Group Policy inventory and maintenance

Export a report per domain

With the GroupPolicy module and access to the domain:

Get-GPOReport -All -Domain 'contoso.com' -ReportType Html `
    -Path '.\all-group-policies.html'
Get-GPO -All -Domain 'contoso.com' |
    Select-Object DisplayName, Id, GpoStatus, CreationTime, ModificationTime

The HTML report helps spot overlapping settings and unrelated settings bundled into the same policy. Keep the domain and collection time with it. The report shows configuration, but it can’t restore a GPO. See Get-GPOReport.

Record which views the assessment actually covered

Keep track of what you checked alongside the findings. Exporting every setting from one domain or DC doesn’t check all replicas in the forest, or tell you what a client processed.

Choose clients that exercise the suspected problem: OS/build, site/network path, user and computer OU, filtering groups, loopback, and application role. Three convenient machines in one office may tell you little about branch clients or shared session hosts. Mark an unreachable target or failed extension report as not assessed, with the error and reason. Don’t let a failed collection become a passing row.

GPMC separates policy configuration, Modeling and Results. Get-GPResultantSetOfPolicy produces logging results for the selected computer/user; it does not run a hypothetical model. For example, with the GroupPolicy module, required remote access and an existing protected output directory, this writes a local report:

Get-GPResultantSetOfPolicy -Computer 'WS1.contoso.com' `
    -User 'CONTOSO\ExampleUser' -ReportType Html `
    -Path 'C:\GpoEvidence\WS1-ExampleUser.html'

Check the returned RsopMode, LoggingComputer, LoggingUser and LoggingMode against the intended case. The cmdlet reference defines that scope. Use the client trace when a report cannot explain the missing setting, and baseline validation when comparing intended security settings with actual behavior.

Back up before a cleanup

Writes backup files; does not change the GPO: create the destination first, then take the backup.

$backup = Join-Path 'C:\GpoBackups' (Get-Date -Format 'yyyyMMdd-HHmmss')
New-Item -ItemType Directory -Path $backup -ErrorAction Stop | Out-Null
Backup-GPO -All -Domain 'contoso.com' -Path $backup

Check the backups and make sure you can access them. Record links, inheritance, WMI filter definitions, and dependencies separately; the GPO backups alone won’t reconstruct the whole deployment. See Backup-GPO.

Unlinked is a review candidate

An unlinked GPO may be a staged replacement, rollback copy, or deliberate template. It is not automatically safe to delete.

Get-GPO -All -Domain 'contoso.com' | ForEach-Object {
    $gpo = $_
    [xml]$report = Get-GPOReport -Guid $gpo.Id -Domain 'contoso.com' -ReportType Xml
    if (-not $report.SelectSingleNode("/*[local-name()='GPO']/*[local-name()='LinksTo']")) {
        $gpo | Select-Object DisplayName, Id, ModificationTime
    }
}

This checks the report’s XML structure rather than looking for a missing string on each line. It gives you candidates to review, not proof that a GPO is unused across the forest. Check site links in the Configuration NC, domain/OU links in every relevant domain, and cross-domain links within the forest. An incomplete or inaccessible report can’t tell you there are no links. Confirm links and ownership in GPMC before taking action. A disabled link is also different from a disabled GPO section.

The Central Store serves editors

\\contoso.com\SYSVOL\contoso.com\Policies\PolicyDefinitions

ADMX files and the matching language ADML files tell the editor how to present settings. Clients apply policy data; they do not download these templates to discover how to apply each setting.

Keep a managed template set and a record of its versions. Missing or mismatched templates can hide an existing setting or show it as an extra registry setting without removing the actual setting from a GPO. The local EnableLocalStoreOverride DWORD can direct a particular editor to its local PolicyDefinitions folder for diagnosis; it changes that editor’s behavior, not the policy clients receive. See Central Store override behavior.

Check for old preference credentials

MS14-025 prevented creation of the affected password-bearing preferences through updated management tools, but old XML and backups can still contain cpassword material. Removing an obsolete item does not revoke an exposed password: rotate the affected credential and inspect retained copies too. Keep collection output restricted because policy reports can reveal sensitive configuration. See Microsoft’s MS14-025 guidance.

