Can I check what policies are being applied to a particular security group in ADUC?

Question

I've been given the task to clean up ADUC/Group Policy.

Quite daunting due to the perplexing manner it was all put together. It appears to have been put together with a "try this, didn't work, don't worry about deleting it, just try this, rinse/repeat" method.

Moving on. I've got users organized the way I'd like it. But before I start removing/adding objects to the security groups I'd like to see what policies they are inheriting. I'm doing this with hope there is justification for some of this crud I'm seeing.

In other words: How can I tell what policies are being applied to a particular security group?

Solution 1

What you want is the GPMC - the Group Policy Management Console. It allows you to run reports on users & computers to see what the "RSOP" or Resultant Set of Policies is.

Solution 2

Policies are not applied to security groups (they're for security settings, not policies); Policies are applied via group/OU membership.

If you edit a specific policy, then in the Group Policy Object Editor you can right-click the Policy name and choose Properties. Then in the Links tab you can use the 'find now' button to determine which policy group(s)/OU(s) the policy applies to.

Get yourself the Group Policy Management Console from MS if you don't have it already. It will make it much more obvious as to what policies apply to which groups.

Also you can use RSOP.MSC on a workstation to determine how the policies are affecting that workstation/user.

Hope that helps...

Comments

[I say Reinstate Monica]

Welcome to superuser! It's not clear if you're offering an answer here to the OPs question. If so, could you clarify how he might solve his dilemma? If not, your answer will likely be removed as being a non-answer.