Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to find if a single Group policy setting has been applied on a specific domain / AD server.

In the simple case of modifying the the default group policy I can look up the policy setting via:

  1. the registry (local or remote using WMI)
  2. using the WMI class RSOP_PolicySetting in the ROOT\RSOP\Computer namespace. However, this only appears to give me the group policy setting for the machine you are connecting to with WMI.

However, imagine a AD configuration with multiple OU's with custom policies on each OU. For instance, Say the OU hierarchy is:

  • Employees
    • Marketing
    • Engineers
    • Drones

How do I get look across all 4 OU's to see if the correct policy is applied everywhere? I'd like to make a single query to the AD server to figure this information out.

I suppose an alternative solution would be to find all the OU's, pick a sample computer from each OU, and query it for the correct policy. Hopefully there is a better solution :)

share|improve this question
add comment

1 Answer

Group policy processing can be affected by many things. Among them

  • security filtering
  • WMI filtering
  • Enforce/block inheritance usage

You can use modelling in the GPMC to determine what would happen under certain criteria. However, the only way you can ensure a machine has received the setting, is to query the registry or RSOP WMI namespace of the computer directly as you've already determined through means.

There is no one query that will tell you if the "correct" policy is applied everywhere. As an admin, the best you can do is to ensure it is configured the way you expect it to be (i.e. linked at the right level and filtered to the intended audience).

At the end of the day, you should not be querying AD. You should be querying the computer where the policy is supposed to have been processed.

HTH

share|improve this answer
    
Thanks. This feature is part of a product so we don't anything about the configuration of the end user's domain. As we intend to visit many computers in the domain, the intention is that we could determine up front if WMI is enabled domain wide. Our current aproach is to query RSOP and see if WMI is enabled as part of the default domain policy. Not a real solid approach but gives the customer a starting point to see if their system configuration needs to be modified to enable WMI. If they have multiple OU's with different policies all bets are off... –  cshimer Oct 24 '11 at 12:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.