--- title: "How to use RSOP to Inspect Applied GPO Settings" description: "Learn how to find all of the policy settings those GPOs applied to a computer and user locally or remotely with the RSOP (resultant set of policy) tool." canonical: "https://adamtheautomator.com/rsop/" --- # How to use RSOP to Inspect Applied GPO Settings > Learn how to find all of the policy settings those GPOs applied to a computer and user locally or remotely with the RSOP (resultant set of policy) tool. Source: https://adamtheautomator.com/rsop/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to use RSOP to Inspect Applied GPO Settings](https://adamtheautomator.com/wp-content/uploads/2021/06/How-to-use-RSOP-to-Inspect-Applied-GPO-Settings.jpg) # How to use RSOP to Inspect Applied GPO Settings [![](https://secure.gravatar.com/avatar/c14b031fe4a12b0e3f4d1e112e37261df83921ddc370cdafbad2a614e36f0cf4?s=192&d=mm&r=g)Chaitanya](https://adamtheautomator.com/author/chaitanya-g/)29 June 20218 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[Group Policy](/tag/group-policy/) Table of Contents * [Prerequisites](#h-prerequisites) * [What is the RSOP tool?](#h-what-is-the-rsop-tool) * [Modes](#h-modes) * [Inspecting Locally-Applied GPOs with RSOP](#h-inspecting-locally-applied-gpos-with-rsop) * [Testing Policy Changes with RSOP’s Planning Mode](#h-testing-policy-changes-with-rsop-s-planning-mode) * [Inspecting Remotely-Applied GPOs with RSOP](#h-inspecting-remotely-applied-gpos-with-rsop) * [Conclusion](#h-conclusion) When you apply an Active Directory (AD) [Group Policy Object (GPO)](https://adamtheautomator.com/what-is-group-policy/) across hundreds or even thousands of target computers, chances are it’s going to take a while for them all to receive it. How do you know when a computer receives a new policy or retrieves updated policy settings? Using the RSOP tool. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** The RSOP tool or [Resultant Set Of Policy](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265978\(v=ws.11\)), is a built-in Windows tool that allows you to discover what policy settings are applied to local and remote computers. If you’re wondering what configuration GPOs are setting on your PC, read on! Related:[How to Verify Applied GPOs with the GPResult Tool](https://adamtheautomator.com/gpresult/) Let’s get started. ## Prerequisites This tutorial will run through a few different demos. If you’d like to follow along, be sure you have the following: * An Active Directory domain – Any version of AD will work. This tutorial will use a domain called _HomeLab.Local_. * A domain-joined Windows PC with at least one GPO applied to it to test local GPOs. This tutorial will use a PC called _Win10VM1_. * A second domain-joined Windows PC if you want to run RSOP remotely. This tutorial will use a PC called _Win10VM3_. * TCP ports 445, 135, [RPC dynamic ports](https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-rpc-dynamic-port-allocation-with-firewalls), and [all ports for WMI](https://docs.microsoft.com/en-us/windows/win32/wmisdk/setting-up-a-fixed-port-for-wmi) open on the remote computer. You can create a starter GPO called [Group Policy Reporting Firewall Ports](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj572986\(v=ws.11\)#:~:text=starter%20gpo%20called%2C%20group%20policy%20reporting%20firewall%20ports) to ensure all ports are open. * Local administrator rights on both the local PC and remote PC. * A GPO with an [AD group configured with deny permissions](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/assign-security-group-filters-to-the-gpo#to-prevent-members-of-a-group-from-applying-a-gpo). _DeniedGPOUsers_ AD group with no users added to it and deny permissions will be used in this tutorial. ## What is the RSOP tool? When you assign a GPO to a computer in Active Directory, that computer should reach out to the domain controller and, based on the defined [GPO refresh interval](https://social.technet.microsoft.com/wiki/contents/articles/31623.modify-group-policy-refresh-interval-for-computers.aspx), soon see that GPO and attempt to apply the settings the GPO defines. Related:[What is Group Policy and How Does it Work (In Detail)](https://adamtheautomator.com/what-is-group-policy/) When the computer applies the GPO settings, those policy settings are then stored on the computer in the [Common Information Management Object Model (CIMOM)](https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/large-wmi-repository-cause-slow-logon#:~:text=rsop%20uses%20the%20cimom%20database%20through%20wmi) database using the [Windows Management Instrumentation (WMI)](https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page). To inspect those applied settings, run the RSOP tool. The RSOP tool generates a report on the policies that are applied (or planned) for users and computers on the PC. > __RSOP is great for troubleshooting instances where you have multiple, conflicting policies. Using RSOP, you can inspect which GPOs took precedence and overrode another.