PowerShell GPO troubleshooting

Trace the effective policy for an affected user and computer instead of guessing from a GPO link.

Lesson 2 min read Windows PowerShell 5.1 and PowerShell 7

Written and tested by Dhrub Bharali · Updated 02 October 2026

Overview

Collect gpresult or a resultant-set report for the affected context. A GPO being linked does not prove a setting applied. Look for applied and denied GPOs, processing errors and the source of the effective setting.

Local, site, domain and OU processing provides a starting order. Link order, enforcement, inheritance, security filtering, WMI filtering and setting-specific behavior can change the result. Confirm the resulting setting rather than reducing every case to “the closest OU wins”.

User and computer settings follow different scopes. Loopback can change how user policy is selected on machines such as session hosts. Check its mode and the affected user/computer combination before editing links.

Get-GPResultantSetOfPolicy retrieves resultant-set information for a user or computer. Do not describe it as a hypothetical planning simulation. Refreshing policy also does not make every setting immediate; some require a new logon or restart.

Inspect this example’s structure

Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.

[pscustomobject]@{
  Applied = 'gpresult /h C:\Temp\gpo.html'
  Model = 'Get-GPResultantSetOfPolicy -User corp\\dhrub -Computer WS01 -ReportType Html -Path C:\Temp\rsop.html'
  Refresh = 'Invoke-GPUpdate -Computer WS01 -Force'
  Inventory = 'Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime'
} | Format-List

Stage 1[pscustomobject]@{Positional values or no named parameters
Stage 2Format-ListPositional values or no named parameters

An example to inspect

Preview the example. Sign in for the full lesson and activities.

[pscustomobject]@{
  Applied = 'gpresult /h C:\Temp\gpo.html'
  Model = 'Get-GPResultantSetOfPolicy -User corp\\dhrub -Computer WS01 -ReportType Html -Path C:\Temp\rsop.html'
  Refresh = 'Invoke-GPUpdate -Computer WS01 -Force'
  Inventory = 'Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime'
} | Format-List

What happens

The example lists reporting and refresh commands without running them. Read the report for the affected context, identify the failed or denied stage, and use a refresh only after deciding what it should change.

Worth remembering

Verify both the new processing result and the actual application or operating-system setting.

Primary documentation

Microsoft Learn: get-gpresultantsetofpolicy

Try it

Expected output · prints command text; does not execute these commands

1PS> [pscustomobject]@{

2PS> Applied = 'gpresult /h C:\Temp\gpo.html'

3PS> Model = 'Get-GPResultantSetOfPolicy -User corp\\dhrub -Computer WS01 -ReportType Html -Path C:\Temp\rsop.html'

4PS> Refresh = 'Invoke-GPUpdate -Computer WS01 -Force'

5PS> Inventory = 'Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime'

6PS> } | Format-List

Example reader

Inspect this page's example

Fictional browser data when supported

Run supported commands against the practice data, or inspect the example without executing it.

[pscustomobject]@{
  Applied = 'gpresult /h C:\Temp\gpo.html'
  Model = 'Get-GPResultantSetOfPolicy -User corp\\dhrub -Computer WS01 -ReportType Html -Path C:\Temp\rsop.html'
  Refresh = 'Invoke-GPUpdate -Computer WS01 -Force'
  Inventory = 'Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime'
} | Format-List

Ready to inspect.

Prints the four Group Policy diagnostic commands.

Show reference output

Expected output · prints command text; does not execute these commands

Applied   : gpresult /h C:\Temp\gpo.html
Model     : Get-GPResultantSetOfPolicy -User corp\\dhrub -Computer WS01 -ReportType Html -Path C:\Temp\rsop.html
Refresh   : Invoke-GPUpdate -Computer WS01 -Force
Inventory : Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime

Keep going

Next: AD Sync PowerShell commands for Microsoft Entra Connect

Check your understanding