the history of applied policies. They are stored here so they can be removed.

Dumping the keys at: HKEY_CURRENT_USERS\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
{35378EAC-683F-11D2-A89A-00C04FBBCFA2}
0
     Options: 0
     Version: 458759
     FileSysPath: C:\WINNT\System32\GroupPolicy\User
     DisplayName: Local Group Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}][{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
     Link: Local
     GPOName: Local Group Policy
     GPOLink: 1
     lParam: 0

1
     Options: 0
     Version: 131074
     DSPath: LDAP://CN=User,CN={84757F3E-0F51-4B20-A6BF-A7ACB89098F0},CN=Policies,CN=System,DC=reeftank,DC=com
     FileSysPath: \\reeftank.com\SysVol\reeftank.com\Policies\{84757F3E-0F51-4B20-A6BF-A7ACB89098F0}\User
     DisplayName: This is a test of a reallyreallyreallyreallyreallyreallyreallyreallyreallyreallyreallyreally long policy name
     Extensions: [{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}]
     Link: LDAP://DC=reeftank,DC=com
     GPOName: {84757F3E-0F51-4B20-A6BF-A7ACB89098F0}
     GPOLink: 3
     lParam: 0

{42B5FAAE-6536-11d2-AE5A-0000F87571E3}
0
     Options: 0
     Version: 458759
     FileSysPath: C:\WINNT\System32\GroupPolicy\User
     DisplayName: Local Group Policy
     Extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}][{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
     Link: Local
     GPOName: Local Group Policy
     GPOLink: 1
     lParam: 0


Get/Set Registry Logging Values

 This option will display a dialog box that will show you the current Group Policy registry logging setting and allow you to change them.
If you are not an administrator it will prompt you for credentials.


Group Policy Help

 This option will display the Group Policy Help file (GP.CHM.). If the file is not found in the path on your computer this option will be grayed out.


About WinPolicies

 This option displays WinPolicies About box. This will show the version and the most recent time the files were changed.


Help

 Displays this file.


Alternate Credentials

 Most option will allow you to choose an alternate set of credentials if an access denied error occurs.
NOTE: This dialog allows you to save your credentials to the registry for later use. The user and domain fields are plaintext and the password is encrypted. Use this option with caution, while the encryption algorithym obfuscates the password very well, no guarantees are given. It is only offered for convieninence.

This is a typical credentials section of the registry.
Username=administrator
Domain=domain
pwdEncrypted=±Q€eAAáY


WinPolicies Use of the Registry

 WinPolicies utilizes HKCU\Software\WinPolicies to store some of its information.
Some of the information it currently stores is:
The set of alternate credentials to use (if you chose to save it)
If you changed the font the font information is saved and reloaded for next time.
This is the information currently stored there:

[HKEY_CURRENT_USER\Software\Winpolicies]
"Username"="administrator"
"Domain"="reeftank"
"pwdEncrypted"="±Q€eAAáY"

[HKEY_CURRENT_USER\Software\Winpolicies\Font]
"lfHeight"=dword:fffffff3
"lfWidth"=dword:00000000
"lfEscapement"=dword:00000000
"lfOrientation"=dword:00000000
"lfWeight"=dword:00000190
"lfItalic"=hex(4):00
"lfUnderline"=hex(4):00
"lfStrikeOut"=hex(4):00
"lfCharSet"=hex(4):00
"lfOutPrecision"=hex(4):01
"lfClipPrecision"=hex(4):02
"lfQuality"=hex(4):01
"lfPitchAndFamily"=hex(4):31
"lfFaceName"="Courier"


Command Line Options

 /systray - Immediately hides WinPolicies in the systray when starting /fulltracing - starts Winpolicies with full tracing to catch initialization errors. /help - show command line options /? - shows command line options