GPO Comparison

The GPO Comparison feature allows users to compare and analyze the settings applied by Group Policy Objects in the Active Directory against both custom and official baselines prepared by Microsoft, CIS, STIG, and Forestall. These baselines are created by considering the security best practices.

Input fields are ;

GPO: List of the Group Policy Objects in the selected scan that have readable policy settings.

Baseline: List of the enabled baselines: custom baselines first, then the Forestall baselines, then the other predefined baselines. Each baseline is listed as <Type> - <Name> (<Version>). A disabled baseline (see Custom Baselines) is not offered.

After you select the GPO and the baseline, the page automatically compares the applied settings and displays the results.

GPO Baseline Comparison

Comparison Result

The colored badges under the Comparison Result label in the upper-right show the number of settings in each category. The category name appears as a tooltip when hovering over a badge.

Clicking on these badges allows you to filter the result table.

Colors of the badges are categorized as;

Color	Definition
	Uncompatible
	Not configured
	Baseline not defined
	Compatible
	All

Uncompatible: The setting configured by the GPO is not secure according to the baseline (the UI label for incompatible).

Not configured: The setting referenced by the baseline is not defined or not configured by the GPO.

Baseline not defined: The setting configured by the GPO is not included in the baseline.

Compatible: The setting configured by the GPO is secure according to the baseline.

All: All settings that are configured by the GPO or referenced by the baseline.

The widgets in the upper-right side of the table allow us to;

• Search: Search the comparison results across all table columns.

• Export: Export the comparison results and the respective information listed in this table as a CSV file.

The Results table contains information about the results of the Group Policy Object settings comparison,

GPO Baseline Comparison Result

Status: Comparison result for the GPO setting.

Type: Type of the setting.

Policy Group or Registry Key: Group policy configuration path of the setting.

Setting: Name of the settings.

GPO: Value of the setting configured by the GPO.

Baseline: Value of the setting defined by the baseline.

In addition, each setting name is a link. Clicking it opens a window with the description of the setting and, where available, its Info, Solution and Reference sections.

GPO Baseline Setting Definition

If the comparison returns no settings, the page shows Compare details not found! Check the selected GPO and baseline.