# Gpresult.exe: Group Policy Results

This command-line tool displays information about the result Group Policy has had on the current computer and logged-on user.

GPResult provides the following general information:

- Operating System

- Type (Professional, Server, Domain Controller).
- Build number and Service Pack details.
- Whether Terminal Services is installed and, if so, the mode it is using.

- User Information

- User name and location in Active Directory (if applicable).
- Domain name and type (Windows 2000 or Windows NT).
- Site name.
- Whether the user has a local or roaming profile and location of the profile.
- Security group membership.
- Security privileges.

- Computer Information

- Computer name and location in Active Directory (if applicable).
- Domain name and type (Windows 2000 or Windows NT).
- Site name.

GPResult also provides the following information about Group Policy:

- The last time policy was applied and the domain controller that applied policy, for the user and computer.
- The complete list of applied Group Policy objects and their details, including a summary of the extensions that each Group Policy object contains.
- Registry settings that were applied and their details.
- Folders that are re-directed and their details.
- Software management information detailing assigned and published applications.
- Disk quota information.
- IP Security settings.
- Scripts.

File Required

- Gpresult.exe

GPResult Topics

- GPResult Syntax
- Interpreting GPResult Output

top

## GPResult Syntax

gpresult [/v] [/s] [/c] [/u] [/?]

Where:

/v
  runs GPResult in verbose mode.
  - Adds list of user's security privileges.
  - Adds Group Policy object details (GUID, friendly name, version, source).
  - Adds details for the following Group Policy extensions:
  - Administrative Templates (Registry-Based Policies)
  - Application Management
  - Disk Quotas
  - Folder Re-direction
  - IP Security
  - Scripts
/s
  runs GPResult in super-verbose mode. This includes the same information as verbose in addition to:
  - Binary values of binary registry settings when applicable.
  - A detailed list of which applications will be displayed in Add/Remove Programs.
  - Both version numbers of a Group Policy object (the version number of the GPC and the version number of the GPT).
/c
  displays information on computer settings only.
/u
  displays information on user settings only.
/?
  displays a command-line syntax screen.

top

## Interpreting GPResult Output

This example analyzes the output of Group Policy Results when run in verbose mode using the following command line:

`gpresult /v`

### Operating System Information

When GPResult is run with any mode, the following operating system information is always displayed at the top of the output:

    Microsoft (R) Windows (R) 2000 Operating System Group Policy Result tool
    Copyright (C) Microsoft Corp. 1981-1999

    Created on Wednesday, September 29, 1999 at 2:47:26 PM

    Operating System Information:

    Operating System Type:          Professional
    Operating System Version:       5.0.2128
    Terminal Server Mode:           Not supported

This output provides you with:

- Operating system type (Professional, Server, Domain Controller)
- Operating system version (build number and any installed Service Packs)
- Terminal Server mode, which indicates if Terminal Server is installed and if so, the mode in which it is installed

### User Output

Following the operating system output comes general information for the current user.

The output begins by detailing the user's configuration. This includes domain membership, domain type, and the current site as indicated below:

    User Group Policy results for:

    CN=Alan Steiner,OU=Users,OU=Test,DC=ntdev,DC=microsoft,DC=com

    Domain Name:          NTDEV
    Domain Type:          Windows 2000
    Site Name:            Red-Bldg99

Following this the output details profile information about the user. The output details the roaming profile (if applicable) and location of the current profile that is in use.

    Roaming profile:      \\ntprofiles\roamprof\AlanS
    Local profile:        C:\Documents and Settings\AlanS

Next the output details all the security groups that the user belongs to:

    The user is a member of the following security groups:

    	GROUP1\Domain Users
    	\Everyone
    	BUILTIN\Administrators
    	BUILTIN\Users
    	BUILTIN\Power Users
    	GROUP1\RedirectedDesktop
    	GROUP1\Department 15333
    	GROUP1\mydocs1
    	\LOCAL
    	NT AUTHORITY\INTERACTIVE
    	NT AUTHORITY\Authenticated Users

Following the details of security group membership, the output continues by detailing all of the user's security privilege information:

    The user has the following security privileges:

    	Bypass traverse checking
    	Manage auditing and security log
    	Back up files and directories
    	Restore files and directories
    	Change the system time
    	Shut down the system
    	Force shutdown from a remote system
    	Take ownership of files or other objects

For the complete list of security privileges that may be displayed by GPResult, please refer to Security Privileges below.

After detailing security privileges, a time stamp of when the last time Group Policy was applied to current user and the domain controller from which the policy was applied to the current user are listed.

