--- title: "How to Verify Applied GPOs with the GPResult Tool" description: "Learn how to discover RSOP and other applied Group Policy settings with the handy gpresult command-line tool." canonical: "https://adamtheautomator.com/gpresult/" --- # How to Verify Applied GPOs with the GPResult Tool > Learn how to discover RSOP and other applied Group Policy settings with the handy gpresult command-line tool. Source: https://adamtheautomator.com/gpresult/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to Verify Applied GPOs with the GPResult Tool](https://adamtheautomator.com/wp-content/uploads/2021/05/How-to-Verify-Applied-GPOs-with-the-GPResult-Tooll.jpg) # How to Verify Applied GPOs with the GPResult Tool [![](https://secure.gravatar.com/avatar/c14b031fe4a12b0e3f4d1e112e37261df83921ddc370cdafbad2a614e36f0cf4?s=192&d=mm&r=g)Chaitanya](https://adamtheautomator.com/author/chaitanya-g/)27 May 20216 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/) Table of Contents * [Prerequisites](#h-prerequisites) * [Understanding the GPResult Command](#h-understanding-the-gpresult-command) * [Getting Help with GPResult](#h-getting-help-with-gpresult) * [Retrieving Resultant Set of Policy (RSOP) Data](#h-retrieving-resultant-set-of-policy-rsop-data) * [Getting Granular: Finding Detailed Applied Group Policy Info](#h-getting-granular-finding-detailed-applied-group-policy-info) * [Limiting GPresult to User or Computed-Based Settings](#h-limiting-gpresult-to-user-or-computed-based-settings) * [Exporting GPresult Output](#h-exporting-gpresult-output) * [Exporting Results to a Text File](#h-exporting-results-to-a-text-file) * [Exporting Results to an HTML or XML File](#h-exporting-results-to-an-html-or-xml-file) * [Running GPResult Remotely](#h-running-gpresult-remotely) * [Conclusion](#h-conclusion) Have you ever applied a [Group Policy Object (GPO)](https://adamtheautomator.com/what-is-group-policy/) to an Active Directory organizational unit (OU) and wanted to verify whether or not they are applied? If so, you need to understand the `gpresult` command. > _Scan Your AD for 930+ Million Compromised Passwords. [Download Specops Password Auditor](https://specopssoft.com/product/specops-password-auditor/?utm_source=ata&utm_medium=referral&utm_campaign=na_2023_ata&utm_content=mention), a FREE read only tool that identifies password-related vulnerabilities._ In this tutorial, you will learn how to use the `gpresult` command to verify Group Policy settings on local and remote Windows machines. Let’s get started! ## Prerequisites If you’d like to follow along with the examples in this tutorial, be sure you have the following: * An Active Directory domain. Any version will work. This tutorial will be using a domain called _HomeLab.Local_. * A domain-joined Windows PC with at least one GPO [applied to it](https://docs.microsoft.com/en-us/previous-versions/windows/desktop/policy/applying-group-policy). If you’d like to learn how to invoke `gpresult` remotely, you’ll need a second domain-joined PC. This tutorial will use two Windows 10 computers called _Win10VM1_ and _Win10VM2_. * Local administrator rights on your local PC and remote PC. ## Understanding the GPResult Command GPResult is a command-line tool built into Windows that generates reports on policies applied to a domain-joined computer for both user-based and computer-based policies. When an Active Directory admin assigns a GPO to an OU, the computers or users in that OU then check in to apply those settings. When the target computers receive the GPO is where `gpresult` comes in. _The time that each computer actually receives and applies those settings depends on the [Group Policy refresh interval](https://adamtheautomator.com/gpupdate/#How_Gpupdate_Works)._ The `gpresult` utility allows you to run a command on these target computers to confirm the GPOs you think should be applied actually are. Related:[Understanding the GPUpdate Command](https://adamtheautomator.com/gpupdate/) ## Getting Help with GPResult Like many other command-line utilities, `gpresult` has a simple built-in help system. This help system lets you easily find all of those hard-to-remember switches. You can find all of the switches `gpresult` provides by simply running `gpresult` with no switches as shown below. Rather than coming back to this post when you’re wondering what a parameter does, remember the built-in help exists! ![Help information for gpresult command](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-53.png) Help information for gpresult command ## Retrieving Resultant Set of Policy (RSOP) Data Running `gpresult` with no parameters will only show help information. You need it to retrieve some