RSoP Comparison

Generally, multiple Group Policy Objects apply the same settings with different values.

It can be difficult to determine the final value of policy settings by analyzing link order, precedence, inheritance, and other factors.

The RSoP comparison feature helps users identify the ultimately applied settings by analyzing the Resultant Set of Policies (RSoP) based on link order, precedence, inheritance, and more.

Finally, users can compare and analyze their resultant set of policies against the baselines.

The RSoP Comparison page (Computers & Users List) lists the computers and users of the selected scan on two tabs, Computers and Users, together with the number of their resultant settings that do not comply with the selected baseline.

Baseline: The selector in the upper-right corner chooses the baseline that the resultant settings are compared against. Baselines are listed as <Type> - <Name> (<Version>), and the first baseline is selected by default. The same selection is used on the RSoP detail pages.

The widgets in the upper-right side of each table allow users to;

• Search: Search the table.

• Export: Export the table as a CSV file.

• Columns: Choose the columns shown in the table.

RSoP on Computers

The Computers table shows the Name, OS, IP Address, Privileged, Admin and Uncompatible information about each computer.

RSoP on Computers

Uncompatible: The UI label for incompatible settings: the number of settings in the computer's resultant set of policy whose value does not comply with the selected baseline. (See Glossary for definitions of the other columns.)

Each name redirects to the RSoP detail page for the respective entity.

RSoP on Users

The Users table shows the Name, Enabled, Locked, Service User, Privileged, Admin and Uncompatible information about each user.

Users tab of the RSoP Comparison list

Uncompatible: The number of settings in the user's resultant set of policy whose value does not comply with the selected baseline. (See Glossary for definitions of the other columns.)

If no Group Policy Object in the scan has readable policy settings, both tables are empty.

RSoP Details

The detail page is titled with the name of the computer or user and its type (Computer or User). It lists the settings in the entity's resultant set of policy together with the settings referenced by the selected baseline, and marks each one as compatible or incompatible.

The Baseline selector at the top of the page changes the baseline used for the comparison.

The Results badges next to it show the number of settings in each category. Clicking a badge filters the table:

Badge	Color	Shows
Uncompatible	Red	Settings whose applied value does not comply with the baseline.
Compatible	Green	Settings whose applied value complies with the baseline.
Resultant Set of Policy	Light blue	Settings that are actually applied to the entity by a Group Policy Object.
All	Blue	All settings (this badge has no count).

The category names are shown as tooltips when hovering over the badges.

RSoP of Computer Object

Status: Comparison result for the setting: Uncompatible, Compatible, or Resultant Policy for a setting that is applied by a GPO but is not part of the baseline.

Type: Type of the setting.

Policy Group or Registry Key: Group policy configuration path of the setting.

Setting: Name of the setting. Clicking it opens a window with the description of the setting and, where available, its Info, Solution and Reference sections.

GPO Value: Value of the setting configured by the GPO.

Mandatory Value: Value of the setting defined by the baseline.

Winning GPO: The GPO whose value is applied to the entity after link order, precedence and inheritance are resolved. The name links to the GPO.