• Generate RSoP data (on server side)
• Console : AD Users and Computers

3. rsop.msc (Resultant Set of Policy)

Another way to generate this Resultant Set of Policy that can be used from a console rather than HTML or text format, is to use "rsop.msc".

3.1. Required permissions

However, this requires that you have the required permissions to obtain this Resultant Set of Policy.
To launch it, type "rsop.msc" in the search bar or in the Windows start menu and launch the program of the same name.

If you are logged in with an account that doesn't have the required rights, it will not work and this warning will be displayed :

Plain Text

The RSoP snap-in was unable to generate the computer's data due to insufficient permissions. The snap-in will continue to start but only the user's data will be displayed.

Click : Close.

Wait a few seconds.

And the window will be almost empty.

3.2. Generate the Resultant Set of Policy using rsop.msc for a specific user

If you are not logged in as an administrator on the client computer, search the "rsop.msc" program, then click "Run as administrator".

A "User Account Control" (UAC) window appears telling you that you are trying to launch the "Microsoft Management Console" program (which is normal, because ".msc" files are managed via the "mmc.exe" console).
Provide the credentials of the domain administrator account or of a user who has the required permissions to generate a Resultant Set of Policy.

Since you started this program as administrator, "rsop.msc" thinks you are logged in with the "Administrator" account and therefore retrieves RSoP data for this user.
However, you can change this later.

As you can see, the Resultant Set of Policy is currently for our Domain Administrator account for the "WIN10" client computer.

The advantage of this console is to be able to navigate in the different folders to have a better view of the different policies applied.

For each policy applied, you will see :

• his name
• its state : enabled or disabled
• the GPO name where this policy has been set

Now, to generate the Resultant Set of Policy for another user (who has logged in at least once on this computer), go to the "Actions" menu and click : Change query.

Note : to have the "Action -> Change query" option, you must first select the "Administrator on WIN10 - RSoP" root element.

By default, the report will be generated for this computer (so, the computer you are currently on).

Instead of selecting "Current User", select the specific user for whom you want to generate the Resultant Set of Policy (RSoP).
In our case : the "INFORMATIWEB\InformatiUser" user.

Click Next to retrieve the RSoP data.

Wait while the informations are loaded from one of your domain controllers.

Click Finish to view the results in the console.

Now, we have the Resultant Set of Policy for the desired user for the computer we are on.

And as before, you can easily see which policies have been applied for computer configuration and user configuration.

4. "Resultant Set of Policy" component from the mmc console

If you are a big fan of the mmc console, be aware that there is a "Resultant Set of Policy" component, the principle of use of which is almost the same as for "rsop.msc" shown above.
To begin, launch the "mmc" console as an administrator to have the required permissions to generate the Resultant Set of Policy.

Specify the credentials of an account authorized to generate Resultant Sets of Policy.

In the "File" menu, click : Add/Remove Snap-in.

Select the "Resultant Set of Policy" component, click the "Add" button, and then click OK.

The "Resultant Set of Policy" component appears, but an "Action required" warning appears : Select 'Generate RSoP Data ...' from the Action menu.

As requested, go to the "Action" menu and click on "Generate RSoP Data".

The Resultant Set of Policy Wizard appears.

Select "Logging mode" to get the policy set that was applied on this computer.

Leave the "This computer" option selected and click Next.

Select the specific user for whom you want to generate this Resultant Set of Policy.

A preview of the selections is displayed.
Click on Next.

If you have not started the "mmc" console as an administrator and/or you don't have the required rights to generate a Resultant Set of Policy, this warning will be displayed.

Otherwise, wait while the RSoP data loads.

Once the informations are obtained, click Finish.

As with "rsop.msc", you will be able to navigate in the various folders for the computer configuration and the user configuration.
Thus, know the applied policies, their states and to know from which GPO object they were obtained.