Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I know there are several built-in tools (or tools available for download from Microsoft) that you can use to assess and modify the security policy applied to a system. A few I'm familiar with, to one degree or another, are:

  • secpol.msc
  • rsop.msc
  • gpedit.msc

However, I've found that the results displayed by each of these will at times differ. secpol.msc may reflect a local policy, while gpedit or rsop.msc say that a GPO setting should be in place.

What I'd like to see is a comparison between the local policy, applied GPO(s), and the policy that is actually in effect on the system. At the very least, I need something that shows me the last of those - regardless of what policies are set locally or being pushed to the system, I need to know what the system is actually doing.

Is there a way I can get this comparison with one of the above tools, or another tool that's built-in or available from Microsoft? Where should I turn for an authoritative answer as to what policy the system is actually adhering to?

This is for systems running Windows XP, 2003, 7, and 2008.

share|improve this question

2 Answers 2

gpmc.msc has a good view of this information in its "Group Policy Results" tool.

The report displays information about which GPOs were applied in which order. Additionally, in the "Settings" tab of the report, it shows each applied setting on the system, as well as a "Winning GPO" column that shows which GPO (be it the local policy or one originating from the domain) that took precedence in applying that setting.

gpmc.msc comes in the Admin Tools pack for Vista, 2008, and newer. It is also available for Windows XP, here: https://www.microsoft.com/download/en/details.aspx?id=21895

share|improve this answer
    
That sounds exactly like what I'm looking for, and it sounds like something I've used before on 7/2008. Can you include a source link, though? It doesn't seem built-in for XP. –  Iszi Apr 17 '12 at 17:56
    
You're right, it's a default part of the admin tools for Vista/2008 and newer (and 2003 R2, I think), but a separate download for XP. See here. –  Shane Madden Apr 17 '12 at 17:59
    
Thanks. I ran it locally, and it does seem to have most of what I'm looking for. However, it only appears to include settings for which there are GPOs, (or, maybe our policy is just that all-encompassing) and it doesn't give a comparison between GPO vs. local configuration. Is there any tool that can give me the comparison, or at least include policies that are handled by local configuration where GPOs are not present? –  Iszi Apr 17 '12 at 18:17
    
It shows items that source from the local policy - on the main tab of the results report, you'll see that the local policy is in the list of applied GPOs. But no, it doesn't show settings for which there is no GPO, local or domain; it's only interested in settings for which GPO is involved. –  Shane Madden Apr 17 '12 at 19:36

Try the security and Compliance manager tool. You can export the current effective config (using localgpo.msi) as a set and compare it to either what you want for policy or what you have in GPO's. If you want to just look at a server the group policy management console will tell you what got applied and from where (and generate reports)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.