IT Toolbox
Guide

How to generate a Gp Report for a GPO in the year 2002

gp 2002 shows which GPOs are applied, refused or filtered for a position and user.

TopicActive Directory →
⌚ About 2 min read
View my favorites
Active Directory Beginner 5 min

gp 2002 shows which GPOs are applied, refused or filtered for a position and user.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Open a high prompt

    Use a command prompt or Power Shell with the necessary rights.

  2. 2

    Force the update if necessary

    Run gpupdate /force if you have just changed the strategy.

  3. 3

    Generate HTML Report

    Create a user-readable gp file in a browser.

  4. 4

    Search for GPO

    Identify the strategy expected and its possible reason for refusal.

  5. 5

    Check the OR and filtering

    Compare the result with GPO links, security groups and WMI filters.

Commands utiles

gpupdate /force.
gp - 2002 /h C: -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -/ -// -/ -/ -/ -/ -/ -// -/ -/ -/ -/ -/ -/ -// -//// -/ -/ -/ -/ -////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

À retenir

  • An absent GPO is not necessarily mistaken: it can be off-site.
  • Also check SysVOL and DNS
  • Avoid deactivating the legacy configuration without understanding the application order.
← All les guides
Technical deep dive

GPO: distinguish refresh, resulting set and non-application cause

Technical checkpoints

  • gpupdate triggers a refresh but does not prove a specific GPO applied.
  • gpresult /h or Get-GPResultantSetOfPolicy show the effective result, including security filtering and denials.
  • A GPO depends on its AD object and SYSVOL content; replication inconsistencies can produce different results depending on the DC.

Useful report

Generate an HTML report on the affected computer and inspect Applied GPOs, Denied GPOs and denial reason.

gpupdate /force
gpresult /h C:\Temp\gpresult.html

Topic-specific pitfalls

  • Repeated gpupdate does not fix security/WMI filtering or SYSVOL problems.
  • Some policies require logon or reboot.

How to validate

  • gpresult shows the expected GPO as applied without unexpected denial.
  • The effective setting is verified in the registry, security subsystem or relevant application.
♡ 0