Resultant Set of Policy

You can use Resultant Set of Policy (RSoP) to simulate and test policy settings that are applied to computers or users using Group Policy.

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


How to...

  • Run RSoP
  • Use the RSoP snap-in
  • View policy settings with RSoP
  • Delegate control of RSoP


Run RSoP

  • Run an RSoP query on a computer account
  • Run an RSoP query on a user account
  • Run an RSoP query on a domain
  • Run an RSoP query on an organizational unit
  • Run an RSoP query on a site
  • Run an RSoP query on a local computer


Run an RSoP query on a computer account

Microsoft Windows graphic

To run an RSoP query on a computer account

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the computer account on which you want to run RSoP.

    Where?

    • Active Directory Users and Computers
    • domain node
    • Computers
    • computer account
  3. Point to All Tasks, and then click Resultant Set of Policy (Logging) or Resultant Set of Policy (Planning).

Notes

  • XOX
  • You can also run an RSoP query by adding the RSoP snap-in to a Microsoft Management Console (MMC). For more information, see Related Topics.

Related Topics


Run an RSoP query on a user account

To run an RSoP query on a user account

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the user account on which you want to run RSoP.

    Where?

    • Active Directory Users and Computers
    • domain node
    • Users
    • user account
  3. Point to All Tasks, and then click Resultant Set of Policy (Logging) or Resultant Set of Policy (Planning).

Notes

  • XOX
  • You can also run an RSoP query by adding the RSoP snap-in to a Microsoft Management Console (MMC). For more information, see Related Topics.


Run an RSoP query on a domain

To run an RSoP query on a domain

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the domain on which you want to run RSoP.

    Where?

    • Active Directory Users and Computers
    • domain node
  3. Point to All Tasks, and then click Resultant Set of Policy (Planning).

Notes

  • XOX
  • You can also run an RSoP query by adding the RSoP snap-in to a Microsoft Management Console (MMC). For more information, see Related Topics.


Run an RSoP query on an organizational unit

To run an RSoP query on an organizational unit

  1. Open Active Directory Users and Computers.
  2. In the console tree, right-click the organizational unit on which you want to run RSoP.

    Where?

    • Active Directory Users and Computers
    • domain node
    • organizational unit
    • child organizational unit
  3. Point to All Tasks, and then click Resultant Set of Policy (Planning).

Notes

  • XOX
  • You can also run an RSoP query by adding the RSoP snap-in to a Microsoft Management Console (MMC). For more information, see Related Topics.


Run an RSoP query on a site

To run an RSoP query on a site

  1. Open Active Directory Sites and Services.
  2. In the console tree, right-click the site for which you want to run RSoP.

    Where?

    • Active Directory Sites and Services
    • domain node
    • Sites
    • site
  3. Point to All Tasks, and then click Resultant Set of Policy (Planning).

Notes

  • XOX
  • If you use this method to open RSoP, you cannot change the site name in the RSoP query.
  • You can also run an RSoP query by adding the RSoP snap-in to a Microsoft Management Console (MMC). For more information, see Related Topics.


Run an RSoP query on a local computer

To run an RSoP query on a local computer

  1. Open Microsoft Management Console.
  2. On the File menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. In the Available Standalone Snap-in box, click Resultant Set of Policy, and then click Add.
  5. In Microsoft Management Console, right click Resultant Set of Policy, and then click Generate RSoP Data.
  6. In the Resultant Set of Policy Wizard, click Next.
  7. On the Mode Selection page, click Logging mode, and then click Next.
  8. On the Computer Selection page, click This computer, and then click Next to continue the Resultant Set of Policy Wizard.

Notes

  • XOX
  • Logging mode is the only mode that is available for an RSoP query on a local computer.


Use the RSoP snap-in

  • Open RSoP as an MMC snap-in
  • Access RSoP data for an existing computer and user (logging mode)
  • Simulate RSoP data for a computer and user (planning mode)
  • Save data from an RSoP query
  • Change an existing RSoP query
  • Refresh an RSoP query


Open RSoP as an MMC snap-in

To open RSoP as an MMC snap-in

Using the Windows interface

  1. Open Microsoft Management Console.
  2. On the File menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. In the Available Standalone Snap-in box, click Resultant Set of Policy, and then click Add.

