query group policy settings across all group policy objects on an AD server

Question

I'd like to find if a single Group policy setting has been applied on a specific domain / AD server.

In the simple case of modifying the the default group policy I can look up the policy setting via:

1. the registry (local or remote using WMI)
2. using the WMI class RSOP_PolicySetting in the ROOT\RSOP\Computer namespace. However, this only appears to give me the group policy setting for the machine you are connecting to with WMI.

However, imagine a AD configuration with multiple OU's with custom policies on each OU. For instance, Say the OU hierarchy is:

• Employees
  • Marketing
  • Engineers
  • Drones

How do I get look across all 4 OU's to see if the correct policy is applied everywhere? I'd like to make a single query to the AD server to figure this information out.

I suppose an alternative solution would be to find all the OU's, pick a sample computer from each OU, and query it for the correct policy. Hopefully there is a better solution :)

Answer 1

Group policy processing can be affected by many things. Among them

• security filtering
• WMI filtering
• Enforce/block inheritance usage

You can use modelling in the GPMC to determine what would happen under certain criteria. However, the only way you can ensure a machine has received the setting, is to query the registry or RSOP WMI namespace of the computer directly as you've already determined through means.

There is no one query that will tell you if the "correct" policy is applied everywhere. As an admin, the best you can do is to ensure it is configured the way you expect it to be (i.e. linked at the right level and filtered to the intended audience).

At the end of the day, you should not be querying AD. You should be querying the computer where the policy is supposed to have been processed.

HTH