__ ### Modes RSOP has two different modes to help you with discovering how GPOs affect target computers; logging and planning mode. * Logging mode – The most common use of RSOP that’s used to generate a report on all applied policies for all logged-on users and the computer itself. * Planning mode – A less common use of RSOP that allows you to simulate what settings will apply to a computer _if_ one or more GPOs were applied to them. Planning mode works to determine what will happen when a user is moved to a different AD group, for example. ## Inspecting Locally-Applied GPOs with RSOP Let’s now get started with some hands-on demonstrations of RSOP. First, let’s cover how to bring up the RSOP tool and what kind of information you can expect to see. On your local, domain-joined Windows PC, open a command prompt or PowerShell window as an administrator. Related:[How to Run PowerShell as Administrator](https://adamtheautomator.com/powershell-run-as-administrator/) > __If you don’t run a command prompt or PowerShell as administrator, RSOP will not have access to the computer settings (only logged-in user settings). When you run RSOP, you will receive an error indicating you have insufficient permissions.__ Next, run the command `rsop.msc`. This action will bring up the RSOP [MMC snap-in](https://docs.microsoft.com/en-us/previous-versions/windows/desktop/mmc/snap-ins). When you bring up RSOP, it will immediately begin reading all applied policies and generating a report. RSOP defaults to _logging_ mode. Below you’ll see the results of running RSOP on a computer called _WIN10VM1_ logged in as a user called _LabAdmin_. Expand each of the folders and you’ll see every setting across _all_ GPOs that are applied to that particular user or computer. > __If you do not see an expected GPO setting for a recently-created GPO, run the_ [gpupdate /force command](https://adamtheautomator.com/gpupdate/) _on the PC to manually refresh the policy settings.__ ![Running the gupdate force command](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T125515.830.png) Running the gupdate force command For example, below you’ll see a _local policy_ called **HostName.bat** assigned to the **user logon** on the PC. Inside the policy is a batch file called _HostName.bat_ under **User Configuration —> Windows Settings —> Scripts —> Logon**. ![Local Group Policy Editor](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled.png) Local Group Policy Editor Running RSOP on a computer that has local policy configured, you’ll see the Logon script applied and the Policy Name that applied it. ![Resultant Set of Policy console](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-1.png) Resultant Set of Policy console ## Testing Policy Changes with RSOP’s Planning Mode Perhaps you’re ready to roll out an important GPO to many computers. You _could_ “test in production” by applying it immediately to all computers at once, or you could use RSOP’s planning mode. Using planning mode, you can simulate many different scenarios if you’d apply a GPO to a computer such as when: * The target PC has a slow network connection * You enable [loopback processing](https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy) * The target PC has many GPOs applied to it to test [policy precedence](https://emeneye.wordpress.com/2016/02/16/group-policy-order-of-precedence-faq/) * A user logs onto the target PC or the computer account is in different AD groups and an AD group is denied permission to the GPO. * A user or computer is moved between domains, OUs or even AD sites. * A [WMI filter](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo) is applied to an OU Planning mode will help you account for all of the conditional variables that GPOs can throw at you. To run RSOP in planning mode: 1\. Open a command prompt or elevated PowerShell console and type mmc. This will open [MMC console](https://docs.microsoft.com/en-us/troubleshoot/windows-server/system-management-components/what-is-microsoft-management-console). > __Note you cannot simply run rsop.msc in this instance. The only way to change the RSOP mode is when you add an MMC snap-in, as you’ll see.