Learn about GPResult Command to view Group Policy and its variations for different purposes with syntax and example screenshots:
This tutorial is all about the Group Policy Result Commands and its syntax, along with some examples that are explained with the help of screenshots.
By executing this command, we can view and analyze the set of policies applied to the active directory of your system in the network along with the various types of other settings.
All the commands are explained one by one with the syntax, examples, and output that makes the overall concept more interesting and easy to understand. We have also included some FAQs for more clarity on this topic.
What You Will Learn:
What Is Group Policy
Group policy is an inbuilt feature in all the versions of Microsoft operating systems that supervises the functionality of user accounts and computer accounts. It provisions the centralized management and configuration of various features of OS and accounts in the active directory environment.
A collection of Group Policy is known as Group Policy Objects (GPO). The group policy can be considered as the primary security tool of the OS user account that is used to provide security to the user account and the computer account associated with it.
Uses Of Group Policies
- It can be used to enforce the password policy that restricts the user to access/alter defined services only.
- The group policy can prevent an unknown user to access the network from remote computers.
- It can be used to block or allow access to certain folders or files by the remote end devices in the network.
- It is used to manage the profiles of the roaming users that includes folder redirection, offline file access, etc.
GPResult Command
A group policy result is a tool of Windows that is based on the command line and is applicable for all the versions of Windows like Windows XP, Windows 7, Windows 10, Windows Server 2000, and 2008.
Recommended reading =>> How to use Common Windows CMD Commands
By executing the command gpresult.exe, the administrator of the OS can locate the group policies applied on the computer along with the redirected folders and the registry settings on that system.
gpresult Command: To see the Gpresult commands, go to the command prompt and type the command: “gpresult /?”
The output shown below displays the description and parameter list of the resultant set of policies (RSoP) for a target user and the computer.
gpresult /R – To View Group Policy Settings
To view the output of the group policy objects settings applied to your computer enter the following command in the CMD.
“gpresult /R”
The output will display the resultant set of policies for your desktop as well as the user account which is inclusive of operating system configuration, OS version, User profile, site name, link type as shown below in screenshot 1.
Further, the User profile will elaborate more policies that come under it like when the last time the policy was applied, Domain name, domain type, and link threshold value.
Output of gpresult /R Screenshot-1
As you can see in the output of screenshot-2 of the gpresult command /R it also displays the output for applied GP objects. If the OS is using any kind of filtering method, then it will display it with the security policies applied to the system.
Output of gpresult /R Screenshot-2
GPResult /S – For Remote Computer
- To display the settings and group policy information on a remote computer the /S command is used.
Syntax:
‘gpresult /S COMPUTERNAME’
This command can also be used to display the user and computer settings of the remote computer or server.
- We can also see the verbose settings and parameters of the remote system. We just need to have the credentials of the remote end system and the system should be in the same domain as the host system.
Syntax:
‘gpresult /S system /U username /P password /SCOPE USER /V’
An example of Syntax is shown in the below Screenshot:
As the system is not connected with the remote user, it shows the error message.
The syntax to display the settings of the remote computer is:
‘gpresult /S system /USER targetusername /SCOPE COMPUTER /V’
Thus the system command with the SCOPE command can be used to derive all the required information from the remote end computer and user in the network.
The example is shown with the help of the below screenshot:
[image source]
GPResult /H – To Export Output To HTML
It is not easy to read the group policies objects summary data from the command prompt every time in detail. Thus to get it in an easily readable form, we can export the data into the HTML format.
The /H command with the location and the filename that specifies the location where the file will be saved is used here and is shown in the below screenshot.
The output that is saved in the. HTML format can be viewed through the web browser by going to the location on which it is saved and clicking open with the browser. This is also shown with the help of the below screenshot.
Group Policy For Specific User
This command is used to display the group policies for the specific user or system which lies in the network domain. To display the specific user policy summary you must be aware of the user’s credentials.
The command is as follows:
‘gpresult /R /USER targetusername /P password’
For example, If you have to see the policy information and other data for the user “NEHA” then the command and the result shown in the below screenshot will display all the user settings and OS information.
GPResult Scope Command
The /SCOPE command specifies whether the user settings and the computer settings of the network need to be displayed or not. The syntax used with this command is “USER” or “COMPUTER”.
The scope command can also be used to display the settings of the r111emote computer, target user, and target computer. You just need to have the far end-user credentials to access the information.
Now the command to display the remote computer settings is:
‘gpresult /R / SCOPE COMPUTER’
The output is shown in the below screenshot:
GPResult Force Command
This command is used to force the gpresult to overwrite the existing filenames that are specified by the /H or /X command.
The syntax is ‘gpresult /F /H targetlocation\gpresultoutput.Html’
As shown in the above screenshot, the command will forcefully overwrite the content of the target location filename that is saved at the mentioned location. The modified file location is displayed below and it can be opened with a web browser like Google chrome etc.
GPResult Verbose Command
This command is used to display the verbose information in the system. It includes the additional detailed settings like security privileges granted to the user, public key policies, logon and logoff scripts settings, administrative templates and internet connection related settings, etc.
The syntax is ‘gpresult /V’
The command output is shown in the screenshots below:
Group Policy Settings Using Microsoft PowerShell Tool
The windows PowerShell tool with remote server administration tools (RSAT) installed in the client or server can be used to set the group policies in the Windows Server and Windows client.
There are different cmdlet commands through which we can derive various parameters of the OS and can analyze the resultant set of policy (RSoP) for the remote server and computer. This tool can be used to set and analyze the system settings of various systems in the network at the same time.
Described below are some of the basic Syntaxes of the commands along with their purpose of use.
| Command | Description |
|---|---|
| GET -GPO | Gets group policy objects in the network domain for one and all computers or users. |
| GET-GPOREPORT | Generate report in XML or HTML report for the specified user or all the users in the domain. |
| GET-GPPERMISSION | It gets permission for objects in the domain based on the security principles. |
| Backup-GPO | Backup the Group policy objects for all the systems in the network. |
| Copy-GPO | It makes the replica of the objects. |
| Import-GPO | It imports the group policy objects from the backup folder into the destined GPO. |
| New-GPO | Creates a new group policy object. |
| Remove-GPO | It removes the group policy object. |
| Restore-GPO | This command is used to restore the group policy objects in the domain from the backup files of the GP objects for the specific objects or all objects. |
| Set-GPLink | It is used to set the parameters of the group policy link of the specified user or computer. |
| Set-GPPermission | It allows the level of permissions to the group policy objects in the domain based on the granted security principles. |
Enlisted below are some of the examples in context to the above-mentioned syntax and commands.
Example 1: To create a group policy object in the domain of the user.
The steps are defined in the below screenshot.
Example 2: Remove a Group policy object by name.
Syntax:
By using this command, we can eliminate the group policy object from the network domain of the system.
Example 3: To set the permissions for the security groups that belong to all the group policy objects.
This command is used by the group administrators of the network to set the level of the access permissions and security levels to the users.
Syntax:
Frequently Asked Questions
Q #1) What is the resultant set of policy commands?
Answer: It is a report that is inclusive of all the settings in the active directory which reflects all the significant values that can affect a network and consists of various users and computers.
Q #2) How to check if the group policy is applied or not?
Answer:
Follow the below steps to check if Group Policy is applied:
- Press Windows key + R from your keyboard of the computer. The run prompt will appear. Later, type rsop.msc and then enter.
- The resultant set of policy tools start to scan the system for the applied policies.
- After the scanning, it will display the result through the management console that lists out all the policies applied to your computer since you logged on to the account.
Q #3) Where is the gpresult.html file saved?
Answer: It is by default saved to system 32 folders if you don’t specify the path to save the file.
Q #4) How do I run the gpresult for another user?
Answer: If you want to see settings for both the computer and the user then press the Windows key + cmd and then right-click on the command prompt and select run as administrator.
Q #5) What is the difference between the RSoP command and gpresult?
Answer: The RSoP command will display only a limited set of group policies that are applied to the computer and is not possible to all. But on the other hand, the GPRESULT command-line tool with the various switches can display all the possible sets of applied policies to the users and the computer.
Conclusion
We have explained the concept of Group Policy Commands and their use with examples and screenshots.
There are various kinds of commands used for deriving the applied group set of policies and each is having its significance and the same is explained above.
When we need to derive and analyze the group policies for various computers and users in the network, then we use the Microsoft Power shell tool for this purpose. The tool has a very vast scope and it is explained shortly here.
We have also discussed some FAQ’s that arise in our mind when we explore the above concept and commands.