Collect debug logging for a short reproduction

Changes local logging: GPSvc verbose logging uses the DWORD GPSvcDebugLevel under:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics

Set 0x30002 for diagnostic output in %windir%\debug\usermode\gpsvc.log. The directory must exist. Record the previous value, reproduce briefly, save the log, then restore the previous logging setting. Follow the documented collection steps.

For current work, begin with GPMC infrastructure status, AD/DFSR health, gpresult, and operational events. dcgpofix is a recovery tool with a specific scope, not a generic health-check cleanup command.

Inventory permissions separately from settings

$gpo = Get-GPO -Name 'Workstation baseline' -Domain 'contoso.com' `
    -Server 'DC1.contoso.com'
Get-GPPermission -Guid $gpo.Id -All -DomainName 'contoso.com' `
    -Server 'DC1.contoso.com' |
    Select-Object Trustee, Permission, Inherited

This lists assigned GPO permissions; it doesn’t work out effective access through every nested group and deny ACE. Check read/apply permissions separately from the ability to edit the policy or its ACL. Someone who can change a policy linked to privileged systems may have a route to administering them, even if the group name looks ordinary. The permission cmdlet describes the permission levels.

Preserve computer read permissions when narrowing user-policy filtering. MS16-072’s retrieval behavior means a user-only filter can still fail if the computer cannot retrieve the policy.

A restore and an import have different identities

Restore-GPO changes directory and SYSVOL data: it restores a backed-up GPO to its original domain and identity. Choose a specific backup version when the purpose is rollback; a display name alone may select the latest available backup rather than the desired point in time. Check links and external dependencies separately. See Restore-GPO.

Import-GPO changes settings in a target GPO: it is useful when moving settings to a different policy or domain. A migration table can map security principals and UNC paths. Importing settings does not make the target policy the original object or reproduce every deployment dependency. See Import-GPO.

Test the import against a lab target with representative accounts, shares, and applications. Keep the original backup unchanged while preparing mappings.

Retain a template version as a set

Treat ADMX files and their language-specific ADML resources as a matched set. Stage and test template updates with the editor versions the team actually uses. Keep a recoverable previous Central Store and inspect vendor template dependencies before replacing files.

“Extra Registry Settings” doesn’t mean a registry policy stopped applying. The current editor templates may simply no longer describe data still in the GPO. Changing templates changes the editor; removing a setting means changing the policy data. The Central Store management guide covers creation and updates.

Keep default-policy repair in its narrow scope

dcgpofix rebuilds the default domain and/or default domain controllers policy configuration within its documented scope. It does not restore arbitrary deleted GPOs or recover an organization’s customized settings from a backup. Run it only when default-policy recovery is the identified task and its consequences are understood. The command reference documents those targets. A bad setting in a custom baseline calls for a scoped edit or backed-up policy restoration instead.

Classify an orphan before removing anything

Use explicit DC paths under the identity that failed, and read the same DC’s GPC. A domain UNC may choose another SYSVOL replica and hide the mismatch. Back up the directory metadata and candidate file copies before repair. GPMC’s infrastructure status and replication checks check different parts of this; one inaccessible path doesn’t establish an orphan.

The GPC’s GUID-form name identifies its corresponding GPT directory. Do not assume that the AD object’s objectGUID equals that policy-name GUID. Record the GPO ID, owning domain, display name, and selected DC together. Duplicate display names across domains are a practical reason to use GUID plus domain in scripts.

If the GPC’s files are missing everywhere, look for a valid GPO backup or an isolated surviving copy. If an old folder really has no GPC, check that AD deletion and file replication have converged before removing it. Editing version counters to make the comparison pass won’t recreate a script, repair its ACL, or recover lost registry policy data.

Separate design exceptions from health failures

An enforced link, inheritance block, WMI filter, read-only permission, disabled GPO half, custom ACL, or version zero is a review condition, not intrinsically a defect. Computer read-only access can be required for user-policy retrieval. A version zero is not a substitute for a settings report, and nonzero versions can describe a policy whose settings were subsequently removed.

Review disabled halves that still contain settings for intent and rollback use. Review large binaries and unrelated data in SYSVOL for deployment purpose and replication cost. Preserve custom templates and scripts before changing their storage. Use actual CSE timings, replication workload and administration needs to prioritize changes; arbitrary OU-depth, name-length or GPO-count thresholds do not establish client processing harm.