__ 2\. In the MMC console, open the File menu and click Add/Remove Snap-in, as shown below. ![MMC console Add/Remove option](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T125741.823.png) MMC console Add/Remove option 3\. In the **Add or Remove** Snap-ins dialog box, select **Resultant Set of Policy** and click **Add** to move the snap-in from the left window to the right window. ![Displaying Resultant Set of Policy option](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T125820.061.png) Displaying Resultant Set of Policy option 4\. Next, right click on the **Resultant Set of Policy** MMC snap-in, as shown below, click on **Generate RSOP Data** and **Next** to skip past the intro step. ![Generate RSoP Data option](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T125912.536.png) Generate RSoP Data option 5\. On the **Mode Selection** screen, select **Planning** mode and click Next to get to the **Computer Selection** screen. ![Selecting Planning mode option](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T125947.478.png) Selecting Planning mode option 6\. Next, click **Browse** under **User Information** to select the user that might be affected by an upcoming GPO. Also, click **Container** and **Browse** under **Computer Information** to select the OU that will contain a PC this user may be logging into. In the following screenshot, the simulation will provide all of the settings that a user called **HOMELAB\\User01** would receive if they were to log into any computer in the **Desktop VMs** OU. ![Select user OU and computer OU](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T130036.755.png) Select user OU and computer OU 7\. Now, select options if you’d like to simulate a few more situations: * [Group Policy’s slow link detection](https://www.rebeladmin.com/2015/05/group-policy-slow-link-detection/) * [Loopback processing](https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy) – Selecting **Replace** or **Merge** will replace/merge the user policy settings and computer policy settings in case of a conflict. * Site – To simulate the desktop being logged into’s AD site. Click **Next** when complete. ![Slow network connection and loopback processing mode](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T130124.824.png) Slow network connection and loopback processing mode 8\. If you don’t plan on directly applying the GPO to the OU that the user or computer will be in, click **Browse** to change the OU for either object. When complete, click **Next**. > __In step six, you defined the OUs that the user and target computer would be located in. Here, you are defining the OU that you plan on applying the GPO to.__ ![Changing the path for the simulated applied GPO](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T130212.061.png) Changing the path for the simulated applied GPO 9\. Now, enter the AD group you plan for the user to be in by clicking Add. For this tutorial, the user will be in the _DeniedGPOUsers_ group. ![Displaying User Security Groups ](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T130335.094.png) Displaying User Security Groups You’ll see below that the DeniedGPOUsers group is denied from applying this GPO. ![Displaying custom permissions for DeniedGPOUsers AD group](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T130400.195.png) Displaying custom permissions for _DeniedGPOUsers_ AD group 10\. Next, for this tutorial, step through the screens for defining [WMI filters](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-wmi-filters-for-the-gpo) and computer groups. If, however, you do plan on setting up a WMI filter on the GPO or are denying/allowing GPO application by the AD group the computer account is in, you may make these simulated changes. 11\. Finally, on the summary screen, review all the details. Leave the Gather extended error information option enabled and click Next. When you enable the extended error information option, RSOP snap-in collects more error information when it performs the query. This error message includes network or AD issues that affect the policy when it is implemented. Enabling this option may greatly increase the time to process the simulation, but will provide more verbose information should an error occur. > _After RSOP console is generated, right click on computer configuration or user configuration node and click properties. Then click on Error information tab to view any errors that are generated while simulating the policy._ ![Summary Screen](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2.png) Summary Screen 12\. Once RSOP is complete, navigate through the folders under _Computer configuration_ and _User configuration_ to verify the policies that are applied. You’ll see two windows below; on the left, you’ll see the actual GPO applied (RSOP in logging mode) and on the right, you’ll see what RSOP would look like if the user were removed from the _DeniedGPOUsers_ AD group. ![GPO Applied](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T133015.118.png) GPO Applied ## Inspecting Remotely-Applied GPOs with RSOP To prevent having to go to each computer’s local console, RSOP also allows you to inspect settings remotely for both logging and planning mode. In in this demonstration, the tutorial will use logging mode. 1\. Open RSOP by running through steps 1-4 in the _Testing Policy Changes with RSOP’s Planning Mode_ section above. 