Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've inherited a network, in my new position, that I'm in the process of getting accredited and then online. For now it's completely offline and all my updates are done locally at the machine(s). Using the results of my Retina scans I research my vulnerabilities, download the appropriate patches/fixes and then install them on the respective server(s). However, a large percentage of my audits show "simple fixes" in the form of registry changes, security policy edits, etc. Long story short, I've made these changes numerous times only to find them reappearing in my scans and most-to-all of the items reverting back to what I changed them from.

I've given myself, as high as, enterprise admin rights to no avail. After more and more research and attempts, I noticed that the GPO(s) on this network is completely screwed and I'm having the hardest time narrowing down which GPO is "in control". Does anyone have a tool or anything that may help me narrow down the master GPO? Or any helpful advice on my situation?

share|improve this question

gpresult /H c:\path\to\output.html should give you a nice overview of what policies are applied to that machine.

Group Policy objects are processed in the following order:

  • Local
  • Site
  • Domain
  • OU
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.