getting accurate GPresult output when executing from a script on a service account

Question

My company has asked me to build some .NET software for them (basically a health check client that sits as a service on each of our computers and reports encrypted data back to the server which then uploads it to SQL which can be used for weekly reports, a web console, etc). The program is basically done - except for the one thing that I thought would be the easiest. Here's what I'm having problems with:

The last piece of information we need is the last time the client checked in with group policy. Should be easy... right? Run gpresult and grab the date and time from that! I wrote the code to do so, and it works perfectly when I run it from my own account. The issue is that this will be executed from a service; meaning it has to run as the "local system" account when it gets deployed. When it does execute as a service from the "local system" account, it errors out because group policy (evidently) doesn't apply to the local system account. I tried limiting the scope to computer, but it still doesn't give me anything.

I also tried trying to find files that gpupdate changes when it checks in so that I could maybe go about it a different way and analyze those files instead (that's what I did for the rest of the programs that we are checking on), but so far I haven't had any luck in finding anything that is consistently changed when the computer runs gpupdate.

Any suggestions on anything I could try? I'm kind of driving myself crazy (short trip), and I've tried searching Google and forums without any results.

Thanks in advance for your help!

Answer 1

I found a partial answer. It seems that GP stores a registry key that tells it if the policy is overdue (default is a 90 minute check-in with a 0-30 minute offset). That is enough to make what I want to do work (granted, I would still love the "verboseness" [can I make up a word?] of having the date, but this works for now).

For anyone looking at this in the future, the key is: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History\PolicyOverdue (DWORD).

For now I'll start using that, but I would still love to hear if anyone has some suggestions about how I might be able to get gpresponse working or another way to get a date for the last time GP updated. :)

Thanks!