GPO Settings Comparison

[phawley77]

I was wondering if there was a way or tools to compare two sets of GPOs.

We have an update to one of our products that incorparates changes to around
20 GPOs and we have to apply this whole update in one hit. And we have one
environment that is a unique implementation of our solution, and has been
changed by the customer many times. I was wondering therefore if there is a
way to model offline, differences in two different GPO sets (the live and the
changes the update would make) both in settings and values for these settings
so that we can make the necessary changes to the standard GPO set. If there
are no MS tools around then suggestions for third party tools would be
appreciated.

Thanks,

Phil

[Darren Mar-Elia]

Nothing that is totally out of the box. However, what you could do is use
GPMC to output a settings report from each GPO to an HTML or XML file and
then use Windiff to compare the differences. There are third party GP
management products that do compares but they also do a lot more stuff and
probably are more than you need.

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related

"phawley77" <phaw...@discussions.microsoft.com> wrote in message
news:6F33B519-226E-41C3...@microsoft.com...

[phawley77]

Ah right - didn't think of doing it that way - can i get meaningful results
from the out of windiff including the values for the Reg keys? I used
windiff before I posted directly on the Pol files associated with the GPO's.
But this didn't keep the values. Have used a app called 'beyond compare' to
compare diffs in Reg frags obtained from the Pol files. Was hoping for a way
that can be scripted, and kepping the values for the keys.

Cheers,

Phil

[Darren Mar-Elia]

No it won't get the actual values. A settings report just shows textually
whether a particular policy is enabled or disabled. If you're good with C++,
you could use the IGroupPolicyObject interface to read administrative
template policy out of registry.pol for a given GPO and then compare that to
another one, but it only support admin. template and, you of course have to
write C++ :-). This the perpetual challenge with the way GP storage is
architected today. Because there is no consistent storage format across all
CSEs, you would essentially have to write a parser for each one to truly
compare settings across all GP areas.

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Check out http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Whitepapers and Utilities for all things Group Policy-related

"phawley77" <phaw...@discussions.microsoft.com> wrote in message

news:0349999F-42A1-4DA4...@microsoft.com...