Notes

  • XOX
  • You must add a Resultant Set of Policy snap-in to Microsoft Management Console (MMC) for each new RSoP query.

Using a command line

  1. Open Command Prompt.
  2. Do one of the following:
    • To open RSoP as an MMC snap-in and display RSoP logging mode for the currently logged on user and computer, type:

      rsop.msc

    • To open RSoP as an MMC snap-in and display RSoP logging mode for the specified namespace and target computer, type:

      • rsop.msc /RsopNamespace:NameSpace /RsopTargetComp:TargetComputer

      Note

      • This syntax is intended for use with a WMI script.

Note

  • XOX


Access RSoP data for an existing computer and user (logging mode)

To access RSoP data for an existing computer and user (logging mode)

  1. Open Microsoft Management Console.
  2. Add a Resultant Set of Policy snap-in to a Microsoft Management Console (MMC).
  3. In the console tree, right-click Resultant Set of Policy, and then click Generate RSoP Data.
  4. In the Resultant Set of Policy Wizard, click Next.
  5. On the Mode Selection page, click Logging mode, and then click Next.
  6. On the Computer Selection page, specify the computer on which you want to run RSoP, and then click Next.
  7. On the User Selection page, specify the user for which you want to collect RSoP data, and then click Next.
  8. On the Summary of Selections page, click Next, and then wait for RSoP to finish processing the data.
  9. On the Completing the Resultant Set of Policy Wizard page, click Finish.
  10. In the console tree, click the newly created RSoP query to view the data.

Notes

  • XOX
  • To open RSoP as a Microsoft Management Console (MMC) snap-in, see Related Topics.
  • Only users and computers that are currently logged on to the domain are visible.


Simulate RSoP data for a computer and user (planning mode)

To simulate RSoP data for a computer and user (planning mode)

1. Add the Resultant Set of Policy snap-in to a Microsoft Management Console (MMC).

  • For more information, see Related Topics.

2. Start the Resultant Set of Policy Wizard in planning mode, and then click Next.

  • In the console tree, right-click Resultant Set of Policy, and then click Generate RSoP Data.
  • In the Resultant Set of Policy Wizard, click Next.
  • On the Mode Selection page, click Planning mode, and then click Next.

3. On the User and Computer Selection page, specify the user and computer, and then click Next.

  • On the User and Computer Selection page, under User information and Computer information, specify the name of the user and computer, and then click Next.

4. On the Advanced Simulation Options page, specify the simulation options that you want to apply, and then click Next.

  • If you want to simulate a slow network connection, select the Slow network connection check box.
  • If you want to simulate loopback processing, select the Loopback processing check box. If you select the Loopback processing check box, click either Replace to simulate only applied Group Policy objects (GPOs) based on the computer, or Merge to simulate applied GPOs based on the computer and the user.

5. On the User Security Groups page, verify that the information is complete, and then click Next.

  • The security groups that are currently assigned appear under Security groups.
  • To search for an alternate user security group, click Add, type the name of the security group, click Check Names, click a security group, and then click OK.
  • To restore security groups to those currently assigned to the user, click Restore Defaults.

6. On the Computer Security Groups page, verify that the information is complete, and then click Next.

  • The security groups that are currently assigned appear under Security groups.
  • To search for an alternate computer security group, click Add, type the name of the security group, click Check Names, click a security group, and then click OK.
  • To restore security groups to those currently assigned to the computer, click Restore Defaults.

7. On the WMI Filters for Users page, verify the list of WMI filters, and then click Next.

  • To automatically evaluate all WMI filters that are associated with any Group Policy object (GPO) as true, click All linked filters.
  • To specify which WMI filters associated with any GPO that you want to automatically evaluate as true, click Only these filters. If the filter you want is not in the list, click List Filters.
  • To remove a filter from the list, click the filter name, and then click Remove. Remove any filters that would be considered a false condition for the designated computer.

