--- title: "How to Find (and Remove) Unlinked GPOS in Active Directory" description: "Unlinked GPOs can clutter up Active Directory if not maintained. Learn how to find all of these GPOs via the GUI and PowerShell in this article." canonical: "https://adamtheautomator.com/unlinked-gpo/" --- # How to Find (and Remove) Unlinked GPOS in Active Directory > Unlinked GPOs can clutter up Active Directory if not maintained. Learn how to find all of these GPOs via the GUI and PowerShell in this article. Source: https://adamtheautomator.com/unlinked-gpo/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to Find (and Remove) Unlinked GPOS in Active Directory](https://adamtheautomator.com/wp-content/uploads/2021/04/How-to-Find-Unlinked-Active-Directory-GPOs-in-Bulk.jpg) # How to Find (and Remove) Unlinked GPOS in Active Directory [![](https://secure.gravatar.com/avatar/c14b031fe4a12b0e3f4d1e112e37261df83921ddc370cdafbad2a614e36f0cf4?s=192&d=mm&r=g)Chaitanya](https://adamtheautomator.com/author/chaitanya-g/)30 April 20216 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/) Table of Contents * [Prerequisites](#h-prerequisites) * [Where do unlinked GPOs come from?](#h-where-do-unlinked-gpos-come-from) * [Finding Unlinked GPOs in the GPMC](#h-finding-unlinked-gpos-in-the-gpmc) * [Finding Unlinked GPOs with PowerShell](#h-finding-unlinked-gpos-with-powershell) * [Building an Unlinked GPO PowerShell Tool](#h-building-an-unlinked-gpo-powershell-tool) * [Conclusion](#h-conclusion) As an organization grows so does its Active Directory (AD) environment and [Group Policy (GP) infrastructure](https://docs.microsoft.com/en-us/azure/active-directory-domain-services/manage-group-policy). Group Policy Objects (GPOs) can soon get out of hand and before you know it, you’ve got dozens of unlinked GPOs cluttering up your environment. Let’s change that. In this tutorial, you’re going to learn how to discover all of those unlinked GPOs with both the [Group Policy Management Console (GPMC)](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11) and PowerShell. Let’s get crackin’! ## Prerequisites This article will be a tutorial with hands-on examples. If you’d like to follow along, make sure you have: * [An Active directory domain](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-active-directory-domain-services--level-100-). This article will be using a domain called _HomeLab.Local._ * A Windows computer joined to the AD domain. This tutorial will use Windows 10. * The Windows computer has the [Remote Server Administration Tools (RSAT) package installed](https://www.technipages.com/windows-install-group-policy-management-console). ## Where do unlinked GPOs come from? When you create a GPO and define all the settings, you intend to apply to client computers, that GPO isn’t actually doing anything. To actually affect client computers, the GPO must be _linked_ to an AD organizational unit (OU). Related:[What is Group Policy and How Does it Work? (In Detail)](https://adamtheautomator.com/what-is-group-policy/) As time progresses and more admins create GPOs, forget to link them, unlink GPOs from OUs, intend to remove them but never do, GPOs just sitting around doing nothing can proliferate. Especially in large organizations, unlinked GPOs can grow into the hundreds if not properly maintained. ## Finding Unlinked GPOs in the GPMC You can find unlinked GPOs in one of two ways; via the GPMC or via PowerShell. If you only have a handful of unlinked GPOs, it may make sense to use the GPMC rather than creating a PowerShell script. To find unlinked GPOs via the GPMC: 1\. Open the GPMC by going to your start menu and typing “group policy management”. When the GPMC program shows up, open it. 2\. In the GPMC, go to **Forest: **Domains** —> **,** right-click on the domain name and click **Search**. This action will bring up the **Search for Group Policy Objects** dialog box. ![Search option in GPMC console](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-4.png) Search option in GPMC console 3\. Click on the **Search Item** dropdown and select the **GPO-links**. This search item will search for GPOs that are linked to an OU. Change the **Condition** dropdown to be **Exist In** and the domain to be your domain. In the below screenshot, the combination of these settings will search for all GPOs linked to at least one OU in the _homelab.local_ domain. When you’re complete, click on **Add** to add the criteria. It will show up under the **All search criteria** section. ![Adding search item in "Search for Group Policy Objects" window](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-1-1.png) Adding search item in “Search for Group Policy