How to properly export live settings in GPO applied to a machine

[egoitzr]

Hi,

 

I needed to get which of the following settings, and with which values, are applied live on a server. The needed settings are :

 

SeInteractiveLogonRight

SeRemoteInteractiveLogonRight

SeDenyInteractiveLogonright

SeDenyRemoteInteractiveLogonRight

 

It seems I'm achieving it by doing :

 

Secedit /Export /Areas User_Rights /cfgSecedit /Export /Areas User_Rights /cfg c:\undirectorio\gpo.txt

 

Later by checking the file I achieve my goal.

 

I normally check too this other command file generated :

 

Secedit /Export /Areas SECURITYPOLICY /cfg Secedit /Export /Areas SECURITYPOLICY /cfg c:\undirectorio\gpo.txt

 

They seem to give me what I need even when for instance "SeDenyInteractiveLogonright" is set in the local gpo and set too in a gpo applied to the OU where the server belongs. The behavior is the expected one. I get in the secedit output the value set in active directory GPO in the OU.

So, my question basically is... is this way the correct one of achieving my goal of getting dump in a plain text file the live settings of the policy applied to the virtual machine?. I can have only a local gpo or could have a local gpo (with default values or not) and later n number of gpo applied at different levels in active directory (site, domain, ou... etc...). So the real question is, my secedit command should give me what I'm trying to get and then to have live seetings in the machine (after all gpo at differrent levels are applied) ?.

 

I have seen too that there is a flag /mergedpolicy but it seems to just output then those values that I have applied at local policy and too at active directory policy?. Am I wrong?.

 

Best regards

Thank you so much,

[itskdog]

I normally use:

 

GPRESULT /H gpresult.html 

 

and open the file to see what policies are applied to that system. Can also be done remotely from GPMC, but we've moved to Intune now so I can't recall the exact naming of it any more.

[psydii]

I had a big draft (which I managed to  lose) where I'd dug into this via Win2k and 2k8 ResKit docs,  and the old Windows 2000 Server help files, cross referencing the (slightly) updated info on the  learn.microsoft.com site.

 

Short short version: gpresult cannot do what is being asked here. what is being asked is how to compare the actual settings of the computer against what policy is saying they should be.  One of the challenges is that with security policy "unsetting" a setting does not revert it to its previous state, so policy might say "unset" but what is actually applying is what was set previously.

 

This is quite possible with in-box gui tools. But it is somewhat unclear whether this is  possible to achieve with the command-line tools.

[KK20]

gpresult will give you the same answers as the GPO management ->  Group Policy Results  page.  AFAIK (cannot find the source) both read the registry for policies that applied or had an error.  Neither actually check the resultant registry settings themselves.  So if a policy is applied then both reports will say "yes, I have applied this policy" whatever the policy is.  The same as GPO modelling, this will show what policies should apply but as Psydii says, having a GPO with "Not configured" will not necessarily reverse a previous enabled/disabled/setting.  One example that springs to mind for me is application control policies and the older software restriction policies - these can easily leave stale/unintended settings.

 

Modelling is nice as it should show what will take priority - if at all.  Results should show you which policies did apply (or not), but then If you must know an actual value "now" then the only way I know is a script running to export the values from the registry.