Microsoft KB Archive/830748

From BetaArchive Wiki
Knowledge Base


Group Policy Results tool does not return a complete list of security policies in Windows Server 2003

Article ID: 830748

Article Last Modified on 10/30/2006



APPLIES TO

  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)




SYMPTOMS

When you run the Group Policy Results tool (Gpresult.exe) on a Microsoft Windows Server 2003-based computer, the tool does not return a complete list of domain policies. For example, when you run the Gpresult.exe tool on a primary domain controller (PDC) emulator, you may receive the following output:

Account Policies
----------------
   GPO: Default Domain Policy
   Policy:            MaxServiceAge
   Computer Setting:  600

   GPO: Default Domain Policy
   Policy:            MaxTicketAge
   Computer Setting:  10

   GPO: Default Domain Policy
   Policy:            MinimumPasswordAge
   Computer Setting:  N/A

   GPO: Default Domain Policy
   Policy:            PasswordHistorySize
   Computer Setting:  3

   GPO: Default Domain Policy
   Policy:            MaxClockSkew
   Computer Setting:  5

   GPO: Default Domain Policy
   Policy:            MinimumPasswordLength
   Computer Setting:  N/A

   GPO: Default Domain Policy
   Policy:            LockoutBadCount
   Computer Setting:  N/A

   GPO: Default Domain Policy
   Policy:            MaximumPasswordAge
   Computer Setting:  43

   GPO: Default Domain Policy
   Policy:            MaxRenewAge
   Computer Setting:  7

However, when you run the Gpresult.exe tool on a computer that is not acting as the PDC emulator, you may receive the following output:

Account Policies
----------------
GPO: Default Domain Policy
Policy:            MaxServiceAge
Computer Setting:  600

GPO: Default Domain Policy
Policy:            MaxTicketAge
Computer Setting:  10

GPO: Default Domain Policy
Policy:            MaxClockSkew
Computer Setting:  5

GPO: Default Domain Policy
Policy:            MaxRenewAge
Computer Setting:  7

CAUSE

This behavior occurs when you run the Gpresult.exe tool on a computer that is not acting as the PDC emulator. Some policies, such as system access policies, are automatically replicated by Active Directory and are not reported on replicas.

STATUS

This behavior is by design.

Keywords: kbwinservds kbactivedirectory kbpolicy kbsecurity kbmisctools kbprb KB830748