8. On the WMI Filters for Computers page, verify the list of WMI filters, and then click Next.

  • To automatically evaluate all WMI filters that are associated with any Group Policy object (GPO) as true, click All linked filters.
  • To specify which WMI filters associated with any GPO that you want to automatically evaluate as true, click Only these filters. If the filter you want is not in the list, click List Filters.
  • To remove a filter from the list, click the filter name, and then click Remove. Remove any filters that would be considered a false condition for the designated computer.

9. On the Summary of Selections page, verify the domain controller, and then click Next.

  • The wizard might take several minutes to run the simulation.

10. On the Completing the Resultant Set of Policy Wizard page, click Finish.

  • In the console tree, click the RSoP query to view the data.

Notes

  • To open RSoP as a Microsoft Management Console (MMC) snap-in, see Related Topics.
  • If the information is complete after your specify your settings in a particular wizard page and you want to run RSoP immediately, select the Skip to the final page of this wizard without collecting additional data check box, and then click Next.
  • You can use this procedure to generate RSoP data based on containers, computers, and users.
  • You must be a domain administrator or you must have delegated RSoP (planning) authority over the organizational unit to run RSoP.
  • You must be an enterprise administrator to cross domain boundaries in the same forest.
  • If you only have authority over one of the destinations, RSoP returns data for that destination only.


Save data from an RSoP query

To save data from an RSoP query

  1. From within an existing RSoP query in Microsoft Management Console (MMC), in the console tree, click Console Root, and then in the details pane double-click user account on computer account - RSoP.
  2. On the View menu, click Archive data in console file.
  3. On the File menu, click Save.
  4. In File name, type a name for the file, and then click Save.

Notes

  • XOX
  • To open RSoP as a Microsoft Management Console (MMC) snap-in, see Related Topics.


Change an existing RSoP query

To change an existing RSoP query

  1. From within an existing RSoP query in Microsoft Management Console (MMC), in the console tree, right-click the RSoP query that you want to change, and then click Change Query.
  2. In the Resultant Set of Policy Wizard, select the appropriate step for the query option that you want to change by clicking Next.
  3. To close the wizard, click Finish.

Notes

  • XOX
  • To open RSoP as a Microsoft Management Console (MMC) snap-in, see Related Topics.


Refresh an RSoP query

To refresh an RSoP query

  • From within an existing RSoP query in Microsoft Management Console (MMC), in the console tree, right-click the RSoP query that you want to refresh, and then click Refresh Query.

Notes

  • XOX
  • To open RSoP as a Microsoft Management Console (MMC) snap-in, see Related Topics.


View policy settings with RSoP

  • View individual policy settings with RSoP
  • View a list of all Group Policy objects associated with an RSoP query
  • View the scope of management associated with an RSoP query
  • View Group Policy object revision information in RSoP
  • View an RSoP report in HTML
  • View an RSoP report at the command line


View individual policy settings with RSoP

To view individual policy settings with RSoP

  1. Open an RSoP query.
  2. In the console tree, double-click user account on computer account - RSoP, and then click the folders under it to view individual policy settings.

Note

  • To open RSoP, see Related Topics.


View a list of all Group Policy objects associated with an RSoP query

To view a list of all Group Policy objects associated with an RSoP query

  1. Open an RSoP query.
  2. In the console tree, double-click user account on computer account - RSoP.
  3. In the console tree, right-click Computer Configuration or User Configuration, and then click Properties.
  4. On the General tab, select the Display all GPOs and filtering status check box.
  5. In the details pane, the list of Group Policy objects appears in the Group Policy Object column, and the filtering status appears in the Filtering column as either Applied or Not Applied (Empty).

Notes

  • To open RSoP, see Related Topics.
  • The list includes Group Policy objects that are not applied to the object that is queried.


View the scope of management associated with an RSoP query

To view the scope of management associated with an RSoP query

  1. Open an RSoP query.
  2. In the console tree, double-click user account on computer account - RSoP.
  3. Right-click Computer Configuration or User Configuration, and then click Properties.
  4. On the General tab, select the Display scope of management check box.
  5. In the details pane, the CNAME of each Group Policy object in Active Directory appears in the Scope of Management column.