Objects” window 4\. Now, click on the **Search** button to find all of the GPOs matching the search criteria. ![using search option in "Search for Group Policy Objects" window](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-2-1.png) using search option in “Search for Group Policy Objects” window 5\. As shown in the below screenshot, only linked GPOs are shown in the search results. ![Search results for linked GPOs](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-3-1.png) Search results for linked GPOs 6\. To find the unlinked GPOs, now manually compare all GPOs with the linked GPOs as shown below. In the screenshot below, only three GPOs are linked. By looking under the **Group Policy Objects** node, you can see two of the GPOs don’t show up (UnlinkedGPO1 and UnlinkedGPO2). That means they are not linked. > _This task will be time-consuming and why you’ll see how to perform this task via PowerShell in the next section._ ![Comparing search results with all the Group Policy Objects ](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-4-1.png) Comparing search results with all the Group Policy Objects Linked GPOs will have a link when they are assigned to an AD object like OU, as shown below. If you have only a handful GPOs, you can look for GPOs which has a link, and the ones which don’t have a link. GPOs which doesn’t have a link are unlinked GPOs. ![Displaying linked GPO](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-5-1.png) Displaying linked GPO ## Finding Unlinked GPOs with PowerShell Scouring through GPOs in the GPMC may work for a few GPOs, but you’re going to struggle if you’ve got hundreds or thousands of GPOs managing thousands of endpoints. In that case, it’s time to automate this process and to build a handy PowerShell tool. Assuming you’re on your local domain-joined Windows PC with RSAT installed: 1\. Open a Windows PowerShell console. 2\. Import the [GroupPolicy module](https://docs.microsoft.com/en-us/powershell/module/grouppolicy/?view=windowsserver2019-ps). The GroupPolicy module comes with RSAT and should already be installed on your system. This module contains all of the commands necessary to work with GPOs in PowerShell. ```powershell Import-Module GroupPolicy ``` 3\. Run the `Get-GPO` PowerShell cmdlet using the `All` parameter. This cmdlet queries AD and returns all of the GPOs found. ```powershell Get-GPO -All ``` ![Get-Gpo cmdlet output](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-6-1.png) Get-Gpo cmdlet output 4\. Now that you can query all of the GPOs in the domain, you must now figure out which ones are unlinked. To do that, run the [`Get-GPOReport` cmdlet](https://docs.microsoft.com/en-us/powershell/module/grouppolicy/get-gporeport?view=windowsserver2019-ps). This cmdlet allows you to provide a name and a type of output to return. ```powershell Get-GPOReport -Name SomeGPO -ReportType XML ``` Manually copy and paste one of the GPO names found in the step above and run this command. You’ll see that the cmdlet returns an XML report of all the settings the GPOs has. In particular, notice the section called `LinksTo`, as shown below. This section contains the `SOMPath` XML node that represents the path to the OU it’s linked to. ![Sample output containing LinksTo section](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-7-1.png) Sample output containing LinksTo section > _The `Get-GPOReport` cmdlet can only get a report for a single GPO at a time. This cmdlet only includes search results from domains and not from AD sites._ 5\. Now that you know how to find all GPOs with `Get-GPO` and the cmdlet to discover what they’re linked to (`Get-GPOReport`), combine them by copying and pasting the PowerShell command below in your console. The command below queries all GPOs in the domain (`Get-GPO`) and then generates an XML report for each of them (`Get-GPOReport`), only allowing the ones that don’t have a `` string in the report (`Select-String`) to be returned. ```powershell Get-GPO -All | Where-Object { $_ | Get-GPOReport -ReportType XML | Select-String -NotMatch "" } ``` In the tutorial’s environment, you can see in the below example _UnlinkedGPO1_ and _UnlinkedGPO2_ are not linked to any OU. ![](https://adamtheautomator.com/wp-content/uploads/2021/05/Get-Gpo.png) Listing out unlinked GPO in the domain ## Building an Unlinked GPO PowerShell Tool Let’s now put everything you’ve learned together and build a PowerShell script you might use in the real world. 