Resultant Set of Policy and gpresult
How to see exactly which Group Policy settings actually applied to a user or computer, which GPOs lost, and why, using RSoP, gpresult, and their PowerShell and GUI equivalents.
gpresult is the tool that prints that answer without guesswork.
The calculated result of every GPO that applies to a user or computer, after precedence and filtering.
The command-line tool that queries and prints RSoP data, locally or against a remote computer.
For every setting, RSoP records which GPO applied it and which competing GPOs lost and why.
What Is Resultant Set of Policy?
A single user logging into a single computer can be in scope for a dozen Group Policy Objects at once: one linked to the domain, several linked to organisational units at different levels, maybe one from a site. Some of those GPOs configure the same setting differently. RSoP is the answer to what actually wins after Windows applies inheritance, link order, enforcement, block-inheritance, and security filtering.
Think of RSoP as a receipt printed after checkout, not the shopping cart itself. The cart is every GPO that is linked and in scope; the receipt is what you were actually charged: the final setting values, and which GPO is responsible for each one.
RSoP has two modes. Logging mode reports the settings actually applied to a computer and the user currently logged on, based on real processing that already happened. Planning mode (Group Policy Modeling in GPMC) simulates what would apply if you moved an object, changed group membership, or linked a new GPO, without touching anything.
gpresult remains the complete, authoritative source. Use the GUI for a quick look and gpresult when you need the full picture.
How Windows Calculates the Result
GPOs apply in a fixed order: local policy, then site, then domain, then organisational units from the top down, with the closest OU to the object processed last and normally winning conflicts. A GPO can be enforced to override that, and a container can block inheritance from above it. Security filtering and WMI filtering decide whether a given GPO applies to a specific user or computer at all before any of that ordering matters.
RSoP does not recalculate that logic itself. It reports what Group Policy processing already decided, complete with a Winning GPO for every applied setting and a reason for every GPO that tried to set something and lost.
Reading Results in the GUI
Two GUI paths exist, and they answer different questions.
Group Policy Results, run from the Group Policy Management Console (gpmc.msc), right-click Group Policy Results → Group Policy Results Wizard, pick a computer and user, and it queries that machine for real, already-applied RSoP data. This is what most people mean by “run an RSoP report”: it shows the Winning GPO for every setting on the Settings tab. Reading remote results requires either local admin rights on the target computer or the delegated Remotely access Group Policy Results data permission on the domain or OU containing it.
Group Policy Modeling, in the same console, is the planning-mode sibling. It simulates a deployment (a different OU, a different security group, a slow link, loopback processing) on a domain controller and shows the net effect without applying anything. It never touches local GPOs, so an object with a local policy layer can show a small gap between the model and reality.
The older standalone snap-in, rsop.msc, still works for a quick logging-mode look at a single computer: mmc → Add/Remove Snap-in → Resultant Set of Policy → Generate RSOP data → Logging Mode. It is the same underlying data as Group Policy Results, just without the GPMC wrapper, useful when GPMC itself isn’t installed.
| Tool | Mode | Best For |
|---|---|---|
| Group Policy Results (GPMC) | Logging | What actually applied, with Winning GPO per setting |
| Group Policy Modeling (GPMC) | Planning | Simulating a move, group change, or new GPO before you make it |
rsop.msc | Logging | A quick local look without opening full GPMC |
gpresult | Logging | Complete data, scriptable, works over the command line and remotely |
gpresult From the Command Line
gpresult runs on the local computer by default and can query a remote one with /s. It requires exactly one output option: /r, /v, /z, /x, or /h. Every invocation except /? needs one.
| Flag | Meaning |
|---|---|
/r | Summary data: which GPOs applied, which were filtered out. |
/v | Verbose. Adds detailed settings for items with precedence 1. |
/z | Everything: every setting at precedence 1 and higher. Large output; redirect it to a file. |
/x <file> | Saves an XML report. Can’t be combined with /u, /p, /r, /v, or /z. |
/h <file> | Saves an HTML report. Same combination restrictions as /x. |
/f | Forces /x or /h to overwrite an existing file. |
/s <system> | Targets a remote computer instead of the local one. |
/user <domain\user> | Targets a specific user’s RSoP data. |
/scope {user | computer} | Limits the report to just user or just computer policy. Omit it to get both. |
# Quick summary of what applied to the current user and computer
gpresult /r
# Full HTML report, opened in a browser afterwards
gpresult /h C:\Reports\gpresult.html /f
# Everything available, redirected to a text file (large output)
gpresult /z > policy.txt
# Query a remote computer for a specific user's results only
gpresult /s srvmain /user contoso\jdoe /scope user /r
# Query a remote computer using alternate credentials
gpresult /s srvmain /u contoso\admin /p /rgpresult /r. It lists applied and denied GPOs with a reason for each denial, which is usually enough to spot a security filter or WMI filter mismatch without wading through /z output.
Get-GPResultantSetOfPolicy in PowerShell
The GroupPolicy PowerShell module, installed alongside GPMC, has a scriptable equivalent: Get-GPResultantSetOfPolicy. It only returns logging-mode data (the actual applied result), not modeling; for planning-mode simulation you still need the GPMC wizard.
# Report for the current session's user and local computer
Get-GPResultantSetOfPolicy -ReportType Html -Path "C:\Reports\LocalUserAndComputer.html"
# Report for a specific remote computer only
Get-GPResultantSetOfPolicy -ReportType Html -Path "C:\Reports\computer-08.html" -Computer "computer-08.contoso.com"
# Report for a specific user, XML format for programmatic parsing
Get-GPResultantSetOfPolicy -ReportType Xml -Path "C:\Reports\jdoe.xml" -User "contoso\jdoe"
-ReportType and -Path are both mandatory; -ReportType only accepts Html or Xml. Leaving out -Computer and -User reports on whichever computer and user the session is currently running as.
Installing GPMC
On Windows Server, GPMC is a feature, not installed by default on every role:
# Install GPMC on a Windows Server
Install-WindowsFeature -Name GPMCOn a Windows 10/11 client, GPMC ships as an RSAT capability rather than a server feature, and only on Pro, Enterprise, or Education editions:
# Install GPMC on a Windows 10/11 client (requires internet access for RSAT)
Add-WindowsCapability -Online -Name Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0Digging Deeper: the gpsvc Debug Log
When gpresult shows a GPO applied but the setting still isn’t taking effect on the machine, the gap is usually between the Group Policy Client service reading the GPO and a Client Side Extension actually writing it. The gpsvc.log debug log records that handoff.
# Enable Group Policy Client service debug logging
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics" /v GPSvcDebugLevel /t REG_DWORD /d 0x30002 /f
# Create the log folder first - gpsvc.log is never written if this is missing
mkdir C:\Windows\Debug\Usermode
# Trigger processing so the log actually gets written
gpupdate /forcegpupdate /force /target:computer and gpupdate /force /target:user separately when you need a clean trace on those hosts.
The resulting log lands at C:\Windows\Debug\Usermode\gpsvc.log. Turn GPSvcDebugLevel back off (delete the value, or set it to 0) once you’re done; it’s not something to leave running.
Common Causes When a GPO Doesn’t Show Up
| Cause | How to Confirm | Fix |
|---|---|---|
| Security filtering excludes the user or computer | gpresult /r lists the GPO under “denied” with a permissions reason. |
Grant the target Read and Apply Group Policy permissions on the GPO, or add it to the correct security group. |
| WMI filter doesn’t match | The Group Policy Modeling report shows the GPO filtered out by its linked WMI filter. | Review the WMI filter’s query against the target’s actual OS, architecture, or hardware attributes. |
| A higher-precedence GPO overrides the setting | Check the Winning GPO column in the Settings tab of a Group Policy Results report. | Adjust link order, or enforce the intended GPO if it needs to override a closer-scoped one. |
| Block Inheritance is set on the OU | The GPMC console shows a blue exclamation icon on the OU; an enforced parent GPO still applies despite it. | Remove Block Inheritance if unintended, or enforce the parent GPO so it applies regardless. |
| Client can’t read SYSVOL (Event 1058) | Event Viewer, Application log, source Group Policy, Event ID 1058, naming the failed GPO path. | Check DNS resolution and connectivity to the domain controller named in the event, and confirm SYSVOL replication (FRS or DFSR) has caught up. |
| GPO applied but the setting on disk didn’t change | gpsvc.log confirms the GPO processed; the registry value or file the Client Side Extension should have written is still the old value. | Check the specific CSE’s own debug log, or watch the target value with Process Monitor to see what’s overwriting it after policy runs. |
Final Thoughts
RSoP and gpresult turn “why isn’t this policy applying” from a guessing game into a lookup. Start with gpresult /r or the GPMC Results Wizard for the summary, escalate to /z or the gpsvc log when the summary doesn’t explain it, and use Group Policy Modeling before you make a change instead of after it breaks something.
Get comfortable reading a Results report end to end, and most Group Policy problems become a five-minute diagnosis instead of an afternoon of re-linking GPOs and hoping.
gpresult /r is the first command to run for any “this GPO isn’t applying” ticket. It names every GPO that applied or was denied, and why, in one pass.
Next, we can look at Group Policy Preferences item-level targeting in more depth, or trace a specific processing failure end to end using the gpsvc log techniques covered here.