Group Policy, Group Policy Object and RSoP Explained

-

|

Introduction

This guide gives an overview of Group Policy, RSoP (Resultant Set of Policy) and Group Policy Objects.

Acronyms used in this guide:
GP – Group Policy
RSoP – Resultant Set of Policy
GPOs or GP Objects – Group Policy Objects
GPMC – Group Policy Management Console
GP Settings – Group Policy Settings

What is Group Policy (GP)?

Group Policy is a Microsoft infrastructure tool that provides centralized management and configuration of user and computer settings. Group Policy does this through Group Policy settings and Group Policy Preferences.

The beauty of GP is that it provides administrators centralized management and control. For example, an administrator can enforce a password complexity policy. Or modify specific settings of domain-joined computers.

Advertisements


Group Policy Management Console (GPMC)

Group Policy, Group Policy Object and RSoP Explained

Group Policy Management Console (GPMC) is the tool used to create GPOs. GPOs are the actual objects where the administrator sets the policies that control users and computer settings.

Below are some of the things you can do with GPMC:

  • Create new and edit existing GPOs
  • Export existing GPO and import GPOs.
  • Also, copy, paste, backup and restore GPOs
  • Create GPO reports, including RSoP reports

RSoP (Resultant Set of Policy)

RSoP is a report of group policy settings applied to users and computers. You can use RSoP.mmc to get RSoP for a local computer. To get RSoP information for a remote computer, use GPResult command line.

GPResult displays the Resultant Set of Policy (RSoP) information for a local or remote user and/or computer. To learn how to use GPResult Command, click GPResult Command: Syntax, Parameters, Examples.

How to Use RSoP.mmc to Get Applied GPOs

  • Log on to the computer with an admin account.
  • Next, hold the Windows logo key and R, to open Run. When Run opens, type RSoP.msc and click Ok. RSoP will start gathering the information (see the second image below the Sponsored Content).
Group Policy, Group Policy Object and RSoP Explained
Group Policy, Group Policy Object and RSoP Explained
  • When it finishes, it will display a report similar to the image below.

Generating the policies applied to a computer is useful for troubleshooting and resolving group policy issues. It will help determine what polices are applied or not applied to a user or a computer.

Understanding RSoP.mmc Results

The result generated by RSoP.mmc has two parts, Computer Configuration and User Configuration.

The results are similar to the settings in a typical GPO. But the result only shows settings applied to the computer or user.

As an example, when I click the Computer Configuration\Software Settings node, it is blank. This is because no policy setting was applied to the computer from the settings in this node.

As I said earlier, you can use RSoP results to troubleshoot GPOs. Say you created password policies and applied the GPO to an OU. You have confirmed that a particular computer is in the OU where the GPO is applied. But when you check the computer, the password policy does not apply.

To see the password policies applied to this computer, in the RSoP result, expand \Computer Configuration\Windows Settings\Security Settings\Account Policy. Then click Password Policy. On the right hand side of the console, you can review the password policies applied to this computer.

Tip
There are other factors that may help you determine why a GPO is not applied to a user or a computer. See the next section for details.

Group Policy Objects (GPOs)

A GPO is is a collection of user and computer settings that defines the permissions, behavior and configuration of users or computers the GPO is applied to.

A GPO can be applied at the Domain, Organizational Unit or Site container level.

When you apply a GPO to a container, all objects in that container inherits the policies defined in the GPO settings.

Tip
Objects inhering GPO polices may also be affected by other configurations like Block Inheritance or No override (more on this below).

To apply a GOP to a Domain, OU or site you can create a new GPO or link an existing one.

Enforced, Block Inheritance and GPO Priority

Earlier in this guide, I said that GPOs can be applied to Sites, Domains and Organizational Units (OUs). When you apply a GPO to a container, all objects within the container should apply the GPO settings. But there is a caveat.

There are two GPO settings that affect whether a GPO may be applied to an object or not – Enforced and Block Inheritance. If you do not want higher GPO links to apply to a child container, you can enable Block Inheritance. But if you want to force top level GPOs on child containers, enable Enforced on the higher level GPO.

When a GPO is set to Enforced, it overrides Block Inheritance. This means that Enforced policies takes precedence over Block Inheritance policies.

Tip
Block Inheritance is set at a child container to stop all GPOs in upper higher containers applying to the child container. But if you enable Enforced at the top level GPO, it overrides Block Inheritance set at the child container.

To set Enforced, right-click the top level GPO. Then click Enforced.

To set Block Inheritance, right-click the lower level container. Then click Block Inheritance.

GPO (Group Policy Object) Processing Order

GPO processing is based on a last writer-wins model. This means that a GPO applied later takes precedence over GPOs applier earlier.

GPOs are applied in this order:

  • The local Group Policy object is applied first
  • Then GPOs linked to sites are applied next
  • Followed by GPOs linked to domains
  • Finally, GPOs linked to organizational units (OUs) are applied last
Tip
Except Enforced is enabled at the Site or Domain level, a GPO applied at the OU is applied to an object. This information is very useful for troubleshooting purposes.

To view the Group Policy precedence order of a container:

  • Highlight the container (click on it). On the right hand side, click the Group Policy Inheritance tab.
Advertisements


Conclusion

In this guide I covered Group Policy, RSoP (Resultant Set of Policy) and Group Policy Objects. I hope this has improved your knowledge of Group Policy.

If you have any question or comment use the “Leave a Reply” form at the end of the guide. Alternatively, share your experience with configuring, managing and troubleshooting Group Policies and GPOs.

