Wednesday, March 26, 2014

Allow computer policy RSOP data for limited users

What I commonly do is allow the limited users to see all RSOP data on GPRESULT or RSOP.MSC. By default this is not allowed so when you troubleshoot a workstation you can’t gather the needed data to single output but instead need to gather it twise: once with the logged on user and once with an admin account.

This is easy to change by changing this delegation in GPMC:


You just need to add this permission to the Authenticated Users group and your done!


  1. Another option would be just logging on with an admin account and run "gpresult /h:gpreport.html /user:NormalUser" it would produce both Computer and Normal User GP data.

    1. I agree - kind of... Yes, you can and it's not even a really big thing to do. I love doing everything "with least administrative effort" like in the Microsoft cert exams. There's also some GPP filtering that give false reports if you do the Computer side with different user account.

  2. This comment has been removed by a blog administrator.

  3. I read this article. I think You put a lot of effort to create this article.