What Is RSoP? Resultant Set of Policy Explained

RSoP (Resultant Set of Policy) is a Windows feature that shows which Group Policy settings actually apply to a specific user or computer after all policies have been processed. Because several policies can be linked at different levels and can conflict, RSoP tells you the final result and which Group Policy Object (GPO) won. You can view it with rsop.msc, gpresult or the Group Policy Management Console (GPMC).

Key takeaways

• RSoP shows the effective settings after local, site, domain and OU policies are combined.
• Use rsop.msc for a quick local view and gpresult /h report.html for a detailed report.
• GPMC offers Group Policy Results for real data from a remote machine and Group Policy Modeling for what-if tests.
• Most policy conflicts come from precedence, inheritance, security filtering, WMI filters and loopback processing.
• Run gpupdate /force after a change, then check RSoP again.

What is Resultant Set of Policy?

Resultant Set of Policy is the combined, final set of Group Policy settings that apply to a user and a computer. In a domain, settings can come from the local policy and from GPOs linked to the site, the domain and organizational units (OUs). When they overlap, Windows resolves the conflict by precedence. RSoP reports the winning value and the GPO it came from, which is the key piece of information when a setting does not behave as expected.

How does Group Policy precedence work?

Group Policy is processed in the order local, site, domain, then OU, and the last policy applied wins unless a setting is enforced. This order is often written as LSDOU. The diagram shows how the layers combine into the effective settings that RSoP reports.

Several options change the result:

• Enforced: a GPO link marked Enforced overrides lower-level policies.
• Block Inheritance: an OU can stop higher-level GPOs from applying, except Enforced ones.
• Security filtering: a GPO only applies to the users and computers that have read and apply permissions.
• WMI filters: a GPO applies only if the WMI query returns true on that computer.
• Loopback processing: user settings can be taken from the computer location instead of the user location.

How do you run RSoP?

You can run RSoP with the rsop.msc snap-in, the gpresult command or the Group Policy Management Console. Pick the method that fits the task:

• rsop.msc: press Win+R, type rsop.msc and press Enter. It reads the policy applied to the local computer and the signed-in user. It is available on Windows Pro, Enterprise and Education editions.
• gpresult /r: run gpresult /r in a Command Prompt for a text summary of applied and denied GPOs. Add /scope computer or /scope user to narrow it.
• gpresult /h: run gpresult /h C:Tempgpreport.html for a full HTML report that lists every setting and its source GPO. Run it from an elevated prompt to include computer settings.
• GPMC Group Policy Results: in the Group Policy Management Console, use Group Policy Results Wizard to collect real data from a remote computer and user.
• GPMC Group Policy Modeling: use Group Policy Modeling to simulate what would apply if a user or computer moved to another OU or if you changed a policy.

Microsoft still ships rsop.msc, but gpresult and GPMC reports usually give more detail, so many administrators prefer them.

How do you troubleshoot Group Policy with RSoP?

To troubleshoot with RSoP, find the setting, see which GPO supplies it and then fix the reason it wins or fails to apply. Follow these steps:

1. Run the report. Generate a gpresult HTML report or a Group Policy Results report for the affected user and computer.
2. Find the setting. Search the report for the setting, and check the winning GPO column.
3. Check denied GPOs. Look at the list of GPOs that were not applied and read the reason, such as security filtering or a WMI filter.
4. Check scope and links. Confirm that the GPO is linked to the right OU and that the link is enabled.
5. Check precedence. Look for Enforced links, blocked inheritance and a higher-priority GPO that overrides your setting.
6. Refresh policy. Run gpupdate /force, sign out and in if needed, then generate the report again.
7. Check replication. If a change does not appear on some machines, verify Active Directory and SYSVOL replication between domain controllers.

Why is a Group Policy setting not applying?

A Group Policy setting usually does not apply because of security filtering, a failed WMI filter, a disabled link, inheritance blocking, replication delay or a slow network link. Check these first:

• The user or computer account lacks Read and Apply group policy permissions on the GPO.
• The computer or user is in a different OU than expected.
• A conflicting GPO with higher precedence sets another value.
• The setting is a user setting in a GPO linked only to computers, and loopback is not enabled.
• The computer has not refreshed policy yet. Refresh happens at startup, at logon and about every 90 minutes with a random offset.

Policy design is also a governance topic. See how policy documents work together in our guides to the clean desk policy, the IT strategy template, CYOD (choose your own device) and data retention policy, and learn how a virtual CISO can own policy reviews.

Frequently asked questions

What does RSoP stand for?

RSoP stands for Resultant Set of Policy. It is the final combination of Group Policy settings that apply to a user and a computer.

What is the difference between RSoP and gpresult?

RSoP usually refers to the Resultant Set of Policy snap-in, rsop.msc, which shows the result in a console. Gpresult is a command-line tool that reports the same kind of data as text or an HTML report and is easier to script and share.

Why does rsop.msc not open?

It is not available on Windows Home editions, and it may fail if you do not have the required rights. Use gpresult from an elevated prompt as an alternative.

How do I see which GPO applied a setting?

Open a gpresult HTML report or a Group Policy Results report and look for the setting. The report shows the winning GPO next to each setting.

How often does Group Policy refresh?

Policy refreshes at computer startup and user logon, and for domain members it refreshes in the background about every 90 minutes with a random offset. Run gpupdate /force to refresh right away.

Conclusion

RSoP answers the key Group Policy question: what is actually applied here, and why. Start with gpresult or Group Policy Results, read the winning GPO and the reasons for denied ones, fix precedence, filtering or links, then refresh policy and check again. A clear report saves hours of guessing in any Windows domain.