GPResult is a command-line tool that displays information about the result Group Policy has had on the current computer and logged-on user. You can download this powerful utility from the Microsoft site. It will tell you the OS (pro, member server, DC); build/service pack level: user name and loction in AD; user privileges; domain, site, group membership; computer info (name, location); last time policy applied; domain controller which applied policy; list of policy objects; ip security; scripts applied; ...

If it does not give enough info for debugging Group Policy issues, you can enable verbose Global Policy logging. See rtips30 for the registry hack to enable verbose global policy logging on the workstation.

Its not hard to create a mesh of group policies, maybe I should have said mess. Consider parent and child containers. The important factor between different group policies for parent and child containers is whether one group policy conflicts with the other. If group policies do not conflict with each other, both policy settings will be applied. If there is a conflict between the two policy settings, the policy in the child container will prevail by default. However, if modifications are made to the inheritance rules for group policies so that specific policies are enforced across the network, child policies may be overwritten. The potential of this to get out of hand if you create nested containers and let GPOs get out of hand, can be a major administrative burden. Documenting the scope is critical. Windows 2000 allows you to filter policy settings within an OU by blocking their application to particular computers, users, and security groups. In a complex environment, it can be a guessing game if you are the new kid on the block or you are an admin of an OU layered within other OUs.

According to Microsoft documentation, changes to a Group Policy object made with the Group Policy snap-in are not deferred until an explicit Save is executed but actually take place during the actual edit. This could be the basis of a nice gotcha!

Related Tips:

Troubleshooting Group Policy in Windows 2000

Windows 2000 Group Policy

Implementing Registry-Based Group Policy

A must for support and installations personnel as well as technical savvy users. 1800 pages with a wealth of information on the CD.