> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/gpo-audit/rsop-comparison.md).

# RSoP Comparison

Generally, multiple Group Policy Objects apply the same settings with different values.

It can be difficult to determine the final value of policy settings by analyzing link order, precedence, inheritance, and other factors.

The RSoP comparison feature helps users identify the ultimately applied settings by analyzing the Resultant Set of Policies (RSoP) based on link order, precedence, inheritance, and more.

Finally, users can compare and analyze their resultant set of policies against the baselines.

The RSoP Comparison page (**Computers & Users List**) lists the computers and users of the selected scan on two tabs, `Computers` and `Users`, together with the number of their resultant settings that do not comply with the selected baseline.

**Baseline**: The selector in the upper-right corner chooses the baseline that the resultant settings are compared against. Baselines are listed as `<Type> - <Name> (<Version>)`, and the first baseline is selected by default. The same selection is used on the RSoP detail pages.

The widgets in the upper-right side of each table allow users to;

* **Search**: Search the table.
* **Export**: Export the table as a CSV file.
* **Columns**: Choose the columns shown in the table.

## **RSoP on Computers**

The `Computers` table shows the `Name`, `OS`, `IP Address`, `Privileged`, `Admin` and `Uncompatible` information about each computer.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-92571d0f8e873380d3338a9483a4711f0c4a06d0%2Fgpo-audit-rsop-computers.png?alt=media" alt="Computers tab of the RSoP Comparison list"><figcaption><p>RSoP on Computers</p></figcaption></figure>

**Uncompatible**: The UI label for *incompatible* settings: the number of settings in the computer's resultant set of policy whose value does not comply with the selected baseline. (See [Glossary ](/forestall/introduction/glossary/glossary.md)for definitions of the other columns.)

{% hint style="info" %}
Each name redirects to the RSoP detail page for the respective entity.
{% endhint %}

## RSoP on Users

The `Users` table shows the `Name`, `Enabled`, `Locked`, `Service User`, `Privileged`, `Admin` and `Uncompatible` information about each user.

![Users tab of the RSoP Comparison list](https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-03dcd67c85481ec3ed7f6d620f22a5c1d3b2f39f%2Fgpo-audit-rsop-users.png?alt=media)

**Uncompatible**: The number of settings in the user's resultant set of policy whose value does not comply with the selected baseline. (See [Glossary ](/forestall/introduction/glossary/glossary.md)for definitions of the other columns.)

{% hint style="info" %}
If no Group Policy Object in the scan has readable policy settings, both tables are empty.
{% endhint %}

## **RSoP Details**

The detail page is titled with the name of the computer or user and its type (`Computer` or `User`). It lists the settings in the entity's resultant set of policy together with the settings referenced by the selected baseline, and marks each one as compatible or incompatible.

The **Baseline** selector at the top of the page changes the baseline used for the comparison.

The **Results** badges next to it show the number of settings in each category. Clicking a badge filters the table:

|            Badge            |    Color   | Shows                                                                      |
| :-------------------------: | :--------: | -------------------------------------------------------------------------- |
|       **Uncompatible**      |     Red    | Settings whose applied value does not comply with the baseline.            |
|        **Compatible**       |    Green   | Settings whose applied value complies with the baseline.                   |
| **Resultant Set of Policy** | Light blue | Settings that are actually applied to the entity by a Group Policy Object. |
|           **All**           |    Blue    | All settings (this badge has no count).                                    |

The category names are shown as tooltips when hovering over the badges.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2Fgit-blob-2de7a87906abf39d3d87e5945dd94ef3f5e12fa8%2Fgpo-audit-rsop-details.png?alt=media" alt="RSoP details of DC01 filtered to Uncompatible settings"><figcaption><p>RSoP of Computer Object</p></figcaption></figure>

**Status**: Comparison result for the setting: `Uncompatible`, `Compatible`, or `Resultant Policy` for a setting that is applied by a GPO but is not part of the baseline.

**Type**: Type of the setting.

**Policy Group or Registry Key**: Group policy configuration path of the setting.

**Setting**: Name of the setting. Clicking it opens a window with the description of the setting and, where available, its **Info**, **Solution** and **Reference** sections.

**GPO Value**: Value of the setting configured by the GPO.

**Mandatory Value**: Value of the setting defined by the baseline.

**Winning GPO**: The GPO whose value is applied to the entity after link order, precedence and inheritance are resolved. The name links to the GPO.