Note

  • To open RSoP, see Related Topics.


View Group Policy object revision information in RSoP

To view Group Policy object revision information in RSoP

  1. Open an RSoP query.
  2. In the console tree, double-click user account on computer account - RSoP.
  3. Right-click Computer Configuration or User Configuration, and then click Properties.
  4. On the General tab, select the Display revision information check box.
  5. In the details pane, the location of the revision information appears in the Revision column.

Note

  • To open RSoP, see Related Topics.


View an RSoP report in HTML

Microsoft Windows Graphic

To view an RSoP report in HTML

  1. Click Start, and then click Help and Support.
  2. Under Support Tasks, click Tools.
  3. Under Tools, click Help and Support Center Tools.
  4. Under Help and Support Center Tools, click Advanced System Information.
  5. Under Advanced System Information, click View Group Policy settings applied.
  6. Scroll to the results that you want to view.

Note

  • To hide details, click the arrow in the upper-right corner of a category.


View an RSoP report at the command line

To view an RSoP report at the command line

  1. Open Command Prompt.
  2. At the command prompt, redirect the output to a text file by typing:

    gpresult /z >gp.txt

  3. At the command prompt, open the file by typing:

    notepad gp.txt

Notes

  • XOX
  • To view all of the gpresult command-line parameters, see Related Topics.


Delegate control of RSoP

To delegate control of RSoP

  1. Open Active Directory Users and Computers.
  2. In the Name column, right-click the organizational unit that you want to delegate control of Resultant Set of Policy (RSoP), and then click Delegate Control.
  3. In the Delegation of Control Wizard, click Next.
  4. On the Users or Groups page, click Add.
  5. In the Name box, type the name of the user or group to which you want to delegate control, and then click OK.
  6. Verify that the user or group that appears in the Selected users and groups box is correct, and then click Next.
  7. On the Tasks to Delegate page, click Delegate the following common tasks.
  8. Select the Generate Resultant Set of Policy (logging) check box or the Generate Resultant Set of Policy (planning) check box (you can select both), and then click Next.
  9. Verify the information that appears, and then click Finish.
  10. Click the folders in the console tree to view the data in the details pane.

Notes

  • To open Active Directory Users and Computers, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  • Delegated control is inherited by all child containers below the container to which control is delegated.
  • You must be an enterprise administrator to delegate RSoP control at the domain and site level.


Concepts

This section covers:

  • RSoP overview
  • Using RSoP


RSoP overview

Resultant Set of Policy (RSoP) is an addition to Group Policy that makes policy implementation and troubleshooting easier. RSoP is a query engine that polls existing policies and planned policies, and then reports the results of those queries. It polls existing policies based on site, domain, domain controller, and organizational unit. RSoP gathers this information from the Common Information Management Object Model (CIMOM) database (otherwise known as CIM-compliant object repository) through Windows Management Instrumentation (WMI).

RSoP provides details about all policy settings that are configured by an Administrator, including Administrative Templates, Folder Redirection, Internet Explorer Maintenance, Security Settings, Scripts, and Group Policy Software Installation.

When policies are applied on multiple levels (for example, site, domain, domain controller, and organizational unit), the results can conflict. RSoP can help you determine a set of applied policies and their precedence (the order in which policies are applied).

RSoP consists of two modes: planning mode and logging mode. With planning mode, you can simulate the effect of policy settings that you want to apply to a computer and user. Logging mode reports the existing policy settings for a computer and user that is currently logged on.

The Resultant Set of Policy Wizard helps you create an RSoP query. You can open the wizard from Microsoft Management Console (MMC), Active Directory Users and Computers, or Active Directory Sites and Services. You must run the wizard at least once to create an RSoP query. When complete, the wizard displays the query results in the RSoP snap-in in MMC. From here, you can save, change, and refresh your queries. You can create many RSoP queries by adding multiple Resultant Set of Policy snap-ins to MMC, one RSoP snap-in per query.

