Windows Group Policy application investigation cheat sheet
Compare endpoint policy results, processing events, domain GPO inventory, OU inheritance and configured settings.
Domain-joined Windows endpoints plus a management host with RSAT GroupPolicy. User and computer policy processing are separate scopes.
Updated · Active Directory · 6 min read
| Command | What it does |
|---|---|
gpresult /r /scope user | Endpoint: inspect the current user policy result |
gpresult /r /scope computer | Endpoint: inspect computer policy separately |
Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 50 | Endpoint: read recent policy-processing events |
Get-GPO -All | Select-Object DisplayName,Id,GpoStatus,ModificationTime | RSAT: inspect the domain GPO inventory |
Get-GPInheritance -Target 'OU=Workstations,DC=corp,DC=example' | RSAT: inspect OU links and inherited policies |
Get-GPOReport -Name 'Workstation Baseline' -ReportType Xml | RSAT: inspect the configured policy report |
Walkthrough
Run gpresult and event-log checks on the affected endpoint; run domain GPO commands from an authorized RSAT session. Replace Workstation Baseline and the OU distinguished name. No gpupdate or policy changes are performed.
Step 1: Endpoint: inspect the current user policy result
gpresult /r /scope user
Run in the affected user context and record applied and denied GPOs where shown. This reports the recorded processing result, not a live prediction after an administrator edits a link. A different logged-on account can produce a different result.
Step 2: Endpoint: inspect computer policy separately
gpresult /r /scope computer
Use an elevated authorized session where needed and compare the machine result with the user result. A user setting cannot be diagnosed solely from computer scope. Missing RSoP data may mean processing or visibility problems rather than no applicable GPOs.
Step 3: Endpoint: read recent policy-processing events
Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 50
Correlate processing times, activity IDs and extension errors with the relevant sign-in or refresh. The latest 50 events may not include the incident, so use a bounded time filter when needed. Read event details rather than interpreting event numbers alone.
Step 4: RSAT: inspect the domain GPO inventory
Get-GPO -All | Select-Object DisplayName,Id,GpoStatus,ModificationTime
Confirm the intended policy exists and inspect whether its user or computer settings are disabled. Inventory presence does not prove a policy is linked, readable, in scope or successfully processed on the endpoint.
Step 5: RSAT: inspect OU links and inherited policies
Get-GPInheritance -Target 'OU=Workstations,DC=corp,DC=example'
Replace the target with the computer or user actual OU and examine direct and inherited links, enforcement and inheritance behavior. This does not fully evaluate security filtering, WMI filtering or loopback processing for an individual endpoint.
Step 6: RSAT: inspect the configured policy report
Get-GPOReport -Name 'Workstation Baseline' -ReportType Xml
Read the relevant setting and configured filters in the XML returned to the console. This is configuration evidence, not endpoint resultant policy. Reports can contain internal paths and security details; share only the necessary excerpt.
WORKED INCIDENT
Practical case: A workstation never receives its new baseline
Fictional teaching scenario; observations are examples, not captured production output.
Situation
A new workstation lacks the expected computer policy settings even though the baseline GPO exists in the domain.
Investigation sequence
1. Endpoint: inspect computer policy separately
gpresult /r /scope computerCapture the computer policy result from the affected endpoint, with the correct privileges.
2. Endpoint: read recent policy-processing events
Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 50Check the corresponding processing window for errors before assuming filtering or linking is the cause.
3. RSAT: inspect the domain GPO inventory
Get-GPO -All | Select-Object DisplayName,Id,GpoStatus,ModificationTimeConfirm the baseline GPO exists and its computer settings are enabled.
4. RSAT: inspect OU links and inherited policies
Get-GPInheritance -Target 'OU=Workstations,DC=corp,DC=example'Inspect the workstation actual OU. In the fictional example it is in a staging OU where the baseline is not linked or inherited.
Example findings
Illustrative findings: the baseline is absent from applied computer GPOs; the domain GPO is enabled; the workstation is in a staging OU without its link.
Interpret the findings
The OU/link mismatch supports a scope problem. GPO existence alone does not make it applicable. Verify the intended placement and check filtering, replication and loopback if the link evidence does not explain the result.
Verify the outcome
After the directory owner corrects placement or linking through the approved process, allow normal policy processing or an approved refresh. Repeat computer gpresult and verify the specific intended setting on the endpoint.
Escalation handoff
Provide endpoint identity, actual OU, GPO GUID, scope, processing time and the relevant event details to the directory owner. Avoid moving accounts or changing links merely to test a hypothesis.