Gpresult h gpreport html где сохраняется

Команда GPResult: диагностика результирующих групповых политик

15.11.2022
itpro
Active Directory, Windows 10, Windows Server 2019, Групповые политики
комментарий 21

Утилита командной строки GPResult.exe используется для получения результирующего набора групповых политик (Resultant Set of Policy, RSOP), которые применяются к пользователю и/или компьютеру в домене Active Directory. Gpresult позволяет вывести список доменных политик (GPO), которые применяются на компьютер и пользователя, настройки политик и ошибки обработки. Это наиболее часто используемый инструмент администратора для анализа настроек и диагностики групповых политик в Windows.

В этой статье мы рассмотрим, как использовать команду GPResult для диагностики и анализа настроек групповых политик, применяющихся к Windows в домене Active Directory.

Использование команды GPResult в Windows

Команда GPResult выполняется на компьютере, на котором нужно проверить применение групповых политик. Синтаксис GPResult:

GPRESULT [/S <система> [/U <пользователь> [/P <пароль>]]] [/SCOPE <область>] [/USER <имя_конечного_пользователя>] [/R | /V | /Z] [(/X | /H) <имя_файла> [/F]]

Чтобы получить подробную информацию о групповых политиках, которые применяются к данном объекту AD (пользователю и компьютеру), и других параметрах, относящихся к инфраструктуре GPO (т.е. результирующие настройки политик GPO – RsoP), выполните команду:

Результаты выполнения команды разделены на 2 секции:

• COMPUTERSETTINGS(Конфигурация компьютера)– раздел содержит информацию об объектах GPO, действующих на компьютер в Active Directory;
• USERSETTINGS – раздел с политиками пользователя (политики, действующие на учетную запись пользователя в AD).

Вкратце пробежимся по основным параметрам/разделам, которые нас могут заинтересовать в выводе GPResult:

• SiteName (Имя сайта:)– имя сайта AD, в котором находится компьютер;
• CN – полное каноническое пользователя/ компьютера, для которого были сгенерированы данные RSoP;
• LasttimeGroupPolicywasapplied (Последнее применение групповой политики)– время, когда последний раз применялись (обновились) настройки GPO;
• GroupPolicywasappliedfrom (Групповая политика была применена с)– контроллер домена, с которого была загружена последняя версия GPO;
• DomainNameи DomainType (Имя домена, тип домена)– имя и версия схемы домена Active Directory;
• AppliedGroupPolicyObjects(Примененные объекты групповой политики) – списки действующих объектов групповых политик;
• ThefollowingGPOswerenotappliedbecausetheywerefilteredout (Следующие политики GPO не были применены, так как они отфильтрованы)— не примененные (отфильтрованные) GPO;
• Theuser/computerisapartofthefollowingsecuritygroups (Пользователь/компьютер является членом следующих групп безопасности) – список доменных групп безопасности, в которых состоит пользователь/пользователь.

В нашем примере видно, что на объект пользователя действуют 4 групповые доменные политики.

• Default Domain Policy;
• Enable Windows Firewall;
• DNS Suffix Search List; .

Также в отчете будет информацию о локальных параметрах политик, настроенных через локальный редактор GPO (gpedit.msc).

С помощью опции /scope можно вывести только политики пользователя или компьютера:

gpresult /r /scope:user

или только примененные политики компьютера:

gpresult /r /scope:computer

gpresult /r /scope:computer

Для удобства анализа данных RSOP, вы можете перенаправить результаты Gpresult в буфер обмена:

Gpresult /r |clip

или текстовый файл:

Gpresult /r > c:\gpresult.txt

Чтобы вывести сверхподробную информацию RSOP, нужно добавить ключ /z.

Например, на скриншоте показаны настройки политики паролей в домене, которые применяются к компьютеру.