1\. Open your favorite code editor and copy/paste the following PowerShell script into it. Save the script as _Remove-UnlinkedGPO.ps1_. This script: * Creates a folder with the current date to store unlinked GPO reports. * Finds all GPOs in AD that are unlinked. * Creates an HTML report for each unlinked GPO and saves it to disk. * Creates and appends to a text file a list of all unlinked GPOs. * Removes each unlinked GPO with a confirmation step using the `Remove-GPO` cmdlet. > _You can also [download the Remove-UnlinkedGPO.ps1 script via GitHub](https://github.com/Adam-the-Automator/Scripts/blob/main/Remove-UnlinkedGPO.ps1)._ ```powershell Import-Module GroupPolicy $Date = Get-Date -Format dd_MM_yyyy $BackupDir = "c:\GPOBackup\$Date" ## Creates a directory to store the GPO reports if (-Not(Test-Path -Path $BackupDir)) { New-Item -ItemType Directory $BackupDir -Force } # Get all GPOs with the gpo report type as XML and also look for the section in the xml report. # Consider only the GPOs that doesnt have section. Get-GPO -All | Where-Object { $_ | Get-GPOReport -ReportType XML | Select-String -NotMatch "" } | ForEach-Object { # Backup the GPO, HTML report and saving the GPO details to text file are optional. Backup-GPO -Name $_.DisplayName -Path $BackupDir # Run the report and save as an HTML report to disk Get-GPOReport -Name $_.DisplayName -ReportType Html -Path "$BackupDir\$($_.DisplayName).html" # Create and append to a text file called UnlinkedGPOs.txt in the backup folder that # contains each GPO object that Get-GPO returns $_ | Select-Object * | Out-File "$BackupDir\UnLinkedGPOs.txt" -Append # Remove the GPO but first prompt before removing $_.Displayname | Remove-GPO -Confirm } ``` 2\. Execute the _Remove-UnlinkedGPO.ps1_ script. Related:[How to Run a PowerShell Scripts from the Command Line](https://adamtheautomator.com/run-powershell-script/) 3\. If an unlinked GPO is found, the script will prompt you to remove it. This prompt comes from the [`Remove-GPO` cmdlet](https://docs.microsoft.com/en-us/powershell/module/grouppolicy/remove-gpo?view=windowsserver2019-ps) using the `Confirm` switch. To confirm the removal of that single GPO, click **Yes** otherwise, click **Yes to All** to remove all unlinked GPOs with no further confirmation. ![GPO deletion confirmation prompt ](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-11-1.png) GPO deletion confirmation prompt After the script is complete and it found at least one unlinked GPO, you should see in the _C:\\GPOBackup\\_ folder the GPO contents as a GUID folder along with the HTML reports and the _UnlinkedGPOs.txt_ file. ![Displaying Backup Folder](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-12-1.png) Displaying Backup Folder 4\. Now, open one of the GPO HTML reports with a web browser. You can see below the report contains all the settings defined in that GPO. In the below example, the UnlinkedGPO1 GPO contains settings for the PowerShell execution policy. ![GPO HTML report](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-13-1.png) GPO HTML report 5\. Finally, open the _UnlinkedGPOs.txt_ file. You’ll see below that it contains the same output you received from the `Get-GPO` cmdlet. ![UnlinkedGPOs.txt GPO listing](https://adamtheautomator.com/wp-content/uploads/2021/04/Untitled-14-1.png) UnlinkedGPOs.txt GPO listing ## Conclusion You should now know how to find all of those unlinked GPOs in your AD environment using the GPMC and PowerShell. Which way do you prefer? Can you think of a way to improve the PowerShell script covered? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Funlinked-gpo%2F&text=How%20to%20Find%20\(and%20Remove\)%20Unlinked%20GPOS%20in%20Active%20Directory)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Funlinked-gpo%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Funlinked-gpo%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-11.webp) ### [How to Troubleshoot Active Directory Replication Errors](/troubleshoot-active-directory-replication-errors/) Troubleshoot Active Directory replication errors by isolating 1311, 1722, 2087, and USN rollback issues with repadmin, dcdiag, DNS, RPC, and KCC checks. ![](https://adamtheautomator.com/wp-content/uploads/2026/05/featured_image-7.webp) ### [Migrate Group Policy to Intune Without Breaking Endpoints](/gpo-intune-migration/) Export GPOs as XML, analyze them with Group Policy Analytics, migrate supported settings to Intune Settings Catalog, and resolve hybrid device conflicts. ![](https://adamtheautomator.com/wp-content/uploads/2026/06/ditch-gpos-intune-featured.webp) ### [Ditch the GPOs: Migrate to Microsoft Intune](/ditch-gpos-migrate-microsoft-intune-2/) Use Group Policy Analytics to migrate GPOs to Intune Settings Catalog profiles, handle unsupported Group Policy Preferences, and manage hybrid AD-to-MDM transitions. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)