RSoP and the CIMOM database

RSoP uses the CIMOM database through WMI. When a computer logs on to a network, information such as the computer hardware, Group Policy Software Installation settings, Internet Explorer Maintenance settings, Scripts, Folder Redirection settings, and Security Settings, is written to the CIMOM database. When you start RSoP in logging mode, RSoP reports policy settings that have been applied from information provided in the CIMOM database.

RSoP, Active Directory, and policy precedence

Unlike the CIMOM database, Active Directory® directory services stores objects regardless of the state of a computer or user. Group Policy uses Group Policy objects (GPOs) in Active Directory to store policy settings. With Group Policy, administrators can:

  • Deploy registry keys (Administrative Templates)
  • Deploy software (Group Policy Software Installation)
  • Deploy security: Safer, IPSec (Security Settings)
  • Deploy scripts: logon, logoff, startup, shutdown (Scripts)
  • Configure the browser (Internet Explorer Maintenance)

After you define a policy setting for an object, it is applied the next time that object logs on. When an object logs on to a network, the policy settings are applied in the following order:

  • Local policy
  • Site-level policy
  • Domain-level policy
  • Domain controller policy (if the domain controller is left in the domain controller container)
  • Organizational unit policy

When a Group Policy object overwrites the settings of a different GPO that was applied previously, the new GPO has precedence over the GPO that it has overwritten. When a Group Policy object has a no overwrite attribute, it has precedence over all of the policies that are applied subsequently. RSoP can simulate and test the application of policy settings and precedence to Group Policy objects in Active Directory.

RSoP and Group Policy Software Installation

A significant part of Group Policy are the software settings extensions, which monitor Group Policy Software Installation. In an RSoP report, RSoP displays which applications are available for any given user or computer, as well as any software setting changes that are advertised or applied. By identifying all of the software that is available for a given user, as well as updates and configuration changes, RSoP makes deployment scenario planning and implementation easier.

RSoP and security issues

RSoP provides the following features that you can use to determine which comprehensive security policy meets your needs:

  • Provides security templates for creating and assigning security settings for one or more computers. A security template is a file representation of a security setting configuration. It can be applied to a local computer or it can be imported to a Group Policy object in Active Directory. When you import a security template to a Group Policy object, Group Policy processes the security template and makes the corresponding changes to the members of that Group Policy object, which can be users or computers. RSoP verifies those changes. By polling the system and displaying the resultant policy, RSoP indicates a misapplied or overwritten policy setting and the policy setting's precedence, which enables you to fix a security breach.
  • RSoP reports the scope of a Group Policy object according to security group membership. RSoP does this through Group Policy filtering.
  • Processes and displays the resulting policy for any computer or user. Through individual security settings, Administrators can define a security policy in Active Directory that contains specific security settings for nearly all security areas. Security settings in a local Group Policy object can also establish a security policy on a local computer. When there are conflicts, security settings that are defined in Active Directory always override any security settings that are defined locally.


Using RSoP

RSoP provides the following tools that you can use to obtain the information necessary to best configure Group Policy for your organization:

  • The RSoP snap-in—You can use the RSoP snap-in to create detailed reports about applied policy settings. The RSoP snap-in has two modes: logging mode and planning mode. Logging mode displays policy settings that are applied to computers or users that have logged on. For more information, see RSoP logging mode. Planning mode simulates policy settings that will be applied to a computer or user, or you can use planning mode to check assigned policy settings for a computer that is not currently available or a user that is not currently logged on. For more information, see RSoP planning mode. For information about the RSoP snap-in, see Use the RSoP snap-in.
  • Advanced System Information - Policy—In Help and Support Center, you can use Advanced System Information - Policy to view an HTML report of Group Policy results. Similar to RSoP logging mode, this tool provides a detailed assessment of policy settings applied to the computer and user that are currently logged on. You can print this report. For more information, see To view an RSoP report in HTML.
  • Gpresult—You can use the gpresult command at the command line to get similar detailed information provided by RSoP logging mode. You can export query results to a text file. For more information, see Gpresult.

This section covers:

  • Using the RSoP snap-in
  • View Group Policy settings in HTML


Using the RSoP snap-in

This section covers:

  • RSoP logging mode
  • RSoP planning mode
  • RSoP planning mode options
  • Viewing RSoP query results


RSoP logging mode

Resultant Set of Policy (RSoP) logging mode helps administrators review existing policy settings that have been applied to computers and users.