GPResult: экспорт данных RSOP в HTML отчет

Утилита GPResult позволяет сгенерировать HTML-отчет по примененным результирующим политикам (доступно в Windows 7 и выше). Такой отчет содержит подробную информацию обо всех параметрах Windows, которые задаются групповыми политиками и именами GPO, которые внесли изменения. Этот отчет по структуре напоминает вкладку Settings в консоли управления доменными групповыми политиками ( gpmc.msc ). Сгенерировать HTML отчет GPResult можно с помощью команды:

GPResult /h c:\gp-report\report.html /f

Чтобы сгенерировать отчет и автоматически открыть его в браузере, выполните команду:

GPResult /h GPResult.html & GPResult.html

В HTML отчете gpresult содержится довольно много полезной информации: видны ошибки применения GPO, время применения конкретных политик (в мс.) и CSE (в разделе Computer Details -> Component Status). Это удобно, когда нужно понять почему групповые политики (GPP/GPO) применяются на компьютере слишком долго.

Например, на скриншоте выше видно, что политика Enforce password history с настройками 24 passwords remember применена политикой Default Domain Policy (столбец Winning GPO).

HTML отчет позволяет представить результирующий набор GPO компьютера в удобном графическом виде.

Получение отчета по политикам GPResult с удаленного компьютера

GPResult может получить информацию о результирующих политик с удаленного компьютера.

GPResult /s wks22123 /r /user a.ivanov

В команде gpresult можно указать имя и пароль для подключения к удаленному компьютеру:

gpresult /R /S wks22123 /scope user /U winitpro\kbuldogov /P [email protected]$$worrd

Если вы не хотите, чтобы ваш пароль сохранялся в истории команд PowerShell, можно запросить пароль интерактивно:
gpresult /R /S wks22123 /scope user /U winitpro\kbuldogov /P

Аналогичным образом вы можете удаленно собрать данные как по пользовательским политикам, так и по политиками компьютера.

Если вы не знаете имя пользователя, под которым выполнен вход, можно узнать учетную запись на удаленном компьютере так:

Get-GPResultantSetOfPolicy -user kbuldogov -computer corp\pc0200 -reporttype html -path c:\ps\gp_rsop_report.html

Пользователь не имеет данных RSOP

Если на компьютере включен UAC, то GPResult без повышенных привилегий выведет только параметры пользовательского раздела групповых политик. Если нужно одновременно отобразить оба раздела (USER SETTINGS и COMPUTER SETTINGS), открыть командную строку с правами администратора. Е

сли командная строка с повышенными привилегиями запущена от имени учетной записи отличной от текущего пользователя системы, утилита выдаст предупреждение INFO: The user “domain\user” does not have RSOP data (Пользователь «domain\user» не имеет данных RSOP). Это происходит потому, что GPResult пытается собрать информацию для пользователя, ее запустившего, но т.к. данный пользователь не выполнил вход (logon) в систему, информация RSOP для него отсутствует. Чтобы собрать информацию RSOP по пользователю с активной сессией, нужно указать его учетную запись:

gpresult /r /user:tn\edward

Если вы не знаете имя учтённой записи, которая залогинена на удаленном компьютере, учетную запись можно получить так:

Также проверьте время (и часовой пояс) на клиенте. Время должно соответствовать времени на PDC (Primary Domain Controller).

Следующие политики GPO не были применены, так как они отфильтрованы

При отладке и траблшутинге применения групповых политик стоит также обращать внимание на секцию: The following GPOs were not applied because they were filtered out (Следующие политики GPO не были применены, так как они отфильтрованы). В этой секции отображается список GPO, которые по той или иной причине не применяются к этому объекту. Возможные варианты, по которым политика может не применяться:

• Filtering: NotApplied(Empty) (Фильтрация:Не применено (пусто)) – политика пустая (применять, нечего);
• Filtering: Denied(UnknownReason) (Фильтрация:Не применено (причина неизвестна)) – скорее всего у пользователя или компьютера отсутствуют разрешения на чтение/применение этой политики. Разрешения настраиваются на вкладке Security в консоли управления доменными GPO — GPMC (Group Policy Management Console);
• Filtering: Denied (Security) (Фильтрация: Отказано (безопасность)) — в секции Apply Group Policy указан явный запрет в разрешении Apply group policy либо объект AD не входит в список групп в разделе настроек Security Filtering.

