[gptalk] Re: Error on Vista Event Log 'Custom View' for GPOs with GPPES (GPOPrefs) Installed - Suggestions Anyone?
- From: "Cruz, Jerome L" <jerome.l.cruz@xxxxxxxxxx>
- To: "gptalk@xxxxxxxxxxxxx" <gptalk@xxxxxxxxxxxxx>
- Date: Thu, 17 Apr 2008 10:27:49 -0700
Any takers?
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Cruz, Jerome L
Sent: Tuesday, April 15, 2008 1:34 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Error on Vista Event Log 'Custom View' for GPOs with GPPES
(GPOPrefs) Installed - Suggestions Anyone?
After installing GPPEs on a Vista device, I wanted to update a Custom View to
display Event Log entries for all GPO activities including those from all the
new sources. However, I think I've run into a limitation of the interface (or
perhaps the language). Any time I add the 22nd source, the interface fails. I
can remove any 'one' entry anywhere in the list and get the custom view created
correctly.
As a work-around, I can create two separate custom views, but...I'd really like
them in one view.
Can anyone suggest `a work-around', perhaps with a manually entered filter?
Perhaps someone can come up with a filter that uses a differently ordered XML
syntax.
Note: The source doesn't have to be related to GPOs... just any one source
more....and Ka-Blam!
The error displayed is:
Query Error
! One or more logs in the query have errors
Log Error
Application The specified query is invalid
System The specified query is invalid
The events displayed are partial results.
OK
========
The custom view is "By Source" and after adding the GPPEs, there are quite a
few new entries (e.g. Group Policy Client, Group Policy Data Sources, Group
Policy Drive Maps, etc.). There is no sub-filtering and All Event IDs are used.
The query listed below works fine at 21 sources...add anything else and BLAM!
The XML version is:
<QueryList>
<Query Id="0" Path="Application">
<Select
Path="Application">*[System[Provider[@Name='Microsoft-Windows-Folder
Redirection' or @Name='Group Policy' or @Name='Group Policy Applications' or
@Name='Group Policy Client' or @Name='Group Policy Data Sources' or
@Name='Group Policy Device Settings' or @Name='Group Policy Drive Maps' or
@Name='Group Policy Environment' or @Name='Group Policy Files' or @Name='Group
Policy Folder Options' or @Name='Group Policy Folders' or @Name='Group POlicy
HTML View Extension' or @Name='Group Policy Ini Files' or @Name='Group Policy
Internet Settings' or @Name='Group Policy Local Users and Groups' or
@Name='Group Policy Mail Profiles' or @Name='Group Policy Registry' or
@Name='Microsoft-Windows-SoftwareRestrictionPolicies' or
@Name='Microsoft-Windows-User Profiles General' or
@Name='Microsoft-Windows-User Profiles Service' or @Name='Windows Script Host']
and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]</Select>
<Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Folder
Redirection' or @Name='Group Policy' or @Name='Group Policy Applications' or
@Name='Group Policy Client' or @Name='Group Policy Data Sources' or
@Name='Group Policy Device Settings' or @Name='Group Policy Drive Maps' or
@Name='Group Policy Environment' or @Name='Group Policy Files' or @Name='Group
Policy Folder Options' or @Name='Group Policy Folders' or @Name='Group POlicy
HTML View Extension' or @Name='Group Policy Ini Files' or @Name='Group Policy
Internet Settings' or @Name='Group Policy Local Users and Groups' or
@Name='Group Policy Mail Profiles' or @Name='Group Policy Registry' or
@Name='Microsoft-Windows-SoftwareRestrictionPolicies' or
@Name='Microsoft-Windows-User Profiles General' or
@Name='Microsoft-Windows-User Profiles Service' or @Name='Windows Script Host']
and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]</Select>
</Query>
</QueryList>
Other related posts:
