Auditing and Managing Group Policy
Once you design and deploy GPOs to support your security policy, it is important to validate your Group Policy to ensure that you have defined the right GPOs. Auditing Group Policy ensures the GPOs you have in place satisfy your security policy. As you change users and computers in your organization, you may find that your GPOs no longer satisfy your security policy. It is important to audit Group Policy periodically to ensure that any changes in your organization have not reduced your GPO’s effectiveness.
Microsoft provides two main tools you will use to audit Group Policy: Group Policy Inventory and Resultant Set of Policy tool. The first tool, Group Policy Inventory, provides an inventory list of GPOs and many other computer and user settings. You must download this program from Microsoft’s website and install it on your computer—it isn’t included when you install Windows. The second tool is included with Windows. The Resultant Set of Policy tool shows what settings Windows applies to a specific user on a specific computer.
Group Policy Inventory
The first step in using the Group Policy Inventory tool (gpinventory.exe) is to download and install it on your computer. You can get the tool from Microsoft’s website. Gpinventory queries the computers you select for system and GPO information and then displays the results in a single window. This tool makes it easy to collect information from many computers across a domain to ensure that your Group Policy is deploying the way that you expect. Follow these steps to run Gpinventory:
Open a PowerShell window—Choose the Windows Start button > type powershell.exe.
Change directories to the install directory for the Gpinventory tool—Enter: cd C:program files (x86)Windows Resource KitsTools.
Run Gpinventory—The command is gpinventory.exe.
Choose the computers to query—Query > Select Computers to Target using Active Directory.
Choose the information you want to gather—Query > Select Information to Gather.
Execute the query—Query > Run Query.
After Group Policy Inventory gathers the information you requested, it displays the results in the main window. You can view the details and save the information to analyze later. The Group Policy Inventory tool will save the results in an XML file or a text file. Use the Results menu item to save the results in either format. Group Policy Inventory is an important tool to provide validation of Group Policy in your domain. Use it after any GPO change and periodically to ensure computers and users are operating with the settings you define to comply with your security policy.
Analyzing the Effect of GPOs
The other common tool you will use to audit GPOs is the Resultant Set of Policy (RSOP) tool. The RSOP tool is included in Windows and shows the specific settings that will result from applying GPOs to a specific user logged on to a specific computer. The Group Policy Inventory tool can include some RSOP results, but the stand-alone RSOP tool provides access to more details. RSOP is a great way to analyze the effect of any GPO changes. RSOP provides two modes of operations—logging mode to show existing GPOs and planning mode that shows the effect of planned GPO changes.
You can run RSOP using two methods. The first method runs RSOP in logging mode that defaults to the currently logged-on user on the current computer. After the initial information displays, you can easily change the user or computer and generate updated GPO information. Follow these steps to run RSOP in logging mode:
Choose the Windows Start button.
Type rsop.msc in the Run box, and then, press Enter.
The Resultant Set of Policy window displays the current settings for the user who is currently logged on. The display looks like the GPMC, but you can’t change any settings here.
If you want to run RSOP for another user or computer, open the context menu (by right-clicking) on the main item in the left panel. This item will be your username and computer name.
On the context menu, select Change Query.
Select the desired computer and user on the next two dialog boxes.
RSOP will calculate the effective settings using the new user and computer you provided.
RSOP also runs in a powerful planning mode. The planning mode is useful when you want to analyze the effects of a GPO change before deploying the change. Follow these steps to run RSOP in planning mode:
Choose the Windows Start button > Windows Administrative Tools > Active Directory Users and Computers.
Open the context menu of the desired object by right-clicking the desired computer, user, domain, or OU.
Select All Tasks > Resultant Set of Policy (Planning).
The next several screens ask you to provide information that describes the planned target environment. RSOP will evaluate the GPOs based on the information you provide here. You can provide the following information:
User and Container—Run RSOP for any user for any container.
Advanced options—Set advanced simulation conditions.
Groups—Analyze the effects of adding or removing group assignments.
WMI Filters—See what effects different WMI filters produce.
Group Policy Inventory and RSOP help you validate the Group Policy you have in place and evaluate how changes will affect your environment. Both tools are important components of a complete administrator’s toolbox.