Other Helpful Guides

Additional Resources and References

  • Was this post Helpful?
  • YesNo

LEAVE A REPLY

Please enter your comment!
Please enter your name here

FEATURED POSTS

How to Add Bullet Points in Google Slides

How to Add Bullet Points in Google Slides (Android or iOS Apps or PC)

This Itechguide teaches you how to add bullet points in Google Slides. The guide offers steps to add bullet points in Google...
How to Create a Business Facebook Page without a Personal Account

How to Create a Business Facebook Page without a Personal Account

This Itechguide teaches how to create a business Facebook page without a personal account. There could be a...
How to Wrap Text in Google Sheets

How to Wrap Text in Google Sheets (from a PC or the Apps)

This Itechguide teaches you how to wrap text in Google Sheets. The guide offers steps to wrap text in Google Sheets from...
How to Change Birthday on Facebook

How to Change Birthday on Facebook (from the App or PC)

This Itechguide teaches you how to change birthday on Facebook. The guide contains steps to change birthday on Facebook from the Facebook...
Best Thrillers on Netflix

The 10 Best Thrillers on Netflix

The thrillers on Netflix is quite a large number of movies. Knowing the best thrillers to watch can be a challenge.

ADVERTISEMENTS

TRENDING POSTS

Remote Desktop Connection

Remote Desktop Connection an Internal Error Has Occurred [Fixed]

Introduction I recently received the error message "Remote Desktop Connection an Internal Error Has Occurred". It was strange because...

Find My Samsung: Register and Use Samsung Find my Mobile

Introduction Ever wondered how you could find your Samsung phone if you lost it? Find my Samsung or Samsung...
What is the Difference Between PowerShell and CMD?

Windows Powershell vs CMD: Differences and Similarities

Introduction This short guide compares Windows PowerShell vs CMD (Windows command prompt). I will cover the history and nature...
Spotify No Longer Supports this Version of Microsoft Edge

Spotify No Longer Supports this Version of Microsoft Edge [Fixed]

Introduction When you open Spotify web player on Microsoft Edge, you may receive the error message "Spotify No Longer...
Windows 10 Won't Boot

Windows 10 Won’t Boot With Black Screen? 3 Ways to Fix It

Why Won't Windows 10 Boot Up? If your Windows 10 stops with a black screen, the first question in...

BEST OF ITECHGUIDES

No Root File System is Defined

‘No Root File System is Defined’ When Installing Ubuntu [Fixed]

Introduction You are reading this because you probably received the error message "No Root File System is Defined" during...
The 10 Best Korean Movies on Netflix

The 10 Best Korean Movies on Netflix

Korean movies are making wave in the movie world globally. There are several Koreans movies on Netflix with different genre.
Cortana Search not Working in Windows 10 [Fixed]

Cortana Search not Working in Windows 10 [Fixed]

Introduction This guide offers the fix for Cortana search not working in Windows 10. The reason for Cortana search...
what model iphone do i have

What iPhone Do I Have: How to Check Your iPhone Model

Introduction Looking for your iPhone model? It is fairly straightforward. This guide will take you through the steps. To...
routing and remote access windows server 2016

Routing and Remote Access in Windows Server 2016 (Part 1): Install Remote Access Role

Introduction This is the first of a 4-part "Routing and Remote Access in Windows Server 2016" series.

ADVERTISEMENTS

RECENT POSTS

How to Logout of Amazon App

How to Logout of Amazon App (from Android, iPhone or Windows 10)

This Itechguide teaches you how to logout of Amazon app. The guide offers steps to logout of Amazon app for Android, for...
How to Turn off YouTube Notifications

How to Turn off YouTube Notifications (PC or YouTube Apps)

This Itechguide teaches you how to turn off YouTube notifications. The guide offers steps to turn off YouTube notifications from a PC...
How to Change YouTube Thumbnail

How to Change YouTube Thumbnail (PC or YouTube Studio App)

This Itechguide teaches you how to change YouTube thumbnail. The guide offers steps to change YouTube thumbnail from a PC or...
How to Add Bullet Points in Google Slides

How to Add Bullet Points in Google Slides (Android or iOS Apps or PC)

This Itechguide teaches you how to add bullet points in Google Slides. The guide offers steps to add bullet points in Google...
How to Change Shipping Address on Amazon

How to Change Shipping Address on Amazon

This Itechguide teaches you how to change shipping address on Amazon. The guide offers steps to change shipping address on Amazon:

MUST READ

How to PM on Facebook

How to PM on Facebook (Send a Private Message on Facebook)

Introduction If you are looking to send a friend a private message (PM) on Facebook, you are in the...

GPUPDATE (Group Policy Update Command): Syntax, Parameters, Examples

GPUPDATE Meaning (and What It Does) GPUPDATE means Group Policy Update Command. It is a Windows command line tool...
PowerShell-NoTypeInformation

Powershell NoTypeInformation: Applications and Examples

Powershell NoTypeInformation: Why So Much Interest? I chose to write on 'Powershell -NoTypeInformation' because so many people ask questions...
How-to-Find-People-on-Facebook

How to Find People on Facebook (Basic and Advanced Search)

Introduction There is more than one available option to find people on Facebook - you can perform a basic...
dism /online vs /image

The Difference Between DISM /Online and DISM /Image Commands

What is DISM /Online vs /Image? In comparing DISM /online vs /image, while DISM /online targets the running operating...

LATEST DEALS

Exclusive Student Offer_Save 10% on selected Surface devices

By using this website you agree to accept our Privacy Policy and Terms & Conditions