Resultant Set of Policy: What it is and how to use it

What is RSoP?

Resultant Set of Policy (RSoP) is both a concept and a built-in Windows tool. As a concept, RSoP refers to the effective combination of all Group Policy settings that apply to a specific user or computer after Windows has processed every GPO in scope, factoring in inheritance, precedence, security filtering, WMI filtering, and block inheritance rules. As a tool, RSoP refers to the RSoP MMC snap-in, commonly launched with rsop.msc, which provides a graphical view of effective policy settings.

When multiple GPOs apply to the same machine or user, Windows does not simply stack all settings together. It applies them in a defined order (local > site > domain > OU) and lets higher-precedence GPOs overwrite lower ones. The RSoP is what remains after that entire resolution process: the final, effective value for each policy setting on that machine for that user. Understanding RSoP is the foundation of Group Policy troubleshooting, because the symptom an admin sees (a setting not applying, a user getting an unexpected configuration) is always a consequence of how Windows resolved the RSoP for that combination of user and computer.

RSoP modes: Logging and planning

RSoP operates in two modes that serve different purposes.

Logging mode reports the actual Group Policy settings currently applied to a live, active system. It shows the effective values for computer configuration and user configuration settings as they exist on the machine at the time of the query. Use logging mode to verify that a policy applied correctly, or to diagnose why a setting is not taking effect.

Planning mode simulates how Group Policy would apply under hypothetical conditions such as a user moving to a different OU, a computer joining a different security group, or a new GPO being linked to an existing container. It does not read from the local machine; it runs a what-if query against the domain. Use planning mode before making changes to confirm the expected outcome without affecting a live system.

Both modes are accessible through the RSoP snap-in and through the Group Policy Management Console (GPMC). The GPMC features include Group Policy Results for logging mode and Group Policy Modeling for planning mode. These GPMC implementations are more capable than the rsop.msc snap-in and are what most administrators use in enterprise environments.

How to run RSoP

Method 1: rsop.msc (quick graphical view)

rsop.msc opens the RSoP snap-in and shows the effective computer and user policy settings for the queried scope. It is a convenient way to get a graphical view of applied policy settings.

1. Press Win + R, type rsop.msc, and press Enter.
2. RSoP processes the available policy data and opens a tree view organized similarly to the Group Policy Management Editor: Computer Configuration on one side, User Configuration on the other.
3. Navigate to the policy area you want to check. Each setting shows its effective value.

Important limitations of rsop.msc

• The rsop.msc shortcut is commonly used for a quick local view, but the RSoP snap-in can also be run through MMC for other logging scenarios.
• It can indicate the source GPO for settings, but it is not the most complete troubleshooting view on modern Windows versions.
• Starting with Windows Vista SP1, RSoP reports do not show all Microsoft Group Policy settings. For a fuller view, use gpresult.
• It does not show as much troubleshooting detail as gpresult or the GPMC Results Wizard.

Method 2: gpresult (local and remote, command line)

gpresult is the command-line tool for querying RSoP data. It provides more troubleshooting detail than rsop.msc, including which GPOs were applied, which were filtered, and the reason for each filter, while also supporting remote machine queries.

Summary view (applied GPOs and filter reasons):

Full HTML report:

Open the HTML file in a browser. The report provides a fuller view of applied Group Policy settings and is generally more useful than rsop.msc for troubleshooting on current Windows versions.

Query a remote machine:

Query a specific user on the local machine:

Query a remote machine for a specific user:

Some gpresult scenarios require elevation or administrative rights, especially for computer-scope or remote queries. For remote RSoP reporting, the target machine must also allow the required inbound firewall traffic.

Method 3: Group Policy Results Wizard in GPMC (recommended for enterprise troubleshooting)

The Group Policy Results Wizard is the logging mode implementation inside GPMC. It provides RSoP data in a graphical interface and adds a Policy Events tab that surfaces Group Policy event log entries from the target machine alongside the results.

1. Open GPMC by pressing Win + R and typing gpmc.msc.
2. Expand the forest and domain tree, right-click Group Policy Results, and select Group Policy Results Wizard.
3. Click Next, select the target computer (This computer or Another computer by name), and click Next.
4. Select the target user and click Next.
5. Review the summary and click Next to run the query, then Finish.

The report opens with three tabs:

• Summary: Lists applied GPOs, denied GPOs along with why they were denied, and component processing status.
• Settings: Shows effective settings and related policy information.
• Policy Events: Group Policy event log entries from the target machine, correlated to the same session.

The Details tab is usually the most useful starting point when you need to determine which policy setting won and why.

