Group Policy question

flames1000

Hi All,

A quick question. Do you use RSOP to see where in the registry a change is made? Iam looking into the differences with RSOP and gpresult. Iam thinking that RSOP shows where in the registry the chane applies to but gpresult does not.

Thanks!

Silver Bullet

RSoP, Resultant Set of Policy, is displayed by using the gpedit command. Try using the gpedit /v command and you will see more detailed information.

I believe you use the Security Configuration and Analysis MMC snap-in to compare templates. You can also use the secedit.exe command to compare templates.

s73v3n2k

Its my understanding that RSoP is a way of displaying the policies being applied to a user on a computer and is contained and is accessed from its own mmc snap-in

start > run > type Rsop.msc

Gpresult.exe is designed to do the same it shows the polices in effect on the machine its run on however its a command line tool.

Both differ from Gpedit in that they show a cumulative result of policies in effect i.e a user may be in a number of groups with a number of policies in effect where as Gpedit is aimed at viewing/editing selected polices.

Also from what i have read secedit has been replaced by gpupdate in both XP and 2003 server.

I haven't done my 70-270 exam yet so if some one who has can confirm this, i may be wrong

Silver Bullet

I don't know how I typed gpedit. (What a brain fart)

I think you would have found that gpedit.exe doesn't work as a command from c:\ unless you replace .exe with .msc then you will be greeted with a gui.

run from the run line as gpedit.msc gives you a gui, and you are right, it is geared at viewing/editing group policy.

gpresult /v command will give you verbose information on RSoP in a command line interface. RSoP.msc from run is gpresult (with whatever switch you use), just in gui format.

Security Configuration and Analysis Tool is used to make comparisons between templates.

Silver Bullet

Also from what i have read secedit has been replaced by gpupdate in both XP and 2003 server.

gpudate only replaces secedit /refreshpolicy

Silver Bullet

Here is a good reference for the Secedit command

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/secedit_cmds.mspx

mobri09

Gpresult would be the way to go to track down a detailed answer for the group policy dealing with the regestry. Its for ALL group policies and for users and computers. RSOP is just for users!