Logging mode is most helpful in the following situations:

  • You want to discover which policy settings are applied to a computer or user.
  • You want to discover failed or overwritten policy settings.
  • You want to see how security groups affect policy settings.

For more information, see To access RSoP data for an existing computer and user (logging mode) and To view individual policy settings with RSoP.

To run RSoP logging mode on a remote computer, you must be logged on as a member of the Domain Admins security group, Enterprise Admins security group, or be delegated Generate Resultant Set of Policy (logging) rights. For more information about security groups, see Default groups. For more information about delegating control of RSoP, see Delegate control of RSoP. Any local user account can run a single RSoP logging mode query when logged onto a local computer.


RSoP planning mode

Resultant Set of Policy (RSoP) planning mode helps administrators plan for growth and reorganization. With RSoP planning mode, you can poll existing Group Policy objects (GPOs) for all of the policy settings that can be applied. Then, you can use the results to construct a "What if?" scenario to predict the effect of changes in policy settings.

Planning mode is most helpful in the following situations:

  • You want to simulate the affect of specific policy settings on a computer or user, domain, organizational unit, or site.
  • The user is in Active Directory only (for example, a new account).
  • You want to test policy precedence in the following situations:
    • The user and the computer are in different security groups.
    • The user and the computer are in different organizational units.
    • The user or the computer is moving to a new location.
  • You want to create a slow network simulation.
  • You want to create a loopback simulation.

After you decide that a change is necessary, you can run a series of RSoP planning simulations to see what will happen to a user or a group of users if they are moved to another location or security group, or even to another computer. This includes what policy settings will be applied and which files will be loaded automatically after you implement the change. For more information, see RSoP planning mode options.

To run RSoP planning mode on a remote computer, you must be logged on as a member of the Domain Admins security group, Enterprise Admins security group, or be delegated Generate Resultant Set of Policy (planning) rights. For more information about security groups, see Default groups. For more information about delegating control of RSoP, see Delegate control of RSoP.


RSoP planning mode options

Resultant Set of Policy (RSoP) provides several planning mode options. You can configure the Resultant Set of Policy Wizard to run each option separately or in conjunction with other options. For more information about running RSoP in planning mode, see RSoP planning mode and To simulate RSoP data for a computer and user (planning mode).

Slow network connection

This option simulates a slow network connection in the reporting of Group Policy settings. If the rate at which data is transferred (that is, from the domain controller that provides a policy update to the computers in this group) is slower than the rate that is specified by this policy, the system considers the connection to be slow. The system's response to a slow network connection varies among policy settings. During slow connections, some policy settings might not be applied. RSoP simulates a slow network connection and displays the expected results.

Loopback processing

Loopback processing simulates the application of alternate user policy settings when a user logs on to a computer that is affected by the alternate user policy settings. The loopback processing simulation directs the system to apply the set of Group Policy objects (GPOs) for the computer to any user who logs on to a computer that is affected by the alternate user policy settings. It is intended for special-use computers, such as those in public places, laboratories, and classrooms, where you must modify the user policy based on the computer that is being used.

By default, the user's Group Policy objects determine which user policy settings apply. When you apply loopback processing, you need to select one of the following options:

  • Replace—Indicates that the user policies that are defined in the computer's Group Policy objects replace the user policies that are normally applied to the user.
  • Merge—Indicates that the user policies that are defined in the computer's Group Policy objects and the user policy settings that are normally applied to the user are combined. If the policy settings conflict, the user policy settings in the computer's Group Policy objects take precedence over the user's existing policy settings.

When you run the query, the computer's Group Policy objects determine which set of Group Policy objects applies.

Site name

This option specifies which site and physical location of the subnet that RSoP will use. A site is required. A domain controller, is not required. Use a site to test policy settings that are based on startup or logon being on a subnet other than the one on which the query is currently being run. Use a domain controller to test policy for computers and users that could be operating in location other than the one in which the query is being run, such as a field office.

