How to Use the gpresult Command in Windows 11 to Generate Group Policy Diagnostic Reports

In enterprise corporate domains and local administrative environments, Group Policy Objects (GPOs) govern workstation security configurations, firewall rules, software restrictions, and user rights assignments. However, when security policies conflict, fail to apply, or get blocked by security filtering, troubleshooting through the graphical interface can be complex. Windows 11 includes gpresult.exe, a command-line tool that calculates the Resultant Set of Policy (RSoP). It provides conclusive auditing of which policies actually win precedence and apply to a specific user or computer.

Running Command Prompt with Elevated Permissions

While standard users can evaluate policy settings applied to their own profile, generating comprehensive computer-level reports requires elevated administrative privileges:

1. Press Win + R, type cmd, and press Ctrl + Shift + Enter (or right-click Windows Terminal and select Run as Administrator).
2. Confirm the User Account Control (UAC) prompt to open an administrative console.

Quick Console Summary with gpresult /r

The most common and immediate diagnostic command is gpresult /r. It displays a structured terminal summary divided into computer and user scopes:

gpresult /r

Key sections to examine in the command output:

• Applied Group Policy Objects: Lists GPOs that were successfully processed and enforced on the machine.
• The following GPOs were not applied because they were filtered out: Highlights policies that failed to apply due to WMI filters, access control permissions, or empty links.
• Security Groups: Displays the Active Directory and local security group memberships evaluated during token creation.

To inspect only the Computer policy scope or only the User policy scope, append the /scope parameter:

gpresult /r /scope:computer
gpresult /r /scope:user

Exporting Detailed HTML Diagnostic Reports

While the console view provides quick validation, complex troubleshooting requires examining individual registry values, script paths, and Administrative Template settings. The /h parameter exports an interactive HTML diagnostic report:

gpresult /h C:\Reports\GPO_Audit_Report.html

Once generated, open the HTML document in Microsoft Edge or Google Chrome. The interactive report provides expandable sections showing:

• Processing times for each Client-Side Extension (CSE) in milliseconds.
• Fast Boot and network detection status during startup policy application.
• The winning GPO for every conflicting policy setting.
• Detailed error codes and explanations for failing policy extensions.

Generating Verbose Plain Text Output

For headless automated scripting, pipeline integration, or remote log parsing, export verbose output directly to a plain text file using the /v and redirection switches:

gpresult /v > C:\Reports\gpresult_verbose.txt

The verbose dump details specific security permissions, Kerberos tickets, and organizational unit (OU) path hierarchies.

Targeting Remote Workstations Across the Network

Systems administrators can query remote Windows 11 machines across the domain without establishing an interactive Remote Desktop session by specifying the /s switch:

gpresult /s WIN11-WORKSTATION-05 /h \\FileServer\Audit\Client05.html

Ensure that remote management firewall rules (WMI and RPC ports) are enabled on the target machine.

Command Switch Reference Table

Parameter	Operational Function
/r	Displays standard RSoP summary data directly in the terminal.
/v	Produces verbose output detailing individual policy settings.
/h [Path.html]	Generates an interactive, styled HTML audit report.
/scope:computer	Restricts evaluation exclusively to machine-level policies.
/scope:user	Restricts evaluation exclusively to user-level policies.
/s [ComputerName]	Targets a remote network workstation for RSoP analysis.
/f	Forces overwriting of existing target report files.