2\. On the Mode Selection screen, choose Logging mode and click Next to come to the Computer Selection screen. ![Selecting Logging Mode](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T133058.806.png) Selecting Logging Mode 3\. On the **Computer Selection** screen, choose **Another computer** since you’re going to be querying a remote computer and click **Browse**_._ ![Selecting remote PC](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T133140.665.png) Selecting remote PC 4\. In the **Select computer box**, enter remote PC name and click **Check Names**. This action will search for the computer’s AD computer account. If found, it will underline the PC name, as shown below. ![Remote PC name](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T133226.014.png) Remote PC name 5\. Click **Next** on the **Computer Selection** screen. Here, you could select **Do not display policy settings for the selected computer in the results…** but you’re going to inspect both computer and user settings. ![Resultant Set of Policy wizard](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T133305.920.png) Resultant Set of Policy wizard 6\. Next, choose the user you’d like to inspect applied user policies for. You will see the list of users who have logged on to the remote computer at least once. Select a user from the list and click **Next**. > _Notice the **Current user** option is greyed out. RSOP doesn’t support finding the remotely logged-in user. You must explicitly pick one._ ![Selecting user on remote PC](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T133357.190.png) Selecting user on remote PC 7\. Uncheck the **Gather extended error information** checkbox. Click Next to continue. RSOP will now connect to the remote computer and attempt to retrieve all RSOP settings for both the selected user and the computer. ![Resultant Set of Policy Wizard gather extended error information option](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-4.png) Resultant Set of Policy Wizard gather extended error information option 8\. Click **Finish** when done. ![Resultant Set of Policy wizard complete](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T133604.038.png) Resultant Set of Policy wizard complete 9\. You will now the exact same MMC snap-in you did when inspecting local settings. But this time, the settings came from a remote PC. ![Verifying GPO on remote PC](https://adamtheautomator.com/wp-content/uploads/2021/06/Untitled-2021-06-26T133646.391.png) Verifying GPO on remote PC ## Conclusion The RSOP tool is handy when you need to quickly find all the applied GPO settings targeted to a computer or user. Using this tool allows you to see the _applied_ settings; not just all the settings for GPOs targeting a specific computer or user. Where do you see yourself using RSOP in the future? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Frsop%2F&text=How%20to%20use%20RSOP%20to%20Inspect%20Applied%20GPO%20Settings)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Frsop%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Frsop%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2021/02/Understanding-the-GPUpdate-Command-In-Depth.jpg) ### [Understanding the GPUpdate Command \[In Depth\]](/gpupdate/) If you need to quickly apply a group policy to your Windows system, you must learn how gpupdate works. ![](https://adamtheautomator.com/wp-content/uploads/2021/02/What-is-Group-Policy-and-How-Does-it-Work_-In-Detail.jpg) ### [Discover What is Group Policy and How it Works (In Detail)](/what-is-group-policy/) What is Group Policy? That’s the question we’re going to answer in this in-depth article. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-11.webp) ### [How to Troubleshoot Active Directory Replication Errors](/troubleshoot-active-directory-replication-errors/) Troubleshoot Active Directory replication errors by isolating 1311, 1722, 2087, and USN rollback issues with repadmin, dcdiag, DNS, RPC, and KCC checks. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)