Alternate security groups

This option simulates the application of alternate security groups to both computer and user configurations. With this option you can run a query that simulates what happens when a user or computer belongs to alternate security groups and how this affects the application of the Group Policy object. Administrators can use security groups to further refine which computers and users a Group Policy object influences. For any Group Policy object, administrators can filter the Group Policy object's effect on computers or users that are members of specified security groups. You can set this filtering by using the standard access control list (ACL) editor. To use the ACL editor, click the Security tab in a Group Policy object's properties dialog box. Administrators can also use the ACL editor to delegate who can modify the Group Policy object.

WMI filters

This option enables RSoP to include configured Windows Management Instrumentation (WMI) filters. With a WMI filter, an administrator can specify a WMI-based query to filter the effect of a Group Policy object based on certain information, such as installed hardware and software. You can find WMI filters in the properties dialog box for a Group Policy object. In addition, RSoP also displays existing WMI filters that are currently enabled.


Viewing RSoP query results

After you run the Resultant Set of Policy Wizard, you can view the results from the RSoP query for computer configuration and user configuration in the RSoP snap-in. In the RSoP query in Microsoft Management Console (MMC), under Computer Configuration and User Configuration, the query results for Software Settings, Windows Settings, and Extra Registry Settings appear in the MMC details pane.

Software Settings

You can view the Resultant Set of Policy (RSoP) results for Software Settings in the details pane, which displays the five default columns described in the following table.

Column | Description
Name | Lists the name of the deployed package
Version | Lists the software version of the deployed package
Deployment state | Indicates whether the package is assigned or published
Source | Specifies the source location of the deployed package
Origin | Lists the name of the Group Policy object that deployed the package

Windows Settings

You can view the Resultant Set of Policy (RSoP) results for Windows Settings in the details pane, which contains results for the following:

  • Scripts—If a policy setting applies scripts, four default columns appear in the details pane, which are described in the following table.
    Column | Description
    Name | Lists the name of the script
    Parameters | Lists any parameters that are assigned to the script
    Last Executed | Lists the date that the script was last run
    GPO Name | Lists the name of the Group Policy object that assigned the script
  • Security Settings—The Security Settings results in Windows Settings appear the same way that they do for Group Policy. However, when you double-click a policy setting, the Security Policy Settings tab is not available and there is a new Precedence tab. The Precedence tab that indicates which Group Policy objects affect this policy setting from newest to oldest.
  • Internet Explorer Maintenance—The Internet Explorer Maintenance results appear the same way that they do for Group Policy. However, for each policy setting there is an additional Precedence tab that indicates which Group Policy objects affect this policy setting in order from newest to oldest.
  • Administrative Templates—You can view the Resultant Set of Policy (RSoP) results for Administrative Templates in the details pane. The details pane appears the same way that it does for Group Policy, except that only those policy settings that have been changed from the default setting appear and there is an additional column called GPO Name, which displays the Group Policy object name.

    To view more information about an Administrative Template setting, in the details pane double-click the setting. A dialog box appears with three tabs. The following table lists and describes these tabs.

    Tab | Description
    Setting | Indicates the state of the policy setting (unavailable)
    Explain | Describes the policy setting
    Precedence | Indicates Group Policy object precedence, from newest to oldest

Extra Registry Settings

You can view the Resultant Set of Policy (RSoP) results for Extra Registry Settings in the details pane. Extra Registry Settings is a collection of policy-based registry settings that do not have an Administrative Template associated with them. Because there is no association with an Administrative Template, there is no explanation of the setting except for the registry key and the Group Policy object that set the key. If no Extra Registry Settings are applied, Extra Registry Settings does not appear in the RSoP query results.

Note

  • To view an HTML report of Group Policy policy settings, you can use Advanced System Information - Policy in Help and Support Center. You can use this feature to quickly determine which policy settings are currently being applied, without running RSoP logging mode. For more information, see View Group Policy settings in HTML.


