Take the 2-minute tour ×

Is there any tool that would help us get a handle on all our group policies to discover and remove the conflicting and redundant group policies that are giving us a headache? We change one group policy and another one is always there to mess things up.

share|improve this question
add comment

2 Answers

Use the Group Policy Management Console (gpmc.msc) to get an idea of how things are linked, and then use the RSOP console (Resultant Set of Policies - run RSOP.msc) on a member machine to find out what/how group policies are affecting that machine.


share|improve this answer
+1 for RSOP. It's hard to manage conflicting policies if you can't see exactly which ones are having an effect and where. –  John Gardeniers Jan 20 '10 at 21:34
+1. This is a great answer but personally I think gpresults is a far easier method. It provides a wealth of information in one window without the need to tool around GPMC looking at GPO's, links, security filtering, etc., etc., and then having to run RSOP on another machine to see the affects of GP processing. –  joeqwerty Jan 20 '10 at 23:52
Tomato, tomato. :) GPResult is a command line version of the RSOP.msc console. GPMC is considerably different in that it's more of a hub vs. an end. So it's good for quickly identifying hierarchies and inheritance for all GPOs, as well as seeing what 'should be' being applied, vs. what's actually being applied(RSOP/GPResult). :) –  techie007 Jan 21 '10 at 3:21
add comment

Running gpresults can be used to show what GPO's and settings are being applied for a particular user on a particular computer.

Also, there's no such thing as conflicting GPO's, as far as I'm concerned. The term "conflicting group policies" is a misnomer. You may have settings in different GPO's that oppose each other, but they don't conflict. One set of settings is going to get set one way or another (link order, no over-ride, inheritance blocking, filtering) but they are not going to conflict. A conflict would result in a stalemate where nothing gets set, but that's never the case with GPO's.

share|improve this answer
add comment

Your Answer


