- One of the main tools to configure user and system settings in Windows is the Group Policy Objects (GPO).Local (these settings are configured locally on the computer) and domain GPOs (if a computer is joined to the Active Directory domain) can be applied to the computer and its users.
- Summary: Microsoft Scripting Guy, Ed Wilson, talks about using Windows PowerShell to generate and parse a Group Policy Object report. Microsoft Scripting Guy, Ed Wilson, is here. So, I am working on my MCSE: Server Infrastructure certification and having passed the Installing and Configuring Windows Server 2012 exam (70-410).
- GPResult is a command line tool that shows the Resultant Set of Policy (RsoP) information for a user and computer. In other words, it creates a report that displays what group policies objects are applied to a user and computer. If your using group policy in your environment then you definitely should know how to use this tool.
GPResult is a command-line utility for determining the resultant set of policy for a given user and/or computer. In other words, it shows you what Group Policy Objects have been applied and their settings. This is typically one of the first tools I go to when troubleshooting Group Policy from a client once basic connectivity has been confirmed (e.g. Network/DNS). The tool itself is very simple to use and I will run through some common examples below.
RSoP, Resultant Set of Policy, and GPResult are two of those tools you absolutely have to know about if you're using Group Policy in your environment or you'll wish you had known about it sooner. Through the Group Policy Management Console you can see all the settings that a specific GPO will apply to machines.
List GPOs Applied with Summary Data
/r Displays RSOP summary data
This is pretty useful when you simply want to see what GPOs have applied and in what order. It will also display summary data, such as last time group policy was applied, which Domain Controller it was applied from, the site, security groups and if the slow link threshold has been activated. If you are unsure if a GPO has been applied, this is a quick way of checking.
Here we see that 4 GPOs have applied to the Computer settings portion.
If you don't want to view both Computer and Users settings in the output you can request one or the other with the /scope flag.
The output reads fairly well from within the command prompt, but if you need to export the output you could use either of the following.
Gpresult /r > gpresult.txt Export output to a text fileGpresult /r |clip Export output to Windows clipboard
I can't see the Computer Settings?
If UAC is enabled, running GPResult without elevating the command prompt will only show you the user settings. If you want to see both user and computer settings, elevate the command prompt by either tapping the winkey+cmd then ctrl+shift+enter or right click on the command prompt and select run as administrator. If you elevate with an admin account different to the currently logged in user (common if the user does not have administrator rights), then you will receive an error message stating INFO: The user 'domainuser' does not have RSOP data. This is because GPResult is using the elevated user's context. To work around this, specify the standard user that you are troubleshooting.
Generate HTML Report
/h Saves the report in HTML format/f Forces GPresult to overwrite the file name specified with /h/user Specifies the user name for which the RSOP data is to be displayed
To get a more graphical view of what's going on, you can generate a HTML report. This gives a detailed break down of each setting and the GPO from which it came. This view is particularly nice as you can show all and use ctrl+f to find a particular policy or setting.
Run GPResult on Remote Computer
/s Specifies the remote system to connect to
This allows you to run GPResult on a remote system, all of the above applies.
The following GPOs were not applied because they were filtered out
You may see this for a few reasons. The first that the policy is empty in which case you'll see Filtering: Not Applied (Empty), this is fairly self explanatory. The second is Filtering: Denied (Security), which typically boils down to the 'Apply Group Policy' permission on the GPO. You may also see Filtering: Denied (Unknown Reason) which is similar to (Security) in that the 'Read' permissions has been denied.
To review the last two examples, launch the GPMC (Group Policy Management Console). Find the offending GPO, and select Delegation- from there you may see an additional group or a single user or machine that has been added.
Click on advanced and review the permissions against the object. In this case you can see that the Seven computer object has been denied Apply Group Policy resulting in the Filtering: Denied (Security) message.
V j singh cheating. If in doubt, select Advanced -> Effective Access and enter the required computer or user object. If you scroll down to around halfway you'll see the Apply Group Policy permission with either a green tick of a red cross against it. If deny read has been granted every permission will have a red cross next to it.
I hope this gives you the basics behind GPResult and some good real world example to aid in your Group Policy troubleshooting.
You can access the Local Group Policy Editor (see the following picture) on your Windows 10 computer with the help of Run, Search, Start Menu, Command Prompt and Windows PowerShell. For more info, please keep on reading.
