Group Policy troubleshooting: gpresult, logs, RSoP and filtering

Start DC01, DC02 and CL01. On CL01, sign in as SAATLAB\priya.sharma for user checks, and use PowerShell as administrator (adm.rahul) for computer checks.

1Read gpresult like a pro

On CL01, as priya.sharma (normal PowerShell):

gpresult /r /scope:user

You’ll see something like this (cut down):

USER SETTINGS
--------------
    CN=Priya Sharma,OU=Finance,OU=Staff,OU=SAATLAB,DC=saatlab,DC=internal
    Last time Group Policy was applied: 19/10/2026 at 15:40:12
    Group Policy was applied from:      DC01.saatlab.internal
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        SAATLAB

    Applied Group Policy Objects
    -----------------------------
        U-Finance-Printer
        U-Staff-Desktop

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

Read it top down: which DC served the policy, when, which GPOs applied, and which were filtered and why. “Not Applied (Empty)” means the GPO has no settings for this side. “Denied (Security)” and “Denied (WMI Filter)” are the two you’ll chase most.

✅ Checkpoint: gpresult shows the DC used, the applied GPOs and a reason for each filtered GPO.

2Follow one refresh in the operational log

On CL01, as administrator, refresh computer policy and read the newest events:

gpupdate /target:computer /force
Get-WinEvent -LogName Microsoft-Windows-GroupPolicy/Operational -MaxEvents 12 |
    Sort-Object TimeCreated |
    Select-Object Id, @{ n = 'Message'; e = { ($_.Message -split "\r?\n")[0] } } | Format-Table -Wrap

You’ll see something like this:

  Id Message
  -- -------
4004 Starting manual processing of policy for computer SAATLAB\CL01$.
5017 The system call to get account information completed.
5326 Group Policy successfully discovered the Domain Controller in 15 milliseconds.
5312 List of applicable Group Policy objects:
5313 The following Group Policy objects were not applicable because they were filtered out :
4016 Starting Registry Extension Processing.
5016 Completed Registry Extension Processing in 47 milliseconds.
4016 Starting Security Extension Processing.
5016 Completed Security Extension Processing in 312 milliseconds.
8004 Completed manual processing of policy for computer SAATLAB\CL01$ in 2 seconds.

This is the full story of one refresh: DC found, GPO list built, each extension run with its time, then done. A slow extension shows a large time in its 5016 event; a failed one logs an error (7016 or similar) with a code.

✅ Checkpoint: You see the start, the applicable list, each extension and the completion events for one refresh.

3Create an RSoP report

On CL01, as administrator, report what priya.sharma gets on CL01:

Get-GPResultantSetOfPolicy -Computer CL01 -User SAATLAB\priya.sharma -ReportType Html -Path C:\Lab\rsop-priya.html
Start-Process C:\Lab\rsop-priya.html

You’ll see something like this:

RsopMode        : Logging
Namespace       : \\CL01\Root\Rsop\NS2A7C1F07_63D4_4F1B_8A6B_6E04B2B9C3D1
LoggingComputer : CL01
LoggingUser     : SAATLAB\priya.sharma
LoggingMode     : UserAndComputer

In the report, open Settings. Every setting has a Winning GPO column, which answers “which GPO set this?” without guessing. [Add your screenshot here]

✅ Checkpoint: rsop-priya.html opens and shows the winning GPO for each setting.

4Check link order and precedence

On DC01:

(Get-GPInheritance -Target 'OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal').InheritedGpoLinks |
    Select-Object Order, DisplayName, Enforced, Target

You’ll see something like this:

Order DisplayName            Enforced Target
----- -----------            -------- ------
    1 C-Workstation-Security False    OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal
    2 C-LAPS                 False    OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal
    3 C-Cert-Autoenroll      False    OU=Workstations,OU=SAATLAB,DC=saatlab,DC=internal
    4 Default Domain Policy  False    dc=saatlab,dc=internal

The list is in precedence order: Order 1 wins if two GPOs set the same thing. GPOs linked closer to the object (the OU) beat GPOs linked higher up (the domain), unless a higher link is Enforced.

✅ Checkpoint: You can say which GPO wins on CL01 for a conflicting setting.

5Compare GPO versions on both DCs

On DC01:

foreach ($dc in 'DC01', 'DC02') {
    $g = Get-GPO -Name U-Staff-Desktop -Server $dc
    [pscustomobject]@{
        DC          = $dc
        UserAD      = $g.User.DSVersion
        UserSysvol  = $g.User.SysvolVersion
        Modified    = $g.ModificationTime
    }
}

You’ll see something like this:

DC   UserAD UserSysvol Modified
--   ------ ---------- --------
DC01      6          6 19/10/2026 11:02:14
DC02      6          6 19/10/2026 11:02:14

All four numbers match, so AD and SYSVOL agree on both DCs. If DC02 showed an older SYSVOL version, clients in the Branch site would get the old settings. Check DFS Replication for SYSVOL (Lesson 41) and AD replication (Lesson 45).

✅ Checkpoint: U-Staff-Desktop has the same AD and SYSVOL version on DC01 and DC02.