Policy Spy is a tool for viewing and troubleshooting the policy system on System Center Configuration Manager 2007 clients.

Requirements

This tool supports System Center Configuration Manager 2007.

Important
Policy Spy must be run as an administrator.

Syntax

Although Policy Spy is primarily intended for use through its user interface, it does provide limited command-line options to support automation and batch processing.

PolicySpy.exe [/export <ExportFilename> [<computername>]]

Option Description

/export

This option silently exports the policy of the local or remote computer. <ExportFilename> is the file name that is used to save the XML exported policy. If the <computername> option is provided, Policy Spy exports the policy of that computer, instead of the local computer.

Note
This command-line option does not provide a way to specify user credentials. If you must use alternative credentials to access a remote computer, you should use the runas command to open a new command prompt with the required security credentials.

Menu Items

There are two menu options that you can select: Tools and Edit.

The following table describes the options available when selecting Tools from the menu.

Tools Menu Option Description

Open Remote

Connects to the policy on a remote computer. Use the Connect dialog box to retrieve the name of the remote computer system and optional user credentials. If the connection fails, error information is displayed in the Client Info pane. If the connection fails again, you can try connecting by selecting Refresh on the Edit menu or by pressing F5.

Open File

Opens a policy export file (.xml) created by the Export Policy option. The exported policy is viewed exactly the same as a live policy except some features that only apply when connected to an actual client are disabled.

Request Machine Assignments

Triggers a request for machine policy assignments on the target computer system. This feature is disabled when viewing exported policy.

Evaluate Machine Policy

Triggers a machine policy evaluation on the target computer system. This feature is disabled when viewing an exported policy.

Request User Assignments

Triggers a request for user policy assignments for the logged-on user. This feature is only available when viewing a policy on the local computer.

Evaluate User Policy

Triggers a user policy evaluation for the logged-on user. This feature is only available when viewing a policy on the local computer.

Reset Policy

Removes all non-default policies and resets the policy cookies for the site. It then triggers a request for machine policy assignments. This feature is disabled when viewing an exported policy.

Export Policy

Exports the target computer system's policy to an XML-format export file. This file can be viewed on any computer by selecting Open File on the Tools menu and opening the export file. This feature is disabled when viewing an exported policy.

Exit

Closes Policy Spy.

The following table describes the options available when selecting Edit from the menu.

Edit Menu Option Description

Delete

Deletes the instance selected in the Results pane. This is only supported for policy instances. An error message is displayed if you try to delete anything other than policy instances. This feature is disabled when viewing an exported policy.

Refresh

Refreshes all results to ensure that you are viewing the latest information. All tree nodes that are expanded before refreshing are automatically expanded afterward. If Policy Spy has not successfully connected to the target computer's policy, Policy Spy tries to connect again. This feature is disabled when viewing an exported policy.

Clear Events

Clears all items from the Events tab.

Results Pane

The results pane displays different views of the policy system on the target computer. These views are accessed by clicking on one of the following four tabs: Actual, Requested, Default, and Events.

Actual tab

This tab displays the current policy of the client. The current policy determines a client's behavior and the behavior of its client agents, such as software distribution and inventory. Results are displayed in a tree format with a root node for the Machine namespace and each user-specific namespace. Expanding a namespace node displays a list of classes. You can expand a class to display a list of its instances. The class list contains only classes that have instances.

Requested tab

This tab displays the policy assignments that were retrieved from the client's assigned site. Results are displayed in tree format with a root node for the Machine namespace and each user-specific namespace. Expanding a namespace node displays the Configuration and Settings nodes.

  • Configuration node - Expanding the Configuration node displays a list of configuration classes, derived from CCM_Policy_Config, that includes policy objects, assignments, and others.

  • Settings node - Expanding the Settings node displays all active settings generated by policies. Settings are displayed under the Configuration node.

Note
Multiple instances can exist with the same names because these settings have not been merged into a final resultant set. Policy Spy displays instances under this node by using the RealKey properties instead of their true policy keys so they can be easily correlated to the resultant set displayed on the Actual tab.

Default tab

This tab displays the same information that the Requested tab does, except that the Default tab also displays the contents of the DefaultMachine and DefaultUser namespaces.

Events tab

This tab displays policy agent events as they happen. The view creates a WMI event subscription for all events derived from CCM_PolicyAgent_Event. The view shows a maximum of 200 events and removes the oldest events from the top of the list, as required. If the last item in the list is selected, the list automatically scrolls down as new events are added. Otherwise, the view maintains its current position and you must scroll down or press the End key to view new events. This view is always empty when viewing an exported policy.

Client Info Pane

The Client Info pane displays a list of properties for the target computer. The following properties are displayed:

Property Description

Name

The computer name of the Configuration Manager client.

ID

The unique identifier of the client as assigned by Configuration Manager.

Version

The version number of the Configuration Manager client.

Site

The name of the Configuration Manager client's assigned site, if the client is assigned to a Configuration Manager site.

Assigned MP

The name of the Configuration Manager client's assigned management point.

Resident MP

The name of the Configuration Manager client's resident, or local, management point.

Proxy MP

The name of the Configuration Manager client's proxy management point.

Proxy State

The state of the Configuration Manager client's proxy management point, such as Active or Pending.

Details Pane

The Details pane displays detailed information about the current selection. If no selection is active, it displays information about Policy Spy itself, including the version and copyright information. Otherwise, it displays a Manage Object Format (MOF) representation of the selected item.

Policy Spy uses its own MOF-generation routine to generate a more user-friendly HTML display than the plain-text MOF generated by WMI. This allows Policy Spy to add the following features to make the MOF more legible:

  • Syntax highlighting.

  • Indented subobjects and arrays.

  • Properties are arranged into system, inherited, and local groups. The system and inherited groups are collapsed by default, so that you can immediately see which properties the instance actually uses.

  • The use of Copy MOF to clipboard to copy plain-text MOF to the Windows clipboard. This is useful for pasting MOF into other applications by directly calling the MofComp tool.

For instances of Policy objects derived from CCM_Policy_Policy, the details pane displays the policy body below the MOF that displays. If the body has not been downloaded by the client, Policy Spy displays a hyperlink so you can download the policy body directly from the client's management point. Clicking the link causes Policy Spy to send an HTTP query to the management point. If the policy body download succeeds, the hyperlink is replaced with the contents of the reply. Otherwise, the display is updated indicating that the request failed.

See Also