none
Check if multiple GPO's are changing the same policy setting(s)

    Question

  • Hi

    Is it possible to check if a group policy settings is applied twice by two different GPO's?

    When I run the Resultant Set of Policy it only shows the last applied GPO.


    /Lasse
    Wednesday, June 23, 2010 6:01 AM

Answers

  • Yes, there is a tool. The integrated mmc snap in for RSOP.
    Unfortunately MS will no longer maintain it, but it is still included in Win7/Win 2008,
    though not showing the new features like GP Preferences.
    But it is still a helper for questions like the one from Lasse.

    Run rsop.msc
    Navigate to the setting you want to examine
    Double click it
    Click on the tab "Precedence"
    You will see all GPOs which deploy this setting to that machine/user.

     


    Patrick
    • Proposed as answer by jdeitel Wednesday, June 23, 2010 2:22 PM
    • Marked as answer by LasseF Monday, June 28, 2010 8:20 AM
    Wednesday, June 23, 2010 1:57 PM

All replies

  • Hi,

    there is no tool that does this automatically. I would create HTML reports of the GPOs and then compare them manually. Depending on the number of GPOs and settings, that could take alot of effort.

    hope that helps,

    Gunter

    Wednesday, June 23, 2010 11:04 AM
  • Yes, there is a tool. The integrated mmc snap in for RSOP.
    Unfortunately MS will no longer maintain it, but it is still included in Win7/Win 2008,
    though not showing the new features like GP Preferences.
    But it is still a helper for questions like the one from Lasse.

    Run rsop.msc
    Navigate to the setting you want to examine
    Double click it
    Click on the tab "Precedence"
    You will see all GPOs which deploy this setting to that machine/user.

     


    Patrick
    • Proposed as answer by jdeitel Wednesday, June 23, 2010 2:22 PM
    • Marked as answer by LasseF Monday, June 28, 2010 8:20 AM
    Wednesday, June 23, 2010 1:57 PM
  • What do you mean by MS will no longer maintain it? I use rsop for tasks like this frequently due to working in an extremely large domain consisting of multiple network administrators.
    Wednesday, June 23, 2010 2:25 PM
  • If you start rsop.msc on Vista or Win 7 you will see a message saying
    "Starting with Windows Vista... RSOP does not show all ... settings...
    use the command line tool gpresult"

    Here is a similar statement:
    http://technet.microsoft.com/en-us/library/cc736424(WS.10).aspx

    Concering the maintenance/support for RSOP:
    Once I opened a MS support call for RSOP and I was told not to use it anymore because
    it is no longer developed. The recommendation was to use GPMC instead...
    Though for me this is not a usable alternative in all cases.

    Sad, but true.


    Patrick
    Wednesday, June 23, 2010 4:19 PM
  • Hi Patrick

    You are correct! I have done a RSoP as I have done many times before, but I have never looket at the "Precedence" tab while working with this problem, haven't even thought about it.

    On the tab "Group Policy enheritance" in the GPMC, is it correct that the lower the number, the higher the precedence? meaning that if two settings are changed, the lower number will win the fight?


    /Lasse
    Thursday, June 24, 2010 6:37 AM
  • In RSOP precedance tab there are no numbers.
    The one on top of the list is the one that is being applied.

    On the tab "Group Policy Inheritance" in the GPMC:
    Yes, the lowest number has highest precedence.


    Patrick
    Thursday, June 24, 2010 9:18 AM