Windows Server

Troubleshoot Group Policy configurations using gpresult

If Group Policy configurations start to go awry, what can you do? IT Jedi Rick Vanover offers some guidance.

Group Policy is one of the best products Microsoft has ever made; and yet, when it comes to troubleshooting Group Policy configuration, it can be a tricky.

There are a number of ways to troubleshoot a Group Policy setting to see why something isn't being applied. The obvious approach is to run the gupdate /force command to refresh the policies assigned to the user and computer account outside of the established automatic refresh timeframe. When this approach and a system reboot don't do the trick for a Group Policy Object (GPO) that seems like it should apply, what can you do?

A good option is to use the gpresult command to get additional information in order to see what's being applied on a server or a workstation. Gpresult provides the following details:

  • Inventory of GPOs applied
  • Last Group Policy update time
  • System configuration settings
  • The domain controller that applied the last policy update
One of the command's cool features is that it can retrieve the result of a remote computer, which saves you from having to log on remotely. In the following example, I show a report for the remote server (DB1.RWVDEV.INTRA) with the most relevant information highlighted (Figure A). Figure A

Click the image to enlarge.

If you want to get the output in a different format, HTML and XML outputs are available by using the /h and /x parameters, respectively; then you add a filename at the end of the command, as shown in the command example below for HTML:

Gpresult /r db1.rwvdev.intra /h databaseserver.html

The output is shown in Figure B. Figure B

Click the image to enlarge.

How are you using the gpresult command? Share your comments in the discussion.

Stay on top of the latest Windows Server 2003 and Windows Server 2008 tips and tricks with our free Windows Server newsletter, delivered each Wednesday.

Automatically sign up today!

About

Rick Vanover is a software strategy specialist for Veeam Software, based in Columbus, Ohio. Rick has years of IT experience and focuses on virtualization, Windows-based server administration, and system hardware.

3 comments
skooboy
skooboy

In domain environments, gpresult will decide to not display the computer GPO's. That problem immediately renders the tool only 50% useful.

Neon Samurai
Neon Samurai

I've a few rules that don't seem to take affect on the client nodes. If this tool shows what rules are being recognized or not, this could be a very good week.

learn4ever
learn4ever

... is WINPOLICIES.EXE, part of the Windows Resource Kit. Unfortunately, it doesn't do local policies either. I've not seen a tool that does both.

Editor's Picks