information! To start out, let’s first cover how the `/r` switch or _resultant set of policy_ works. [Resultant Set of Policy (RSOP)](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265978\(v=ws.11\)) is a Group Policy add-on that allows you to query various aspects of Group Policy. RSOP is a great way to discover the _result_ of the policy assigned to a computer. > _`GPResult` displays RSOP data in [logging mode](https://docs.microsoft.com/en-us/previous-versions/windows/desktop/policy/supporting-rsop-logging-mode) which includes policy settings like user and computer OU path, domain name, AD group memberships, security settings, and applied GPOs for both users and computers._ To use `gpresult` to query RSOP data, open _cmd.exe_ or PowerShell [as administrator](https://adamtheautomator.com/powershell-run-as-administrator/). invoke `gpresult` with the `/r` switch as shown below. ```bash Gpresult /R ``` You can see below that, among other things, `gpresult` returns all of the GPOs that the particular computer (**COMPUTER SETTINGS**) and GPOs targeting all users that will log onto the computer (**USER SETTINGS**). > _You can run `gpresult /R` on a non-admin command prompt but it will only show policies applied to the user who is running the command._ ![Displaying output for Gpresult /R command](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-54.png) Displaying output for Gpresult /R command ## Getting Granular: Finding Detailed Applied Group Policy Info If you simply need to discover what GPOs are applied to a particular computer or user(s) on that computer, the RSOP data you get from the `/r` switch will work. But RSOP data only goes so far. RSOP data does not provide information such as the last execution time of a logon script, the registry key the GPO is created in, and more. To discover as much information as `gpresult` can provide, use the `/v` or _verbose_ switch as shown below. ```bash Gpresult /V ``` Check out just all of the information that `/v` provides. That’s a lot of information! ![Verifying GPOs applied on the computer](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-55.png) Verifying GPOs applied on the computer ![Password policies applied on the computer](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-56.png) Password policies applied on the computer ![Services disabled on the computer](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-57.png) Services disabled on the computer ![Verifying Logon Scripts configured for user](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-58.png) Verifying Logon Scripts configured for user ![Wallpaper set via user policy in GPO](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-59.png) Wallpaper set via user policy in GPO ![Full registry key path for the policies](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-60.png) Full registry key path for the policies ![Verifying GPOs applied for user](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-61.png) Verifying GPOs applied for user Check out the differences in `/r` and `/v` below. You’ll see that `/r` only provides the GPO name while `/v` provides the logon script file name and last time the script executed on the computer. ![Differences in /r and /v](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-62.png) Differences in /r and /v ## Limiting GPresult to User or Computed-Based Settings As mentioned, `gpresult`, by default, returns both user and computer-based settings. Sometimes, especially when managing GPOs with hundreds of settings, the amount of output may get overwhelming. If you need to only look for settings applied to the computer or user, `gpresult` allows you to limit the _scope_ of the query using the `/scope` parameter. By specifying either `computer` or `user` as the `/scope` parameter argument, `gpresult` will only return settings applied to all users or the computer. To see RSOP data for all policies in the `computer` scope, run the below command. ```bash Gpresult /R /Scope computer ``` How about finding all policies in verbose mode for all users only? ```bash Gpresult /V /Scope user ``` > _The `/scope` parameter can be used in addition to other switches like `/r` and `/v` to limit the scope of either command._ If you’re running _cmd.exe_ or PowerShell as administrator and invoke GPResult, it will return Group Policy settings for all users. If you use the `/scope user` switch, it will remove computer-based settings but will still return settings for _all_ users. If you need to limit settings to a single user _logged on at the same time_, use the `/user` parameter followed by the desired username as an argument. ```powershell Gpresult /R /user user01 ``` > _If you attempt to query RSOP data for a user that doesn’t exist, GPResult will return the message `The user "" does not have RSOP data`_. ## Exporting GPresult Output Sometimes just returning information to the command-line console isn’t enough. Perhaps you need to build a report or share the results with someone else. In that case, you need to export results to some other format. You can export GPResult output in a few different ways. ### Exporting Results to a Text File One of the easiest ways to export results to a file is using the [command prompt or PowerShell’s output redirection feature](https://ss64.com/nt/syntax-redirection.html). By “piping” the command-line results to a file with the redirection operator `>` followed by a text file name, the text will contain exactly what you’d see in the console. The below command would return all RSOP data and create a file called _C:\\Temp\\RsopReport.txt_ containing the entire results of the GPResult command. ```bash Gpresult /R > c:\Temp\RsopReport.txt ``` Related:[Redirecting Output to a File with the PowerShell Out-File Cmdlet](https://adamtheautomator.com/out-file/) ### Exporting Results to an HTML or XML File Unlike the native redirection from a command prompt to a text file, you can also generate and save the applied policy information to an HTML or XML file. Using the `/H` switch (for HTML) or the `/X` switch (for XML) followed by the path to the requested HTML file, GPResult will create a nicely-formatted HTML file with output. ```bash Gpresult /H c:\Temp\RsopData.html Gpresult /X c:\Temp\RsopXMLRreport.xml ``` > _If the file already exists, GPResult will return an error. Force GPResult to overwrite the existing file by using the `/F` switch._ ## Running GPResult Remotely Throughout this tutorial, you’ve been running GPResult locally. Using the `/s` parameter, GPResult can also run retrieve all of the same Group Policy settings remotely too. For example, to find RSOP data for the user **user01** that has logged onto the remove **win10vm1** computer at least once, you’d run the following: ```bash gpresult /R /S win10vm1 /user user01 ``` ![Finding RSOP data](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-63.png) Finding RSOP data Maybe you’re logged into a computer that doesn’t have rights to query Group Policy information on a remote computer. In that case, GPResult will fail unless you specify alternate credentials. Specify alternate credentials by using the `/U` (username) and `/P` (password) parameters as shown below. ```bash gpresult /R /S win10vm1 /scope user /U homelab\MyLabAdmin /P password ``` ![Specify alternate credentials](https://adamtheautomator.com/wp-content/uploads/2021/05/Untitled-65.png) Specify alternate credentials > _Are compromised passwords lurking in your Active Directory? Download Specops Password Auditor and [scan for password vulnerabilities for FREE!](https://specopssoft.com/product/specops-password-auditor/?utm_source=ata&utm_medium=referral&utm_campaign=na_2023_ata&utm_content=mention)_ ## Conclusion You should now know how to use the GPResult command to query applied Group Policy settings on both local and remote computers. This handy command is a great discovery and troubleshooting tool in any Active Directory admin’s arsenal. The next time you find yourself wondering, “How do I confirm a domain-joined computer has applied the GPO I expect?”, what tool will you use? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fgpresult%2F&text=How%20to%20Verify%20Applied%20GPOs%20with%20the%20GPResult%20Tool)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fgpresult%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fgpresult%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-11.webp) ### [How to Troubleshoot Active Directory Replication Errors](/troubleshoot-active-directory-replication-errors/) Troubleshoot Active Directory replication errors by isolating 1311, 1722, 2087, and USN rollback issues with repadmin, dcdiag, DNS, RPC, and KCC checks. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-7.webp) ### [Migrate Group Policy to Intune Without Breaking Endpoints](/gpo-intune-migration/) Export GPOs as XML, analyze them with Group Policy Analytics, migrate supported settings to Intune Settings Catalog, and resolve hybrid device conflicts. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/ditch-gpos-intune-featured.webp) ### [Ditch the GPOs: Migrate to Microsoft Intune](/ditch-gpos-migrate-microsoft-intune-2/) Use Group Policy Analytics to migrate GPOs to Intune Settings Catalog profiles, handle unsupported Group Policy Preferences, and manage hybrid AD-to-MDM transitions. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)