    ###############################################################

    Last time Group Policy was applied: Monday, September 06, 1999 at 9:25:40 AM
    Group Policy was applied from: NTDS.ntdev.microsoft.com

    ===============================================================

#### Administrative Templates (Registry-Based Policy)

Next, if any registry-based policies have been applied to the user, the following is displayed:

    The user received "Registry" settings from these Group Policy objects (GPOs):

    	Local Group Policy
    	    Revision Number:	40
    	    Unique Name:		Local Group Policy
    	    Domain Name:

    	EU-DesktopLockDown-Admin
    	    Revision Number:	12 (Active Directory) 12 (Sysvol)
    	    Unique Name:		{EF06ECF2-A8C9-11D2-B575-0008C7457B4E}
    	    Domain Name:		group.microsoft.com
    	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

    	EU-DesktopSetup-Admin
    	    Revision Number:	7 (Active Directory) 7 (Sysvol)
    	    Unique Name:		{29021088-BF90-11D2-8614-00C04FF621C4}
    	    Domain Name:		group.microsoft.com
    	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

Output details:

- The output is a list of Group Policy objects that contain registry-based policy settings (including Local Group Policy)
- Each Group Policy object is displayed with the following details:

- Friendly Name
- Revision Number
- Unique Name (GUID or Local Group Policy)
- Domain Name
- Linking information

Next the details of the actual registry-based settings that were applied are displayed:

    The following settings were applied from: Local Group Policy

    	    KeyName:	Software\Microsoft\Windows\CurrentVersion\Policies\System
    	    ValueName:	VerboseStatus
    	    ValueType:	REG_DWORD
    	    Value:		0x00000001

     	    KeyName:	Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
     	    ValueName:	NoSMHelp
     	    ValueType:	REG_DWORD
     	    Value:		0x00000001

    The following settings were applied from: Default Domain Policy

    	    KeyName:	Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    	    ValueName:	NoManageMyComputerVerb
    	    ValueType:	REG_DWORD
    	    Value:		0x00000001

     	    KeyName:	Software\Microsoft\Windows\CurrentVersion\Policies\System
     	    ValueName:	VerboseStatus
     	    ValueType:	REG_DWORD
     	    Value:		0x00000001

Output details:

- The output lists all registry settings that were applied to the user and the Group Policy object (by its friendly name) that supplied the registry settings.
- Each registry settings is displayed with the following details:
  - Keyname (location in the registry)
  - ValueName
  - ValueType (for example, DWORD or STRING)
  - Value (The value is displayed here only if it is non-binary. To see a binary value, run GPResult in super-verbose mode with the /s switch.

Note

If any of the registry settings is written to a location outside the locations the Group Policy handles, this registry setting is not a true policy setting. Group Policy uses only the following locations:

- \Software\Policies
- \Software\Microsoft\Windows\CurrentVersion\Policies

If any registry settings outside of these locations are applied, the following warning is also displayed.

    +++++++  Warning!  The next registry setting is not a true policy setting
    +++++++            and will be left in the registry when the GPO
    +++++++            that created it is no longer applied.

#### Folder Redirection

If any Folder Redirection policy settings have been applied to the user, output similar to the following is displayed:

    ===============================================================
    The user received "Folder Redirection" settings from these GPOs:

    	EU-RedirectedDesktop-User1
    	    Revision Number:	14 (Active Directory) 14 (Sysvol)
    	    Unique Name:		{C19B776C-A8E8-11D2-9BEB-00A024070A22}
    	    Domain Name:		ntdev.microsoft.com
    	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

    	EU-FolderRedirection-User1
    	    Revision Number:	12 (Active Directory) 12 (Sysvol)
    	    Unique Name:		{FBEE2508-BCAA-11D2-B3EE-00C04FA3787A}
    	    Domain Name:		ntdev.microsoft.com
    	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

    	Desktop is redirected to \\ntpolicy1\desktop\%username%
    	My Pictures is redirected to \\ntpolicy1\mydocs1\%username%\My Pictures
    	My Documents is redirected to \\ntpolicy1\mydocs1\%username%

Output details:

- The output is a list of Group Policy objects that contain Folder Redirection policy settings (including Local Group Policy).
- Each Group Policy object is displayed with the following details:

- Friendly name
- Revision number
- Unique name (GUID or Local Group Policy)
- Domain name
- Linking information

- A list of the folders that have been re-directed, and their re-directed location, is also displayed.

