[gptalk] Re: Error on Vista Event Log 'Custom View' for GPOs with GPPES (GPOPrefs) Installed - Suggestions Anyone?

  • From: "Darren Mar-Elia" <darren@xxxxxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Thu, 17 Apr 2008 12:07:30 -0700

HI Jerry-

I'll play with this when I get back in town tomorrow. 22 seems like a fairly
arbitrary number to fail on, from a programming perspective. So either it's
a bug or something else is going on. I haven't spent enough time with Vista
views to say off the top of my head but I will take a look. 

 

Darren

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Cruz, Jerome L
Sent: Thursday, April 17, 2008 10:28 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: Error on Vista Event Log 'Custom View' for GPOs with
GPPES (GPOPrefs) Installed - Suggestions Anyone?

 

Any takers?

 

From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On
Behalf Of Cruz, Jerome L
Sent: Tuesday, April 15, 2008 1:34 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Error on Vista Event Log 'Custom View' for GPOs with GPPES
(GPOPrefs) Installed - Suggestions Anyone?

 

After installing GPPEs on a Vista device, I wanted to update a Custom View
to display Event Log entries for all GPO activities including those from all
the new sources. However, I think I've run into a limitation of the
interface (or perhaps the language). Any time I add the 22nd source, the
interface fails. I can remove any 'one' entry anywhere in the list and get
the custom view created correctly.

 

As a work-around, I can create two separate custom views, but.I'd really
like them in one view.

 

Can anyone suggest `a work-around', perhaps with a manually entered filter?
Perhaps someone can come up with a filter that uses a differently ordered
XML syntax.

 

Note: The source doesn't have to be related to GPOs. just any one source
more....and Ka-Blam!

 

The error displayed is:

 

   Query Error

   !  One or more logs in the query have errors

 

   Log            Error

   Application    The specified query is invalid

   System         The specified query is invalid

   

   The events displayed are partial results.

   

                                   OK

 

========

 

The custom view is "By Source" and after adding the GPPEs, there are quite a
few new entries (e.g. Group Policy Client, Group Policy Data Sources, Group
Policy Drive Maps, etc.). There is no sub-filtering and All Event IDs are
used. The query listed below works fine at 21 sources.add anything else and
BLAM!

 

The XML version is:

<QueryList>

  <Query Id="0" Path="Application">

    <Select
Path="Application">*[System[Provider[@Name='Microsoft-Windows-Folder
Redirection' or @Name='Group Policy' or @Name='Group Policy Applications' or
@Name='Group Policy Client' or @Name='Group Policy Data Sources' or
@Name='Group Policy Device Settings' or @Name='Group Policy Drive Maps' or
@Name='Group Policy Environment' or @Name='Group Policy Files' or
@Name='Group Policy Folder Options' or @Name='Group Policy Folders' or
@Name='Group POlicy HTML View Extension' or @Name='Group Policy Ini Files'
or @Name='Group Policy Internet Settings' or @Name='Group Policy Local Users
and Groups' or @Name='Group Policy Mail Profiles' or @Name='Group Policy
Registry' or @Name='Microsoft-Windows-SoftwareRestrictionPolicies' or
@Name='Microsoft-Windows-User Profiles General' or
@Name='Microsoft-Windows-User Profiles Service' or @Name='Windows Script
Host'] and (Level=1  or Level=2 or Level=3 or Level=4 or Level=0 or
Level=5)]]</Select>

    <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-Folder
Redirection' or @Name='Group Policy' or @Name='Group Policy Applications' or
@Name='Group Policy Client' or @Name='Group Policy Data Sources' or
@Name='Group Policy Device Settings' or @Name='Group Policy Drive Maps' or
@Name='Group Policy Environment' or @Name='Group Policy Files' or
@Name='Group Policy Folder Options' or @Name='Group Policy Folders' or
@Name='Group POlicy HTML View Extension' or @Name='Group Policy Ini Files'
or @Name='Group Policy Internet Settings' or @Name='Group Policy Local Users
and Groups' or @Name='Group Policy Mail Profiles' or @Name='Group Policy
Registry' or @Name='Microsoft-Windows-SoftwareRestrictionPolicies' or
@Name='Microsoft-Windows-User Profiles General' or
@Name='Microsoft-Windows-User Profiles Service' or @Name='Windows Script
Host'] and (Level=1  or Level=2 or Level=3 or Level=4 or Level=0 or
Level=5)]]</Select>

  </Query>

</QueryList>

 

Other related posts: