GPO reports

In the ARM web client, you can run reports about the Group Policy Objects (GPOs) in your scanned Active Directory domains and export them to Microsoft Excel or PDF.

To run GPO reports, your ARM user needs read access to the web client. Some reports also read Active Directory or SYSVOL directly and require configured scan credentials for the domain. See Group Policy Objects (GPOs) in the web client.

Run a GPO report

1. Log in to the ARM web client.

2. Click Analyze > GPO Reports.

3. Select the report and the domain, and enter the report options. See the descriptions of the reports below.

4. Click Run Report.

5. (Optional) To export the report, click Export Excel or Export PDF.

GPO

The GPO report lists the GPOs of a domain from the latest scan. Select one of the following report types:

• All GPOs: all scanned GPOs.
• Disabled GPOs: GPOs in which both the user settings and the computer settings are disabled.
• Linked GPOs: GPOs that are linked to at least one OU or domain.
• Orphaned GPOs: GPOs that are not linked, are empty, or are fully disabled.

The report includes information such as display name, status, created and modified time, link path, link order, whether the link is enabled or enforced, block inheritance, security filtering, WMI filter, and whether user and computer settings are configured.

Effective Policies

The Effective Policies report shows which GPOs apply to the selected OUs. Select the domain and one or more OUs.

The report evaluates the GPO links in LSDOU order (local, site, domain, OU) and shows the linked GPOs, their precedence, whether each link is enabled or enforced, and whether inheritance is blocked. The summary shows the total number of policies, blocked policies, and enforced policies.

This report reads link data from Active Directory and requires configured scan credentials for the domain.

Policy Conflicts

The Policy Conflicts report shows registry-based policy settings that two or more GPOs set to different values. A conflict is identified by the scope, the registry key path, and the registry value name.

For each conflict, the report shows the GPOs, the configured values, the registry value type, and which GPO wins. The summary shows the number of GPOs and settings analyzed and the number of conflicts found.

This report reads the Registry.pol files from SYSVOL using the configured scan credentials for the domain. The credentials must have read access to SYSVOL.

Health Summary

The Health Summary report highlights GPOs that may need review, for example GPOs that are disabled, orphaned, empty, missing security filtering, or stale (when the ModifiedTime is older than six months). Each issue has a severity.

The summary shows the total number of GPOs, healthy GPOs, and GPOs with issues, and the number of critical, warning, and informational issues.

Permissions

The Permissions report shows who has permissions on the GPOs of a domain. For each permission entry, the report shows the GPO, the trustee, the trustee SID, the permission level, the access type, and whether the permission is inherited. The summary shows the total number of GPOs and permission entries.