If you usually use Local Group Policy Editor, I recommend you create Local Group Policy Editor Shortcut on Desktop.
Video guide on how to access Local Group Policy Editor on Windows 10:
5 ways to access Local Group Policy Editor in Windows 10:
Here we see that 4 GPOs have applied to the Computer settings portion.
If you don't want to view both Computer and Users settings in the output you can request one or the other with the /scope flag.
The output reads fairly well from within the command prompt, but if you need to export the output you could use either of the following.
Gpresult /r > gpresult.txt Export output to a text fileGpresult /r |clip Export output to Windows clipboard
I can't see the Computer Settings?
If UAC is enabled, running GPResult without elevating the command prompt will only show you the user settings. If you want to see both user and computer settings, elevate the command prompt by either tapping the winkey+cmd then ctrl+shift+enter or right click on the command prompt and select run as administrator. If you elevate with an admin account different to the currently logged in user (common if the user does not have administrator rights), then you will receive an error message stating INFO: The user 'domainuser' does not have RSOP data. This is because GPResult is using the elevated user's context. To work around this, specify the standard user that you are troubleshooting.
Generate HTML Report
/h Saves the report in HTML format/f Forces GPresult to overwrite the file name specified with /h/user Specifies the user name for which the RSOP data is to be displayed
To get a more graphical view of what's going on, you can generate a HTML report. This gives a detailed break down of each setting and the GPO from which it came. This view is particularly nice as you can show all and use ctrl+f to find a particular policy or setting.
Run GPResult on Remote Computer
/s Specifies the remote system to connect to
This allows you to run GPResult on a remote system, all of the above applies.
The following GPOs were not applied because they were filtered out
You may see this for a few reasons. The first that the policy is empty in which case you'll see Filtering: Not Applied (Empty), this is fairly self explanatory. The second is Filtering: Denied (Security), which typically boils down to the 'Apply Group Policy' permission on the GPO. You may also see Filtering: Denied (Unknown Reason) which is similar to (Security) in that the 'Read' permissions has been denied.
To review the last two examples, launch the GPMC (Group Policy Management Console). Find the offending GPO, and select Delegation- from there you may see an additional group or a single user or machine that has been added.
Click on advanced and review the permissions against the object. In this case you can see that the Seven computer object has been denied Apply Group Policy resulting in the Filtering: Denied (Security) message.
V j singh cheating. If in doubt, select Advanced -> Effective Access and enter the required computer or user object. If you scroll down to around halfway you'll see the Apply Group Policy permission with either a green tick of a red cross against it. If deny read has been granted every permission will have a red cross next to it.
I hope this gives you the basics behind GPResult and some good real world example to aid in your Group Policy troubleshooting.
You can access the Local Group Policy Editor (see the following picture) on your Windows 10 computer with the help of Run, Search, Start Menu, Command Prompt and Windows PowerShell. For more info, please keep on reading.
If you usually use Local Group Policy Editor, I recommend you create Local Group Policy Editor Shortcut on Desktop.
Video guide on how to access Local Group Policy Editor on Windows 10:
5 ways to access Local Group Policy Editor in Windows 10:
Way 1: Access the editor by Run.
Step 1: Right-tap the lower-left corner on the desktop to open the Quick Access Menu, and open Run.
Step 2: Enter gpedit.msc and click OK.
Way 2: Enter Group Policy Editor via Search.
Step 1: Press Windows+X to open the Quick Access Menu, and choose Search.
Step 2: On the Search panel, enter group policy in the box and click Edit group policy.
Way 3: Access the editor from Start Menu.
Click the bottom-left Start button to open the Start Menu, enter gpedit.msc in the empty box and tap gpedit in the results.
Way 4: Access Group Policy Editor through Command Prompt.
Step 1: Open the Quick Access Menu with Windows+X, and click Command Prompt.
Step 2: Type gpedit (or gpedit.msc) in the Command Prompt window and hit Enter.
Results Goodlettsville Tn
Way 5: Open the editor in Windows PowerShell.
Step 1: Tap the lower-left Start button, and click Windows PowerShell in the Start Menu.
Step 2: Input gpedit in the Windows PowerShell and press Enter.
Results Goodwood
Related Articles:
