4

Is there any tool that would help us get a handle on all our group policies to discover and remove the conflicting and redundant group policies that are giving us a headache? We change one group policy and another one is always there to mess things up.

3 Answers 3

13

Use the Group Policy Management Console (gpmc.msc) to get an idea of how things are linked, and then use the RSOP console (Resultant Set of Policies - run RSOP.msc) on a member machine to find out what/how group policies are affecting that machine.

HTH.

3
  • +1 for RSOP. It's hard to manage conflicting policies if you can't see exactly which ones are having an effect and where. Jan 20, 2010 at 21:34
  • +1. This is a great answer but personally I think gpresults is a far easier method. It provides a wealth of information in one window without the need to tool around GPMC looking at GPO's, links, security filtering, etc., etc., and then having to run RSOP on another machine to see the affects of GP processing.
    – joeqwerty
    Jan 20, 2010 at 23:52
  • Tomato, tomato. :) GPResult is a command line version of the RSOP.msc console. GPMC is considerably different in that it's more of a hub vs. an end. So it's good for quickly identifying hierarchies and inheritance for all GPOs, as well as seeing what 'should be' being applied, vs. what's actually being applied(RSOP/GPResult). :)
    – techie007
    Jan 21, 2010 at 3:21
2

Running gpresults can be used to show what GPO's and settings are being applied for a particular user on a particular computer.

Also, there's no such thing as conflicting GPO's, as far as I'm concerned. The term "conflicting group policies" is a misnomer. You may have settings in different GPO's that oppose each other, but they don't conflict. One set of settings is going to get set one way or another (link order, no over-ride, inheritance blocking, filtering) but they are not going to conflict. A conflict would result in a stalemate where nothing gets set, but that's never the case with GPO's.

0

There's always a gpo that always takes precedence over the other in case of any conflict. e.g., in loopback (merge) gpos the computer OU gpos takes precedence over the user OU. As for investigating if there's any conflict. GPRESULT will give you sufficiently information from the user part, while RSOP console could only be helpful if using it from admin part, i.e., if you could actually see the gpos. My advice use the gpresult html, it's quite robust and easy to investigate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .