Troubleshooting Group Policy application: gpresult, gpupdate, and the GroupPolicy module

Goal

Determine which Group Policy Objects (GPOs) actually applied to a given computer or user, force a re-evaluation, and protect an existing GPO with a backup before editing it.

Prerequisites

An elevated prompt (local administrator) on the target for computer-scope gpresult data and for any remote RSoP query — without elevation gpresult shows only user settings; the GroupPolicy PowerShell module (RSAT) for Get-GPO/Backup-GPO/Get-GPResultantSetOfPolicy; GPO edit rights for backup and restore.

Steps

1. Generate a readable HTML report of the Resultant Set of Policy (RSoP) for the current user and computer: gpresult /h report.html /f; /f forces overwrite of an existing file so the call does not prompt in an unattended run. Use /r instead for a quick text summary of applied GPOs to standard output.
2. For a remote target: gpresult /s SRV1 /user CONTOSO\jdoe /h report.html (user data exists only if that user has signed in on SRV1).
3. From PowerShell, the GroupPolicy module's equivalent is Get-GPResultantSetOfPolicy -Computer SRV1 -ReportType Html -Path C:\Temp\rsop.html (or -User for a user-scoped report), which an agent can call without shelling out; give -Path as a full path.
4. List every GPO in the domain (linked or not) and inspect one: Get-GPO -All | Select-Object DisplayName, GpoStatus, ModificationTime then Get-GPO -Name "Default Domain Policy".
5. Before editing a GPO, back it up: Backup-GPO -Name "Baseline Workstation Policy" -Path C:\GPOBackups (the folder must already exist). This captures the GPO's settings and security filtering and can be restored with Restore-GPO -Name "Baseline Workstation Policy" -Path C:\GPOBackups if the edit needs to be undone; links to OUs/sites are not part of the backup and are not restored.
6. After changing a GPO or its links, force the target to reprocess without waiting for the refresh interval: gpupdate /force (add /logoff or /boot only if the specific settings require a logoff or restart to apply, such as software installation via GPO). Without those switches gpupdate can stop at a Y/N prompt asking to log off or restart; in an unattended run answer it explicitly (echo n | gpupdate /force).

Expected result

report.html/rsop.html lists the GPOs that won and lost, with the reason (security filtering, WMI filter, denied permission) for each; after gpupdate /force, a new RSoP report reflects the intended settings.

Limits and test basis

gpresult and gpupdate are documented Windows commands; the GroupPolicy module's Get-GPResultantSetOfPolicy and Backup-GPO/Get-GPO are documented cmdlets. Client-side processing details (which client-side extension applied which setting) are recorded in the Group Policy operational event log, not in the RSoP report alone — check Microsoft-Windows-GroupPolicy/Operational for that level of detail. gpupdate forces reprocessing but does not itself guarantee network connectivity to a domain controller; a client that cannot reach one reports a processing error and keeps applying its last cached settings. No reboot is required unless a specific policy area demands it.