View Group Policy settings in HTML

In Help and Support Center, the Advanced System Information - Policy tool provides an HTML report of Group Policy settings and Resultant Set of Policy (RSoP) as applied to the local computer and currently logged on user. This tool uses the same functions as RSoP logging mode to determine policy settings specified in the system logging provider (CIMOM database through WMI). Although this tool does not provide the level of detail provided by the RSoP snap-in, it can help you quickly determine the policy settings that are currently applied. For more information, see To view an RSoP report in HTML.

Use Advanced System Information - Policy to view the following:

  • Group Policy results for local computer, which includes the following:
    • Computer Information: Computer name, domain, site, and last time Group Policy was applied
    • Applied Group Policy objects
    • Security group membership when Group Policy was applied
    • Startup scripts
    • Shutdown scripts
    • Security settings - Restricted groups
    • Security settings - File system
    • Security settings - Registry
    • Programs Installed (by using Group Policy Software Installation)
    • Programs listed in Add or Remove Programs (determined by last use of current user)
    • Registry settings
  • Group Policy results for current user, which includes the following:
    • User Information: User name, domain, and last time Group Policy was applied
    • Applied Group Policy objects
    • Security group membership when Group Policy was applied
    • Internet Explorer automatic browser configuration
    • Internet Explorer proxy server settings
    • Logon scripts
    • Logoff scripts
    • Redirected folders
    • Programs installed (by using Software Installation)
    • Programs listed in Add or Remove Programs (determined by last use of current user)
    • Registry settings

Note

  • The RSoP snap-in provides more detailed information about applied policy settings. For more information, see Using the RSoP snap-in.


Troubleshooting

What problem are you having?

The Active Directory query for the specified user, user container, computer, or computer container failed.

Cause: The domain controller that holds this object is unavailable, or the domain controller that holds this object is not responding to requests for information.

Solution: Do the following:

  • Verify that the domain controller is available.
  • Check the network connections, responses, and throughput.

Cause: The client does not have access to the Read properties of the object that is queried.

Solution: Verify that the client has access to the Read properties of the object that is queried.

I received the error message "The container path entered is actually a user object. Please select a container which holds user objects instead."

Cause: The indicated path points to a user account instead of to a container.

Solution: Verify that the path points to a container object.

I received the error message "The container path entered is actually a computer object. Please select a container which holds computer objects instead."

Cause: The indicated path points to a computer account instead of to a container.

Solution: Verify that the path points to a container object.

I received the error message "Failed to generate RSoP data due to the error listed below. (The planning mode provider failed.)"

Cause: The planning mode provider failed.

Solution: See the event log file for more details.

I received the error message "The DomainName domain does not contain a domain controller with the RSoP planning mode functionality available."

Cause: This message appears when the client browses for a domain controller. The client polls a Windows 2000 domain controller, but Windows 2000 does not have planning mode functionality. The user is informed that no domain controller is available.

Solution: Connect to a different domain, or upgrade the domain to XOX or XOX.

I received the error message "The domain controller you have selected does not have the RSoP planning mode functionality available. Please select a different domain controller."

Cause: This message is generated when the client browses for a domain controller. The client is running in a Windows 2000 domain, but Windows 2000 does not have planning mode functionality. The user is informed that no domain controller is available.

Solution: Connect to a different domain controller, or upgrade the domain controller and domain to XOX or XOX.

I received the error message "The selected computer currently does not have RSoP logging enabled. Do you want to continue?"

Cause: The client is trying to poll a computer that does not have the Turn off Resultant Set of Policy logging policy setting disabled.

Solution: Disable the Turn off Resultant Set of Policy logging policy setting.

I received the error message "The RSoP snap-in was unable to enumerate the users on the selected computer due to the error listed below."

Cause: The RSoP snap-in cannot enumerate a list of users on a specific domain controller, usually because the client user does not have Read permissions for that domain controller.

Solution: Try a different domain controller, or obtain Read permissions for the user.

I received the error message "The selected computer does not support RSoP logging. RSoP logging support is available in operating system releases after Windows 2000."

Cause: The client is trying to poll a computer with Windows 2000, and Windows 2000 does not support RSoP logging mode.

Solution: Poll a different computer, or update the operating system to XOX or a product in the Windows Server 2003 family.