Troubleshooting Policy Settings
With all the complexity of GPO processing through the series of L-S-D-OU-OU-OU, and with Block Inheritance and Enforced settings, you might easily recognize that, on occasion, what you get from your collection of GPOs isn't exactly what you expected. To help you sort through this maze of policies and settings, Microsoft has provided several different tools.
Group Policy Results and Group Policy Modeling
The first two tools, and probably the most recommended, can be accessed within the Group Policy Management Console (GPMC):
- Group Policy Results
- Group Policy Modeling
These two tools and a summary from the Group Policy Results tool, are shown in Figure 3.20.
Figure 3.20 Using the Group Policy Results tool in the GPMC.
The Group Policy Results Tool
The Group Policy Results tool allows you to identify the effective GPOs and their settings that configure and control the user's session on the computer. You specify which computer and which user to run the analysis on. The Group Policy Results tool performs its analysis based on where the specified computer account actually is located within AD and where a specified user account actually is located within AD to produce the effective GPO results. The Group Policy Results tool is often called the "What is" analysis tool.
The Group Policy Modeling Tool
The Group Policy Modeling tool is used to experiment with "What if" scenarios. It allows you to specify a computer account and a user account to analyze. It then allows you to manipulate where the computer account might be placed within AD and where the user account might be placed within AD. Finally, the Group Policy Modeling tool calculates the effective GPOs and their settings that configure and control the user's session on the computer, based on their newly proposed positions within AD.
Resultant Set of Policies (RSoP)
Another tool that is available in Windows Vista was available in earlier operating systems. It is called the Resultant Set of Policies (RSoP) tool. This tool is still available in Windows Vista as a snap-in to the Microsoft Management Console (MMC) and must be assembled to be accessed.
Just like the Group Policy Results tool, you select which computer and which user to run the analysis on. The RSoP tool performs its analysis based on where the specified computer account actually is located within AD and where a specified user account actually is located within AD to produce the results. The Resultant Set of Policy tool is also called a "What is" analysis tool because it too is based on the objects' actual locations in AD.
As shown in Figure 3.21, the RSoP tool presents the results like a GPO is formatted. This makes a quick overview more difficult than the summary of settings that is presented with the newer Group Policy Modeling and Group Policy Results tools inside the GPMC, and explains why this might not be your first choice of GPO analysis tools.
Figure 3.21 Using the Group Policy Results tool in the GPMC.
The X icon in Figure 3.21 identifies that a security identifier (SID) failed to resolve to a name. This is usually the result of a renamed or deleted user or computer account.
GPResult.exe Command-Line Tool
A third tool to perform a similar analysis is the command-line tool called GPResult.exe. This tool analyzes only the local machine where the command is executed and the user who is currently logged on to that machine. The output is ASCII text. It identifies the computer and its configuration and status on the network and also its position in AD. Then GPResult reports on all the GPOs that affect the computer. GPResult then repeats the process for the user who is logged on to the computer.