none
Different results in RSOP.msc and GPResult

    Question

  • Hello,

    I have some Group Policies need to apply to all the computers in the domain (Domain Controller WS 2008R2/ Client Windows 7/8.1)

    I have created a group policy (Computer Configurations/Security Settings/Software Restriction) linked to the OU the computers resides.  (The majority of the client machines are Windows 7 and some of Windows 8.1, 2x Windows XP (Legacy Application/VM), I created WMI for different OS and according to GPResult and RSOP), WMI is working OK.

    But GPResult shows (after gpupdate /force and restarted)

    The following GPOs were not applied because they filtered out

    Filtering: Not Applied (Empty)

    although in RSOP shows
    I can see the policies I created in GPO. (looks like applied)

    I am not sure why GPResult and RSOP shows different results and if the policies are applied. I run "Group Policy Results" under GPMC, and I could see the policies are applied.

    My questions are:

    1. The policies are really applied to the computer

    2. Why 'GPResult' and 'RSOP' shows different results?

    kind regards,

    Akira Sekine

    Thursday, November 12, 2015 2:11 AM

Answers

  • Hi,
     
    RSOP.msc is graphical tool where as grpresult is command line tool.
     
    Starting with Windows Vista SP1, the Resultant Set of Policies (RSoP) report does not show all Microsoft Group Policy settings (It is no longer updated and has no idea about a great number of policies).
     
    To see the full set of policy settings applied for a computer/user, it is suggested to use gpresult instead. It also gives you the ability to use a graphical view or a command line view with a single tool.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    • Marked as answer by Akira Sekine Thursday, November 12, 2015 12:02 PM
    Thursday, November 12, 2015 8:13 AM
    Moderator
  • > 2. Why 'GPResult' and 'RSOP' shows different results?
     
    TO show computer GPOs, GPResult must be ran in an elevated prompt.
     
    And rsop.msc is deprecated - read the window header when it starts
    collecting data :)
     
    • Marked as answer by Akira Sekine Thursday, November 12, 2015 12:10 PM
    Thursday, November 12, 2015 9:17 AM

All replies

  • UPDATE:

    I searched the problem over the internet and some article mentioning that gpresult with administrator elevated privilege. I tried it but still the policy is in 'Filtering: Not Applied (Empty).

    I do have couple of policies defined in the GPO.

    kind regards,

    Akira Sekine 

    Thursday, November 12, 2015 4:32 AM
  • Hi After spending some time for research,

    looks like I needed to run 'GPRESULT /R /SCOPE Computer (with Administrative elevated prompt) to see the policy applied to the computer.

    If anyone explains what differences between RSOP and GPResult, would be really appreciated.

    kind regards,

    Akira Sekine

    Thursday, November 12, 2015 4:42 AM
  • Hi,
     
    RSOP.msc is graphical tool where as grpresult is command line tool.
     
    Starting with Windows Vista SP1, the Resultant Set of Policies (RSoP) report does not show all Microsoft Group Policy settings (It is no longer updated and has no idea about a great number of policies).
     
    To see the full set of policy settings applied for a computer/user, it is suggested to use gpresult instead. It also gives you the ability to use a graphical view or a command line view with a single tool.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    • Marked as answer by Akira Sekine Thursday, November 12, 2015 12:02 PM
    Thursday, November 12, 2015 8:13 AM
    Moderator
  • > 2. Why 'GPResult' and 'RSOP' shows different results?
     
    TO show computer GPOs, GPResult must be ran in an elevated prompt.
     
    And rsop.msc is deprecated - read the window header when it starts
    collecting data :)
     
    • Marked as answer by Akira Sekine Thursday, November 12, 2015 12:10 PM
    Thursday, November 12, 2015 9:17 AM
  • Hi Ethan,

    Thanks for the explanation. I was not paying particular attentions to the switches provided in gpresult until now, I did understand the differences among them.

    Thank you,

    kind regards,

    Akira Sekine

    Thursday, November 12, 2015 12:02 PM
  • Hi Martin,

    Thanks for the explanations. I've been using my domain admin account for all GP related tasks. 

    >TO show computer GPOs, GPResult must be ran in an elevated prompt

    that's the reason I wasn't able to get any computer related Policies applied.

    Thanks for the quick answer/reply.

    kind regards,

    Akira Sekine

    Thursday, November 12, 2015 12:10 PM