Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been given the task to clean up ADUC/Group Policy.

Quite daunting due to the perplexing manner it was all put together. It appears to have been put together with a "try this, didn't work, don't worry about deleting it, just try this, rinse/repeat" method.

Moving on. I've got users organized the way I'd like it. But before I start removing/adding objects to the security groups I'd like to see what policies they are inheriting. I'm doing this with hope there is justification for some of this crud I'm seeing.

In other words: How can I tell what policies are being applied to a particular security group?

share|improve this question
up vote 3 down vote accepted

What you want is the GPMC - the Group Policy Management Console. It allows you to run reports on users & computers to see what the "RSOP" or Resultant Set of Policies is.

share|improve this answer

Policies are not applied to security groups (they're for security settings, not policies); Policies are applied via group/OU membership.

If you edit a specific policy, then in the Group Policy Object Editor you can right-click the Policy name and choose Properties. Then in the Links tab you can use the 'find now' button to determine which policy group(s)/OU(s) the policy applies to.

Get yourself the Group Policy Management Console from MS if you don't have it already. It will make it much more obvious as to what policies apply to which groups.

Also you can use RSOP.MSC on a workstation to determine how the policies are affecting that workstation/user.

Hope that helps...

share|improve this answer

Global Groups are very often used as filters to group policy. I came looking for an answer to the initial question and found the answers presented less than helpful. Our environment has hundreds of GPO's and hundreds of Global Groups (Security Groups)so I was hoping someone else came up with an answer... Time for brushing up the powershell skill!

Technically speaking, policies are applied based upon rule sets defined in a hierarchical manner. We currently filter primarily on global group membership. The primary limitation of this method is that the operation occurs under the USER security context. We also employ WMI filters for user targeted settings for machine level changes. Machine changes are usually done with NO global group filters so that they can operate under the machine security context. Machine based/OU membership is difficult to maintain on an enterprise scale.

share|improve this answer
Welcome to superuser! It's not clear if you're offering an answer here to the OPs question. If so, could you clarify how he might solve his dilemma? If not, your answer will likely be removed as being a non-answer. – Twisty Sep 26 '14 at 0:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .