Trace file locations:  Client: %LocalAppData%\Microsoft\AGPM\agpm.log  Server: %CommonAppData%\Microsoft\AGPM\agpmserv.log Additional considerations  You must be able to edit and deploy a GPO to confige AGPM logging and tracing. See and for additional detail. Additional references  Managing the AGPM Service The AGPM Service is a Windows service that acts as a security proxy, managing client access to Group Policy objects (GPOs) in the archive and production environment. It enforces Advanced Group Policy Management (AGPM) delegation and provides an enhanced level of security. The AGPM Service is hosted on the server on which the Microsoft Advanced Group Policy Management - Server is installed. Caution Do not modify settings for the AGPM Service through Administrative and Services in the operating system. Doing so can prevent the AGPM Service from starting.     Start and Stop the AGPM Service The AGPM Service is a Windows service that acts as a security managing client access to Group Policy objects (GPOs) in the archive and production environment. Important Stopping or disabling the AGPM Service will prevent AGPM clients from performing any operations (such as listing or editing GPOs) through the server. A user account with access to the AGPM Server (the computer on the AGPM Service is installed) is required to complete this procedure. To start or stop the AGPM Service 1. On the computer on which Microsoft Advanced Group Policy Management - Server (and therefore the AGPM Service) is installed, click Start, click Control Panel, click Administrative Tools, and then click Services.
To create a new GPO with change control managed through AGPM 1. In the Policy Management Console tree, click Change Control in the forest and domain in which you want to manage GPOs. 2. Right-click the Change Control node, and then click New Controlled GPO. 3. Unless you have special permission to create GPOs, you must submit a request for creation. In the New Controlled GPO dialog box: a. To receive a copy of the request, your e-mail address in the Cc field. b. Type a name for the new GPO. c. Optional: Type a comment for the new GPO. d. To deploy the new GPO to the production environment immediately upon approval, click Create live. To create the new GPO offline without immediately deploying it upon approval, click Create offline. e. Select the GPO template to use as a starting point for the new GPO. f. Click Submit. 4. When the Progress window indicates that overall progress is complete, Close. The new GPO is displayed in the list of GPOs on the Pending tab. When an Approver has approved your request, the GPO will be moved to the Controlled tab. Additional considerations  By default, you must be an Editor or a Reviewer to perform this procedure. Specifically, you must have List Contents permission for the domain.  To withdraw your request before it has been approved, click the Pending tab. Right-click the GPO, then click Withdraw. The GPO will be destroyed. Additional references  Import a GPO from Production If changes are made to a controlled Group Policy object (GPO) outside of Advanced Group Policy Management (AGPM), you can import a copy of the GPO from the production environment and save it to the archive to bring the archive and the production environment to a consistent state. (To import an uncontrolled GPO, control the GPO. See .) A user account with the Editor, Approver, or AGPM Administrator (Full Control) role or necessary permissions in Advanced Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic. To import a GPO from the production environment 1. In the Group Policy Management Console tree, click Change Control in the forest and domain in which you want to manage GPOs.