Forum Discussion

PG's avatar
PG
Copper Contributor
Nov 08, 2024

Gpresult /H and GPMC settings view do not match RSOP.

I am having an issue where I have a couple of GPO settings on a win 11 device not showing in a gpresult /h but they do show in an rsop. I have seen this in the past on a few occasions but never really gave it much thought and just assumed it was something lacking in gpresult as html. I have verified running gpresult /v on the system shows the missing settings and matching rsop so I am confident that the settings are being applied but I am not finding any other examples online of this situation. I also noticed that the settings do not display in the gpmc settings tab on the GPO with the settings but I have of course verified they exist in GPME after right clicking and editing the appropriate GPO. This post is to hopefully find some sort of Microsoft or community backing in my thought process that this is simply the html lacking compatibility to show some extended settings or I am completely open minded to a separate explanation of what is happening. Thanks in advance for any help!

  • PG's avatar
    PG
    Copper Contributor
    Nov 13, 2024

    Thank you for your response. I strongly believe this is the culprit but do you have any sources or ways I can confirm this "The HTML report generated by gpresult /h may not always include certain advanced or less common settings due to formatting or data presentation limitations. This could explain why gpresult /v and RSoP (which show raw output) display more complete data". Yes I have verified the admx files in sysvol and on multiple local machines match, I have even created the same gpo in my home lab(of course again utilizing the same latest admx templates) and seen the same settings/setting options fail to display in a gpresult html. I also check replication daily in both domains and it is not an issue.

  • kyazaferr's avatar
    kyazaferr
    Steel Contributor
    Nov 13, 2024

    HTML Formatting Limitation in gpresult /h

    The HTML report generated by gpresult /h may not always include certain advanced or less common settings due to formatting or data presentation limitations. This could explain why gpresult /v and RSoP (which show raw output) display more complete data:

    • gpresult /v outputs a verbose view that might include more details than what is formatted for HTML output.
    • RSoP pulls live policy data, showing a more detailed, granular view of applied settings.

    2. Settings Compatibility

    Certain settings, especially those from newer administrative templates or custom ADMX files, may not be fully compatible with the way GPMC or gpresult /h processes and displays them:

    • Check if the administrative templates used in your GPOs are up-to-date and compatible with Windows 11.
    • Ensure that the GPMC version on the management station matches or is newer than the version of the OS being managed.

    3. Verification of GPMC View

    The GPMC (Group Policy Management Console) Settings tab may not show certain settings due to:

    • Legacy templates or custom ADMX settings: Settings that don't follow standard reporting formats might not appear in GPMC.
    • Replication delays or issues within the Active Directory domain that may cause discrepancies in what is shown in the GPMC.

    4. Policy Reporting and Resultant Set Differences

    gpresult and RSoP can sometimes show discrepancies because they gather data differently:

    • gpresult directly queries the WMI policy provider, while RSoP compiles results from WMI and the local client.
    • Security filtering and WMI filters in your GPOs could lead to some settings being applied but not fully displayed across all tools.

    5. GPO Settings Not Displayed in GPMC

    If the GPO settings do not appear in the GPMC Settings tab but are visible when editing in GPME (Group Policy Management Editor), consider:

    • ADMX file updates: Ensure that the domain's central store contains the latest ADMX files.
    • GPO corruption: Run GPOTool or other tools to check for inconsistencies or corruption in the GPO.

    6. Steps to Troubleshoot Further

    • Recreate the GPO: Create a new GPO with the same settings to see if it resolves the issue.
    • Check for replication issues: Use repadmin /replsummary to confirm if there are any domain controller replication problems.
    • Update GPMC: Ensure that the Group Policy Management Console you are using is the latest version available for Windows 11.
    • Compare with other devices: Test gpresult /h and RSoP on other Windows 11 devices to determine if it is a widespread issue or device-specific.

Resources