What application log events should Group Policy Guardian generate? (NETIQKB50595)

goal
What application log events should Group Policy Guardian generate?

goal
How can I tell if Group Policy Guardian is correctly reporting group policy events?

fact
NetIQ Group Policy Guardian 2.0

fix

Complete the following tasks to verify the basic functionality of Group Policy Guardian (GPG):

1. On the domain controller, use the Active Directory Users and Computers tool to create a new, unlinked group policy object (GPO).
2. Using GPEdit, change the minimum password length in the new, unlinked GPO.
3. On the domain controller where you changed the GPO, check the Security Event Log for events 560, 565, or 566. If none appear, check that the domain controller auditing settings are correct.
4. On the GPG Server computer:
• Check the Application Log for event 9999. Event 9999 is an internal event generated by GPG Server and normally indicates that GPG generated report data.
• Check the Application Log for event 8888. Event 8888 is detected by the GPG Connector and contains a URL link to the report of what information changed and triggered a GPG event.
5. Check reports by running a general report with default query criteria to check for the GPO change you created.
6. Open your monitoring product console and look for GPG Events. The event message detail should have a report URL linked to the change info for the GPO change that you created.

note
For more information on troubleshooting Group Policy Guardian, see the NetIQ Knowledge Base article NETIQKB33397: "GPG is not generating alerts." https://www.netiq.com/kb/esupport/consumer/esupport.asp?id=NETIQKB33397.

Formerly known as NETIQKB50595