The gpresult command is a built-in Windows diagnostic tool that displays the Resultant Set of Policy (RSoP), the actual Group Policy settings currently applied to a specific user or computer. System administrators often use it to verify if Group Policy Objects (GPOs) are applied correctly, troubleshoot policy conflicts, audit security settings, and confirm policy compliance across domain-joined machines.

What is the gpresult command?

The gpresult command displays the RSoP report, a snapshot of all Group Policy settings that were applied to a user or computer the last time a Group Policy was processed. It shows which GPOs were applied, which were filtered or denied, and the precedence order to resolve conflicts.

RSoP works in two modes:

• Logging mode: Reports the policy settings that were actually applied the last time Group Policy ran on the machine.
• Planning mode: Simulates what policies would apply to a user or computer under hypothetical conditions, such as a different OU, different security group membership, or different site. This mode is available through the GPMC's Group Policy Modeling Wizard, not gpresult.

gpresult syntax and parameters

Here's the syntax for the gpresult cmdlet:

How to run gpresult

To run the gpresult command:

1. Open Command Prompt as an administrator.
2. Type your gpresult command with the desired parameters and press Enter.
3. Review the output, or open the exported HTML or XML report in a browser.
   Copy gpresult /r

Using gpresult /scope computer

The /scope computer parameter filters output to show the policies under Computer Configuration, such as password policies, software deployments, and security settings that apply regardless of who is logged on. Unlike /scope user, it always requires an elevated Command Prompt. The output includes the machine's OS configuration and AD site, whether a slow link was detected during the last refresh, the timestamp and domain controller (DC) of the last successful computer policy refresh, applied GPOs in precedence order, and any filtered GPOs.

Understanding gpresult output: /r vs. /v vs. /z

Choosing the right parameter is important as each returns a different level of detail. Here is what each flag provides and when to use it:

gpresult /r for RSoP summary

gpresult /r is the standard starting point for most policy verification tasks. When run as administrator, it returns two sections:

• Computer Configuration: Displays the computer's OU path, the domain name, the last Group Policy processing time, and the list of applied GPOs.
• User Configuration: Displays the user's OU path, security group memberships, and the list of applied GPOs under User Configuration. GPOs excluded by security filtering or WMI filtering appear in a separate Denied GPOs section.

gpresult /v for verbose mode

gpresult /v adds a significant amount of extra detail over the /r parameter. In addition to everything /r returns, /v includes:

• The registry key path where each policy setting is stored (e.g., HKLM\Software\Policies\...)
• Logon and logoff script filenames and the last time each script executed
• Folder redirection settings with the target paths
• Software installation policy details
• Additional administrative template settings with their configured values

gpresult /z for super-verbose mode

When multiple GPOs configure the same setting, Windows applies them in LSDOU order with each level overriding the one before it. A GPO linked to a child OU therefore takes precedence over a conflicting setting at the domain level. Within the same container, link order determines the winner.

gpresult /r shows which GPOs were applied but not which one enforced a specific setting. To understand precedence, you can use the /z parameter. It returns everything /v shows, along with:

• All GPOs that have a particular setting configured, including those that were overridden by higher-precedence GPOs
• Precedence values for each conflicting policy setting, showing exactly which GPO won and why

Exporting gpresult output to HTML, XML, and text files

Export to HTML with gpresult /h

The /h parameter saves the RSoP report as an HTML file that can be opened in any browser. It produces a well-formatted and color-coded report that is far easier to read than the console output, especially for storing as a compliance record. Use the following command to export it:

Where does gpresult /h save the file?

To save the file in a specific path, use the following command:

If the file already exists and you want to overwrite it, add the /f flag:

To open the report, navigate to the saved path in File Explorer and double-click the file, or open it directly from the command line:

Export to XML with gpresult /x

The /x parameter generates an XML version of the same RSoP data. This is useful when you want to parse policy results programmatically.

Export to a text file

For simple text output, redirect the console output to a file using the > operator. This works with any gpresult flag:

The > operator creates the file if it does not exist and overwrites it if it does. Use >> to append to an existing file instead of overwriting.

Example scripts and use cases

Example 1: Check only user policy settings

Example 2: Check only computer policy settings

Example 3: Verify if GPOs are applied to a specific user

Example 4: Running gpresult on a remote computer

Example 5: Filtering output with findstr

gpresult output can run to hundreds of lines. Piping it through findstr lets you isolate exactly what you are looking for without scrolling through the full result.

Example 6: Refreshing policy before running gpresult

If you want to verify the effect of a policy change you just made, force a refresh first so gpresult reflects the latest state rather than the previous cycle.

The difference between gpresult, RSoP, and Get-GPResultantSetOfPolicy

What is RSoP?

RSoP is the Group Policy framework that computes and records the final set of policy settings applied to a user or computer after all inheritance, precedence, filtering, and enforcement rules have been evaluated. Every time Group Policy is processed on a Windows machine, the RSoP provider logs the outcome in WMI. The gpresult command queries that WMI log and presents the data in a readable format.

Get-GPResultantSetOfPolicy

Windows PowerShell includes the Get-GPResultantSetOfPolicy cmdlet, which produces the same RSoP data as gpresult /h or gpresult /x but in PowerShell. It is particularly useful in automation and scripting contexts.