Также вы можете понять должна ли применяться GPO к organizational unit (OU) в AD на вкладке эффективных разрешений (Advanced -> Effective Access).

Оснастка результирующих политик RSoP в Windows

Изначально для диагностики применения групповых политик в Windows использовалась графическая консоль RSOP.msc . Эта оснастка позволяет получить настройки результирующих политик (доменных + локальных), примененных к компьютеру и пользователю в графическом виде аналогичном консоли редактора GPO. На скриншоте показа вид консоли RSOP.msc в которой видно, что настройки Windows Update на компьютере заданы доменной политикой WSUS_SERVERS.

В современных версиях Windows RSOP.msc не получится использовать для полноценного анализа примененных GPO. Она не отражает настройки, примененные через расширения групповых политик CSE (Сlient Side Extensions), таких как GPP (Group Policy Preferences), не позволяет выполнять поиск, предоставляет мало диагностической информации. В Windows 10 и 11 при запуске rsop.msc появилось предупреждение, что основной инструмент для диагностики применения GPO это утилита gpresult.

В этой статье мы рассмотрели, как использовать утилиту GPResult для анализа результирующих групповых политик, которые применяются в Windows. Также для анализа применения GPO в домене рекомендуем использовать инструкции из статьи “Почему групповая политика не применяется к компьютеру или OU”.

Предыдущая статья Следующая статья

Using GPResult Command to Check Applied GPOs and RSoP Data

The GPResult.exe command-line tool is used to get a Resultant Set of Policy (RSoP) that is applied to a user and/or computer in an Active Directory domain. GPResult allows you to display a list of domain policies (GPOs) that are applied to the computer and user, policy settings, GPO processing time and errors. It is the most commonly used administrator tool for analyzing settings and troubleshooting Group Policy issues in Windows.

In this article, we’ll take a look at how to use the GPResult command to diagnose, debug, and analyze Group Policy settings applied to Windows in an Active Directory domain.

How to Use the Group Policy Results (GPResult.exe) Command?

You must run the GPResult command on the computer on which you want to check the application of Group Policy. The syntax for GPResult is:

GPRESULT [/S system [/U username [/P [password]]]] [/SCOPE scope] [/USER targetusername] [/R | /V | /Z] [(/X | /H) <filename> [/F]]

To get detailed information about the Group Policies applied to a specific user or computer, as well as other settings related to the GPO infrastructure (the resulting GPO policy settings, RsoP), open the command prompt and run this command:
Gpresult /r
The results of this command are divided into two sections:

• COMPUTER SETTINGS– the section contains the information on the GP objects applied to the computer (as an Active Directory object);
• USER SETTINGS – this is a user policy section (the policies applied to the account of the AD user).

Let’s briefly cover the basic settings/sections in the GPResult output that can be of interest for administrators:

• Site Name – is the name of the AD site where the computer is located;
• CN – full canonical user/computer name for which RSoP data was generated;
• Last time Group Policy was applied – is the time when the Group Policy settings were last applied (updated);
• Group Policy was applied from – is the domain controller name from which last GPO versions has been downloaded;
• Domain Name and Domain Type – is the name and the version number of the Active Directory domain schema;
• Applied Group Policy Objects – are the lists of applied GPOs;
• The following GPOs were not applied because they were filtered out
• The user is a part of the following security groups – a list of domain security groups the user is a member of.

In this example, you can see that 4 Group Policies are applied to the user object.

;
• DNS Suffix Search List;
• Enable Windows Firewall;
• Default Domain Policy.

The report will also contain information about local policy settings configured through the Local Group Policy Editor ( gpedit.msc ).

You can use the /scope option to display only user or computer policies:
gpresult /r /scope:user
or only applied computer policies:
gpresult /r /scope:computer

For the convenience of parsing and analyzing RSOP data, you can redirect the Gpresult results to the clipboard:
Gpresult /r |clip
or a text file:
Gpresult /r > c:\ps\gpresult.txt
To display more detailed RSoP information, you need to add the /z key:
Gpresult /r /z
For example, the screenshot shows the domain password policy settings that are applied to the computer.

