Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been given the task to clean up ADUC/Group Policy.

Quite daunting due to the perplexing manner it was all put together. It appears to have been put together with a "try this, didn't work, don't worry about deleting it, just try this, rinse/repeat" method.

Moving on. I've got users organized the way I'd like it. But before I start removing/adding objects to the security groups I'd like to see what policies they are inheriting. I'm doing this with hope there is justification for some of this crud I'm seeing.

In other words: How can I tell what policies are being applied to a particular security group?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

What you want is the GPMC - the Group Policy Management Console. It allows you to run reports on users & computers to see what the "RSOP" or Resultant Set of Policies is.

share|improve this answer

Policies are not applied to security groups (they're for security settings, not policies); Policies are applied via group/OU membership.

If you edit a specific policy, then in the Group Policy Object Editor you can right-click the Policy name and choose Properties. Then in the Links tab you can use the 'find now' button to determine which policy group(s)/OU(s) the policy applies to.

Get yourself the Group Policy Management Console from MS if you don't have it already. It will make it much more obvious as to what policies apply to which groups.

Also you can use RSOP.MSC on a workstation to determine how the policies are affecting that workstation/user.

Hope that helps...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.