To generate the RSoP report using PowerShell:

Key use cases for the gpresult command

Here are some key use cases for the gpresult command:

• Verifying a newly deployed GPO: After linking a new GPO to an OU, gpresult /r confirms whether the policy has reached the target machine and appears in the Applied GPOs list.
• Troubleshooting a setting that isn't working: When a policy setting is configured in a GPO but not taking effect on a machine, gpresult /z shows every GPO that touched that setting and which is applied.
• Diagnosing a user who isn't receiving a software deployment or login script: The /r parameter shows the user-scoped GPOs applied during last logon, including whether the software installation or logon script policy is present, filtered, or absent entirely. The /v flag adds the script filename and the last time it executed.
• Conducting a compliance audit before a security review: Generating an HTML report with every policy setting in effect on a machine at a point in time can help demonstrate that password policies, account lockout settings, and security baselines are actively enforced.

How to generate a Group Policy results report using the GPMC

The Group Policy Management Console (GPMC) includes a built-in Group Policy Results Wizard that produces the same RSoP data as gpresult but in a graphical HTML report, with a Settings tab showing the final GPO for each individual policy setting and a Policy Events tab listing all related event log entries.

To generate the report:

1. Press Win + R, type gpmc.msc, and press Enter.
2. In the left console tree, expand your forest and domain, then right-click Group Policy Results and select Group Policy Results Wizard.
3. Click Next on the welcome screen.
4. On the Computer Selection screen:
   • Select This computer to run the report locally.
   • Select Another computer, type the computer name or click Browse to locate it, then click Next.
5. On the User Selection screen:
   • Select Current user to report on the currently logged-on user.
   • Select Select a specific user and choose from the list of users who have previously logged on to that computer.
   • Select Do not display user policy settings to generate a computer-specific report.
   • Click Next.
6. Review the Summary of Selections screen and click Next to run the query. The GPMC connects to the target machine, retrieves RSoP data via WMI, and generates the report.
7. Click Finish.

How to view Group Policy results using rsop.msc

rsop.msc is a built-in MMC snap-in that displays applied Group Policy settings in a graphical tree view, similar to the Local Group Policy Editor. It is the quickest way to get a visual overview of applied policies without generating a report file or using the command line.

However, rsop.msc does not show all Microsoft Group Policy settings, and it only displays settings that were applied through client-side extensions that support RSoP logging. For a complete picture, use gpresult /h or the Group Policy Results Wizard instead.

To view the RSoP:

1. Press Win + R, type rsop.msc, and press Enter.
2. If prompted by UAC, click Yes.
3. The RSoP snap-in opens and automatically runs a scan of the current user and computer policy.
4. The left pane displays a tree structure identical to the Group Policy Editor.
5. Expand any node to browse applied settings.
6. To see which GPO applied a specific setting, right-click it and select Properties. The Precedence tab lists every GPO that configured that setting, in order of precedence, with the winning GPO at the top.

To view the Group Policy results for a different user or computer, use the stand-alone wizard instead:

1. Press Win + R, type mmc, and press Enter.
2. Go to File > Add/Remove Snap-in.
3. Select Resultant Set of Policy from the list and click Add, then OK.
4. In the left pane, right-click Resultant Set of Policy and select Generate RSoP Data.
5. In the RSoP Wizard, select Logging mode and click Next.
6. Choose Another computer and enter the computer name, or select This computer and click Next.
7. Select Current user or Select a specific user from the list of users who have previously logged on and click Next.
8. Review the summary and click Next to generate the report, and then click Finish.

Troubleshooting tips

• Error: Access denied

  Cause: This error occurs when the gpresult command is run without administrative privileges. Without administrator privileges, Windows restricts the RSoP query to user-scoped policy data and blocks access to computer-scoped settings. This also occurs when saving an HTML report to a path the session has no write permission to or when a remote query uses an account that is not a local administrator on the target machine.

  To fix this error:

  • Run an elevated Command Prompt and execute gpresult /r again.
  • When saving HTML reports to restricted paths, specify a writable location.
    Copy gpresult /h C:\Users\Personal\gpreport.html.
  • For remote queries, ensure the account used with the /u parameter is a member of the local administrators group on the remote machine.
• Error: INFO: The user does not have RSOP data.

  Cause: Running gpresult from a non-elevated Command Prompt returns only user-scoped settings and Windows does not expose computer-scoped RSoP to standard sessions. A secondary cause is running the command with a different admin account than the logged-on user; in that case, gpresult queries the elevated account's context, not the standard user's, and returns the message.

  To fix this error:

  • Re-run the command from an elevated Command Prompt. Add /user DOMAIN\targetuser to query the correct user's policy context.
    Copy gpresult /r /user DOMAIN\john
  • If computer settings are still not fetched after elevation, the machine may not have reached a DC during the last refresh. Run gpupdate /force, then retry.
• Error: The expected GPO simply does not appear under the Applied GPOs list in gpresult /r output.

  Cause: The GPO may not be linked to the correct OU, is excluded by security filtering or a WMI filter, may have its link disabled, or is blocked by inheritance.

  To fix this error:

  • Run gpresult /z to reveal all GPOs evaluated including denied ones.
  • Check the GPO's Delegation tab in the GPMC to confirm the target user or computer has Read and Apply Group Policy permissions.
  • Verify if the GPO link is enabled and is linked to the correct OU.

FAQ