Exporting RSoP Report to HTML with GPResult

GPResult allows you to generate an HTML report on the applied resultant policies (available in Windows 7 and newer). This report contains detailed information on all system settings that are set by the Group Policies and the names of the GPOs that have set them. The gpresult HTML report is structurally similar to the Settings tab in the Group Policy Management Console ( gpmc.msc ). You can generate the RSoP HTML report using the following gpresult command:
GPResult /h c:\PS\gpo-report.html /f

To generate the report and automatically open it in a browser, run the following command:
GPResult /h GPResult.html & GPResult.html
The gpresult HTML report contains quite a lot of useful information: you can see GPOs applying errors, processing time (in ms) for a specific policy and CSEs (in the Computer Details -> Component Status section). This is useful when you need to understand why GPO processing takes a long time.

For example, in the screenshot above you can see that the Enforce password history policy with the settings “24 passwords remembered” is applied by the Default Domain Policy (Winning GPO column).

An HTML report allows you to present the resulting set of computer GPOs in a convenient graphical form.

GPResult: Getting RSOP Data from a Remote Computer

GPResult can get a resultant set of policies from a remote computer as well with no need to log locally or via the RDP on to the remote device.
GPResult /s remote-pc-name1 /r
You can specify a username and password to connect to a remote computer using the gpresult options:

gpresult /R /S wks2b21c /scope user /U corp\jsmith /P myPaSSw0rd1!

If you don’t want your password to be saved in the PowerShell command history, you can prompt for the password interactively:

gpresult /R /S wks2b21c /scope user /U corp\jsmith /P

Similarly, you can remotely collect data on both user and computer policies.

If you don’t know the name of a user who is logged on to a remote computer, you can get a username like this:

Get-GPResultantSetOfPolicy -user jsmith -computer corp\wks2b21c -reporttype html -path c:\ps\gpo_rsop_report.html

GPResult: The User Does Not Have RSoP Data

When the UAC is enabled and GPResult is used in non-elevated mode, only the user settings section of the Group Policies is shown. If you need both sections (USER SETTINGS and COMPUTER SETTINGS) to be displayed, the command must be running in the command prompt with the administrator privileges.

If an elevated command prompt is run on behalf of an account that is different from the current user, the tool will show the warning: INFO: The user “domain\user” does not have RSOP data. This happens since GPResult tries to collect the data of the user that has started it, but because this user has not logged in, there is no RSOP information for him. To collect RSOP information for a user with an active session, you need to specify his account:
gpresult /r /user:corp\edward

Also, check the time (and timezone) on the client. The time must match the time on the domain controller running the FSMO PDC role (Primary Domain Controller).

The following GPOs Were Not Applied Because They Were Filtered Out

When troubleshooting the applied Group Policies, it’s worth paying attention to the section: The following GPOs were not applied because they were filtered out. It contains the list of the GPOs that are not applied to this object for any reason. Here are some reasons why the GPOsare not applied to a specific Active Directory object:

• Filtering: Not Applied (Empty) – the policy is empty (there is nothing to apply);
• Filtering: Denied (Unknown Reason) – a user/computer is likely to have no permission to read/apply this policy. The permissions can be configured in the Security tab of the Group Policy Management Console ( gpmc.msc );
• Filtering: Denied (Security) — an explicit denial is specified in the section Apply Group Policy, or an AD object is not in the list of groups in the Security Filtering section of the GPO.

You can also see if a GPO should be applied to an organizational unit (OU) in AD or to a specific object on the effective permissions tab (Advanced -> Effective Access) in the GPMC.

Resultant Set of Policies (RSOP.msc) Snap-in in Windows

Initially, the graphical console RSOP.msc was used to diagnose applied Group Policies in Windows. This mmc snap-in allows you to get the settings of the resulting policies (domain + local) applied to the computer and the user in a graphical form that is similar to the GPO editor console. The RSOP.msc console on the screenshot below shows that the Windows update settings are configured by the WSUS_SERVERS policy.

You cannot use the RSOP.msc to fully analyze the applied GPOs in modern Windows versions. It doesn’t show settings applied through Client Side Extensions (CSE), such as GPP (Group Policy Preferences), doesn’t allow searches, and provides little diagnostic information. When running rsop.msc on Windows 10 and 11, there was a warning that you should use gpresult to get a full GPO report.

In this article, we looked at how to use the GPResult command to analyze the resultant Group Policies that are applied in Windows. In addition, the following guide may be helpful for troubleshooting GPOs in a domain: “Common issues that prevent Group Policy from being applied to clients”.

Where does gpreport.html get saved to on a Windows 7 PC

This topic has been locked by an administrator and is no longer open for commenting.

To continue this discussion, please ask a new question.

Read these next.

One PC unable to scan to folder.

Hopefully one of you has come across this before. I have a customer with two PCs that scan to folder. One cannot seem to get the scans while the other works completely fine. The one with the problem is the main computer they use. I actually set up the.

run batchfile at logon from locked session

I have a GPO that runs a .bat file which installs a program at startup. And this works perfectly fine. As long as the user restarts their computers. The problem is that, I need to find a way to deploy this without having to restart the computer. I kno.

Snap! — 3D Printed Rocket Launch, MAR10 Day, Proprietary Ink, Employment Games

Your daily dose of tech news, in brief. Welcome to the Snap! Flashback: March 10, 2000: Dot-Com Bubble Peaks (Read more HERE.) Bonus Flashback: March 10, 2006: Mars Reconnaissance Orbiter Reaches Red Planet (Read more HERE.) You need t.

Password Issue

I have a domain that i set up all users on. I have staff that also have laptops that they log in remotely from. Some of them are reporting that the password on the laptop differs from the domain password. Is this because the laptop needs this account to g.

What are your opinions on this job opportunity?

Currently, work at a small-medium business as an internal IT jr system administrator. I started casually applying around as there is little room for position growth here. I ended up getting a job offer at a small MSP, they are around 10 or so techs, and t.

Group Policy Diagnostics with GPResult Command

GPResult.exe – is a console application designed to analyze settings and diagnose group policies that apply to a computer and/or user in an Active Directory domain. Specifically, GPResult provides the resulting set of policies (RSOP), a list of applied domain policies (GPOs), their settings, and detailed information about processing errors. The utility has been part of the Windows operating system since Windows XP. The GPResult utility let you know whether a particular policy applies to a computer, which GPO has changed a particular Windows setting, and why it takes so long for GPP/GPO to apply, even if you’ve run gpupdate /force.

In this article, we will look at how you can use the GPResult command to troubleshoot and debug the application of Group Policy in an Active Directory domain.

Contents

• Resultant Set of Policies (RSOP)
• How to Use GPResult Utility
• How to Get RSOP HTML Report via GPResult
• How to Get GPResult Data From a Remote Computer
• How to Get RSOP Data for a Certain User
• Possible Reasons for GPOs to not Apply

Resultant Set of Policies (RSOP)

Initially, the RSOP.msc graphical console was used to diagnose the application of group policies in Windows, which allowed the resulting policy settings (domain + local) to be applied to the computer and the user in a graphical interface similar to the GPO editor console.

Resultant Set of Policies (RSOP)

However, the RSOP.msc console does not make sense in modern versions of Windows, as it does not reflect the settings applied by various client side extensions (CSEs), such as GPP (Group Policy Preferences). Also, it does not allow searching, and provides little diagnostic information. Therefore, the GPResult command that is the primary tool for troubleshooting GPOs in Windows. Moreover, in Windows 10, there is even a warning that RSOP does not provide a full report as opposed to GPResult.

How to Use GPResult Utility

In order to check for group policy enforcement the GPResult command have to be run on the computer where you want to check for it. The GPResult command has the following syntax:

To learn more about Group Policies that apply to the following AD object (user and computer) and other settings related to the GPO infrastructure (i.e. the resulting GPO policy settings – RsoP), run the command:

The results of the command execution are divided into 2 sections:

• COMPUTER SETTINGS – this section contains information about GPO operating on the computer
• USER SETTINGS – user policies (policies that apply to the user account in AD)

Let’s briefly run through the main settings/partitions that may be useful in GPResult output:

• Site Name – the name of the AD site where the computer is located;
• CN – full canonical user/computer name for which RSoP data were generated;
• Last time Group Policy was applied – the time when Group Policy was last applied;
• Group Policy was applied from – the domain controller from which the latest version of the GPO was downloaded;
• Domain Name and Domain Type – the name and version of the Active Directory domain schema;
• Applied Group Policy Objects – lists of active Group Policy Objects;
• The following GPOs were not applied because they were filtered out – not applied, filtered GPOs;
• The user/computer is a part of the following security groups – domain groups that the user belongs to.

In our example, you can see that there are 3 Group Policies that apply to the user object.

• Default Domain Policy;
• Drive Mapping;
• Outlook Coding;

If you do not want the console to display both user and computer policies at the same time, you can use the /scope option to display only the needed section. For example here is the command for user settings:

And here is for the computer policies:

Since the Gpresult utility outputs its data directly to the command line console, which is not always convenient for further analysis, its output can be redirected to the clipboard:

To output RSOP super detailed information, you need to add the /z key:

How to Get RSOP HTML Report via GPResult

In addition, the GPResult utility can generate an HTML report on the applied resulting policies (available in Windows 7 and above). This report will contain detailed information about all system settings that are set by Group Policies. The resulting report is structured like the Settings tab in the Domain Group Policy Management Console (GPMC). You can generate a GPResult HTML report using the following command:

GPResult HTML Report

To generate a report and then automatically open it in your browser, follow the command:

The gpresult HTML report contains quite a lot of useful information:

• GPO’s application errors
• Processing time in ms
• Application of specific policies and CSE (that are located in Computer Details ⇒ Component Status)

As you can see, this HTML report is much more useful for analyzing the policies than the rsop.msc console.

How to Get GPResult Data from a Remote Computer

GPResult can also collect data from a remote computer, eliminating the need for the administrator to log on to the remote computer locally or via RDP. The syntax of the command to collect RSOP data from the remote computer is the following:

Similarly, you can remotely collect data by both user and computer policies.

How to Get RSOP Data for a Certain User

When UAC is enabled, running GPResult without elevated privileges displays only the user’s group policy settings. If you want to display both settings at the same time (User and computer settings), you need to run the command with administrative privileges. If the cmd.exe with elevated privileges is run on an account that differs from the current system user, the utility will generate an INFO warning: The user “domain\user” does not have RSOP data. This happens because GPResult is trying to collect information for the user who started it, but because the user has not logged on, there is no RSOP information for him. To collect RSOP information for a user with an active session, you need to specify their account:

If you do not know the name of an account that is logged on to a remote computer, the account can be obtained this way:

Also check the time (and time zone) on the client. The time must correspond to the time on the PDC (Primary Domain Controller).

Possible Reasons for GPOs to not Apply

While troubleshooting group policies, you should also take a look at the section: “The following GPOs were not applied because they were filtered out“. This section displays a list of GPOs do not apply to this object. Policy may not apply due to following options:

• Filtering: Not Applied (Empty) – the policy is empty (there’s nothing to apply);
• Filtering: Denied (Unknown Reason) – It is likely that the user or computer does not have permission to read/apply this policy. Permissions can be configured in the Security tab in the Group Policy Management Console (GPMC);
• Filtering: Denied (Security) – the “Apply Group Policy” section has an explicit deny permission, or the AD object is not listed in the Security Filtering section of the GPO settings.

You can also understand whether the policy should apply or not to a specific AD object on the Advanced ⇒ Effective Access tab.

So, these are all options for the Group Policies diagnostic features using the GPResult utility.