Method 4: Group Policy Modeling Wizard in GPMC (planning mode)

The Group Policy Modeling Wizard simulates RSoP for a hypothetical user, computer, or OU combination without touching the live system. Use it before making changes to validate the expected result.

1. In GPMC, right-click Group Policy Modeling and select Group Policy Modeling Wizard.
2. Choose the domain controller to run the simulation on.
3. Specify the simulated user and computer, security group membership, WMI filter conditions, and target OU.
4. Run the simulation and review the report.

The output mirrors the Group Policy Results report structure but is based entirely on the hypothetical conditions you specified. It is the correct tool for capacity planning, OU restructuring, and pre-deployment validation of new GPOs.

RSoP vs. gpresult: Which to use

The two tools answer different questions.

In practice, gpresult /r, gpresult /h, or the GPMC Results Wizard is where most troubleshooting starts. rsop.msc is still useful for a quick graphical check, but it is not the most complete troubleshooting option on modern Windows versions.

Common RSoP troubleshooting scenarios

1. A setting is not applying and you need to find out why

Run gpresult /r on the affected machine. Look at two sections: Applied Group Policy Objects (the GPOs that processed successfully) and The following GPOs were not applied because they were filtered out (the GPOs that were excluded and why). If the GPO you expect is in the filtered list, the reason tells you where to look: denied permission, WMI filter mismatch, empty GPO, or disabled link.

2. The setting is applying but with the wrong value

A competing GPO has a higher-precedence setting. Run gpresult /h report.html and open the HTML report. Find the setting in the report and check which GPO applied it. The named GPO is overriding yours. To fix this, either adjust the link order, use the Enforced option on your GPO, or edit the winning GPO.

3. RSoP shows a setting but the application is not respecting it

rsop.msc and gpresult confirm that Group Policy is applying the setting at the Windows policy layer. If the application is not respecting it, the issue is in the application and not in Group Policy. Confirm the application reads from the registry path that the GPO writes to, and check whether the application has its own setting that overrides the Windows policy.

4. gpresult returns not enough privileges

You may be running the command without the rights needed for that query. Retry from an elevated Command Prompt if you are querying computer-scope or remote data. For computer configuration settings, you typically need local administrator rights. For remote queries, the account you are running from must have remote access and the necessary permissions on the target machine.

5. rsop.msc shows no data or errors out

This can happen on machines where the Group Policy service is not running, or where WMI is broken. Check the Group Policy service status:

If it is stopped, start it and run:

For WMI issues, run:

If it returns inconsistent, repair the WMI repository with:

Simplify GPO visibility and reporting with ADManager Plus

RSoP and gpresult tell you what is applied to a single machine. In larger environments, confirming that GPOs are configured consistently, linked correctly, and producing the expected results across all machines requires a different approach. ManageEngine ADManager Plus provides centralized GPO reporting and management without requiring GPMC access on individual domain controllers.

• GPO reporting: Run GPO reports to confirm settings are configured correctly across all GPOs in the domain in a single view, the domain-wide equivalent of running gpresult on every machine individually.
• RSoP reporting: Verify that a policy actually applied to a specific user or computer after deployment, without running the Group Policy Results Wizard for each target individually.
• Link order management: Adjust GPO precedence from the web console when RSoP analysis reveals a competing policy is winning over the intended one.
• On-demand policy refresh: Push an immediate GPO refresh to selected computers after making changes, and verify results without logging in to each machine.
• Delegation oversight: Assign GPO reporting and refresh tasks to help desk technicians through role-based access, so staff can investigate and resolve GPO application issues without needing domain admin rights or RSAT installed.

FAQ

1. What is RSoP?

RSoP stands for Resultant Set of Policy. It refers to the effective combination of all Group Policy settings that apply to a specific user or computer after Windows processes every GPO in scope, accounting for inheritance, precedence, and filtering. The RSoP snap-in, commonly launched with rsop.msc, generates a graphical view of those effective settings.

2. What is the difference between RSoP and gpresult?

Both report effective Group Policy settings, but gpresult generally provides a more complete troubleshooting view. rsop.msc offers a graphical policy view, while gpresult shows applied GPOs, filtered GPOs, and additional reporting detail. For troubleshooting on current Windows versions, gpresult is usually more useful.

3. How do I generate an RSoP report?

Run rsop.msc from the Run dialog box for a quick graphical view. For a fuller report, run gpresult /h C:\rsop_report.html and open the HTML file in a browser. For remote machines, add /s RemoteComputerName to the gpresult command.