#### Scripts

If any Scripts policy settings have been applied to the user, output similar to the following is displayed:

    ===============================================================
     The user received "Scripts" settings from these GPOs:

     	EU-Marketing
     	    Revision Number:	12 (Active Directory) 12 (Sysvol)
     	    Unique Name:		{EF068882-A229-11D2-B575-0008C7457B4E}
     	    Domain Name:		ntdev.microsoft.com
     	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

     EU-Canada
     	    Revision Number:	44 (Active Directory) 44 (Sysvol)
     	    Unique Name:		{HJ924782-A444-11D2-B444-00039573954F}
     	    Domain Name:		ntdev.microsoft.com
     	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

     	Logon scripts specified in:  EU-Marketing
     	    \\marketing1\logon$\adlogon.bat

     	Logoff scripts specified in:  EU-Marketing
     	    \\marketing1\logon$\adlogoff.bat

     	Logon scripts specified in:  EU-Canada
     	    \\toronto3\logon$\pplogon.bat

     	Logoff scripts specified in: EU-Canada
     	    \\toronto3\logon$\adlogoff.bat

Output details:

- The output is a list of Group Policy objects that contain Scripts policy settings (including Local Group Policy).
- Each Group Policy object is displayed with the following details:

- Friendly name
- Revision number
- Unique name (GUID or Local Group Policy)
- Domain name
- Linking information

- A list of scripts that were run is displayed with the following details:

- Type of script (logon, logoff, startup, shutdown)
- Script name
- Location from where the script was run

#### Application Management

If any Application Management policy settings have been applied to the user, output similar to the following is displayed:

    ===============================================================
     The user received "Application Management" settings from these GPOs:

     	EU-CorpStandard
     	    Revision Number:	156 (Active Directory) 156 (Sysvol)
     	    Unique Name:		{9B4293472AC06-44D2-B22A-0008C7457E8J}
     	    Domain Name:		ntdev.microsoft.com
     	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

     	EU-RedmondSite
     	    Revision Number:	1536 (Active Directory) 1536 (Sysvol)
     	    Unique Name:		{9B4999999AC06-12O2-B66A-0008C7457B4E}
     	    Domain Name:		ntdev.microsoft.com
     	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

     	The user has been assigned the following applications:

     	    Microsoft Office 2000 Premium (RTM)
     		GPO Name:	EU-CorpStandard
     		Removal Option:	Application is uninstalled when policy is removed

     	    Microsoft FrontPage 20000
     		GPO Name:	EU-RedmondSite
     		Removal Option:	Application is uninstalled when policy is removed

     	The user has installed the following published applications:

     	    WinZip 7.0
     		GPO Name:	EU-CorpStandard
     		Removal Option:	Application is uninstalled when policy is removed

Output details:

- The output is a list of Group Policy objects that contain Application Management policy settings (including Local Group Policy).
- Each Group Policy object is displayed with the following details:

- Friendly name
- Revision number
- Unique name (GUID or Local Group Policy)
- Domain name
- Linking information

- A list of assigned and published applications is displayed with the following details:

- Assigned or published
- Name of application
- Name of Group Policy object where the application was configured
- Removal Option information for the application

If GPResult had instead been run in Super verbose mode (/s), it would also have provided information on which applications would be available in Add/Remove Programs. The output would look similar to the following:

    The user has the following applications available in Add/Remove Programs:

     	    Microsoft Money 99
     		GPO Name:	EU-RedmondSite
     		Installed:	No

     	    Connection Manager Self Host -- Smart Card Corpnet Access
     		GPO Name:	EU-RedmondSite
     		Installed:	No

     	    Microsoft Excel 97 SR2 (Legacy Deployment)
     		GPO Name:	EU-RedmondSite
     		Installed:	No

Output details:

- The output is a list of applications that will appear in Add/Remove Programs. The details provided are:

- Name of application
- Name of Group Policy object where the application was configured
- Installed or not installed

#### Other Group Policy Extensions

For other Group Policy extensions that ship with Windows 2000 that have been applied to the user, the following is displayed for each of these extensions:

    ===============================================================
    The user received "Name of the Extension" settings from these GPOs:

    	EU-SecurityB31
    	    Revision Number:	14 (Active Directory) 14 (Sysvol)
    	    Unique Name:		{C19ASDAS-ADD8-11D2-9BEB-002342342342}
    	    Domain Name:		ntdev.microsoft.com
    	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

    	EU-SecurityHR
    	    Revision Number:	12 (Active Directory) 12 (Sysvol)
    	    Unique Name:		{FBEASDAS-BDDA-11D2-B3EE-002342342342}
    	    Domain Name:		ntdev.microsoft.com
    	    Linked to:			Domain (DC=ntdev,DC=microsoft,DC=com)

### Computer Output

This section repeats the same processes as above for User Output, but this time displays information for the computer that the user has logged on to.

The output begins with general information for the computer, including the computer name and location, domain name, domain type and site name as indicated below.

    ###############################################################

      Computer Group Policy results for:

      CN=DEVPC01,CN=Computers,DC=ntdev,DC=microsoft,DC=com

      Domain Name:          NTDEV
      Domain Type:          Windows 2000
      Site Name:            Red-Bldg99

After detailing the general information, the output shows a time stamp of when the last time Group Policy was applied to this computer and the domain controller from which Computer Group Policy was applied.

    ###############################################################

    Last time Group Policy was applied: Monday, September 07, 1999 at 7:51:59 AM
    Group Policy was applied from: NTDS.ntdev.microsoft.com

    ===============================================================

The Registry Based Policy, Folder Re-direction, and other Group Policy extensions that have been applied to this computer are detailed at this point. This information is output in the same format as detailed earlier in this document for the User Output.

In addition, the Computer section displays the following when applicable:

#### IP Security

If any IP Security policy settings have been applied to the computer, output similar to the following is displayed:

    ===============================================================
     The computer received "IP Security" settings from these GPOs:

     	EU-IPSecDefaultClientPol-RandyRam
     	    Revision Number:	5 (Active Directory) 5 (Sysvol)
     	    Unique Name:	{6EB61A60-A991-11D2-9BEB-00A024070A22}
     	    Domain Name:	ntdev.microsoft.com
     	    Linked to:		Domain (DC=ntdev,DC=microsoft,DC=com)

     	Policy Name:	NTDEV Default Client Policy
     	Description:	All NTDEV machines get this
     	Policy Path:	LDAP://CN=ipsecPolicy{163E9FDB-A9AE-11D2-AFD6-006097936A9F},
    CN=IP Security,CN=System,DC=ntdev,DC=microsoft,DC=com

Output details:

- The name of the Group Policy object that applied IP Security settings. For this Group Policy object, the following details are displayed:

- Friendly name
- Revision number
- Unique name (GUID or Local Group Policy)
- Domain name
- Linking information

- IP Security settings details:

- Policy name
- Description
- Policy path

#### Disk Quotas

If any Microsoft Disk Quota policy settings have been applied to the computer, output similar to the following is displayed:

    ===============================================================
     The computer received "Microsoft Disk Quota" settings from these GPOs:

     	Local Group Policy
     	    Revision Number:	25
     	    Unique Name:		Local Group Policy
     	    Domain Name:
     	    Source:		Local computer

     	Disk Quotas enabled:			Yes
     	Disk Quotas enforced:			Yes
     	Quota limit:				80 MB
     	Warning level:				120 MB
     	Log event when quota limit exceeded:		No
     	Log event when quota warning level exceeded:	No
     	Apply policy to removable media:		No

Output details:

- The name of the Group Policy object that applied Microsoft Disk Quotas. For this Group Policy object, the following details are displayed:

- Friendly name
- Revision number
- Unique name (GUID or Local Group Policy)
- Domain name
- Source

- Disk Quota details:

- Disk Quotas enabled: yes/no
- Disk Quotas enforced: yes/no
- Quota limit
- Warning level
- Log event when quota limit reached: yes/no
- Log event when quota warning level exceeded: yes/no
- Apply policy to remove media: yes/no

### Security Privileges

Complete list of security privileges that can be tracked by GPResult in verbose mode:

    "Create a token object"
    "Replace a process level token"
    "Lock pages in memory"
    "Increase quotas"
    "Add workstations to domain"
    "Act as part of the operating system"
    "Manage auditing and security log"
    "Take ownership of files or other objects"
    "Load and unload device drivers"
    "Profile system performance"
    "Change the system time"
    "Profile single process"
    "Increase scheduling priority"
    "Create a pagefile"
    "Create permanent shared objects"
    "Back up files and directories"
    "Restore files and directories"
    "Shut down the system"
    "Debug programs"
    "Generate security audits"
    "Modify firmware environment values"
    "Bypass traverse checking"
    "Force shutdown from a remote system"
    "Remove computer from docking station"
    "Synchronize directory service data"
    "Enable computer and user accounts to be trusted for delegation"