New tool: Policy Analyzer

Published Jun 18 2019 01:15 PM 75K Views
Former Employee
First published on TechNet on Jan 22, 2016
Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). It can highlight when a set of Group Policies has redundant settings or internal inconsistencies, and can highlight the differences between versions or sets of Group Policies. It can also compare GPOs against current local policy settings and against local registry settings. And you can export its findings to a Microsoft Excel spreadsheet.

Policy Analyzer lets you treat a set of GPOs as a single unit.  This makes it easy to determine whether particular settings are duplicated across the GPOs or are set to conflicting values.  It also lets you capture a baseline and then compare it to a snapshot taken at a later time to identify changes anywhere across the set.

For example, the US Government Configuration Baseline (USGCB) for Windows 7 includes seven different GPOs.  Policy Analyzer can treat them as a single set, and show all the differences between them and the Microsoft recommended baselines for Windows 10 and Internet Explorer 11 with a single comparison.  You can also use it to verify changes that were made to your production GPOs.

The following screenshot shows two baselines compared with each other and to corresponding registry values on the local system. The lower pane displays the Group Policy setting, location, and other information associated with the selected row. Conflicting settings are highlighted in yellow; absent settings are shown as a grey cell. Policy Analyzer also offers options to display only rows containing conflicts or other differences.


The following screenshot shows Policy Analyzer’s Excel output. Policy Analyzer sorts results primarily by the Group Policy path and setting name columns, which are the leftmost columns.


Policy Analyzer is a lightweight standalone application that doesn’t require installation, and doesn’t require administrative rights (except for the “local policy” feature).

The downloadable attachment to this blog post contains Policy Analyzer, its full documentation and sample GPO sets taken from the Microsoft security configuration baselines.

[Updated 3 February 2016: download now includes representations of all Windows, IE, and Office GPOs published in the Security Compliance Manager.]

[Update: the latest version of Policy Analyzer is here .]
www.000webhost.com
16 Comments
Senior Member

It would be very helpful add the policy name retrieved when you specify a root folder for GP within the File Name field when you click on Import, it would speed up the import process, imagine you have to deal with hundreds of policies....

Regular Visitor

Hi this tool seems like it'd be really useful but I'm having an issue where it's not importing all the backed up GPOs. I got the backups using PowerShell's Backup-GPO. I've tested the backups with Group Policy Management and it sees them all fine. At a loss what to try next, it's no good to me if I can't get all my policies in it to compare.

Senior Member

Did you check which policies have not been imported and which settings they contains, reason why I'm asking is because some settings, such as wifi networks or AppLocker are not visible within PolicyAnalyzer, other reason could be if permission are not enough on that specific policy.

Contributor

Dear @Intune Support Team do you know if there is a plan to get something like "Policy Analyzer" but with Graph API support for comparing intune / Microsoft endpoint manager policies? Thank you!

Hi @Sergg, have you seen our GraphAPI docs for the deviceConfiguration resource type? We also have several Intune Device Configuration Policy script samples to retrieve, create, delete or update data within your Intune tenant. Hope this helps!

Occasional Contributor

does it analyse now the " GP preferences"?  sometimes settings are configured using GPpreferences instead of GPPolicies

i cannot find release notes information and the instruction PDF inside the .ZIP still dates back 2016.

i think it is a great tool to compare and cleanup GPOs, but without including the GP preferences, it is half a tool, like a hammer without a handle.

Senior Member

@sbonnat time being it does not include policy preferences, nor other settings e.g. wifi or applocker, I agree including the full spectrum you can push via policy it would be a complete tool, but still it's very useful on scenarios where you have dozens of policies with settings that overlap or not organized very well and find rapidly where that particular one is located.

Occasional Visitor

@Intune Support Team @Aaron Margosis 

When we use Policy Analyser is it possible to use result to modify and correct GPO ?

Senior Member

@LeaIT  It's a read and compare tool, you can't edit or write new policies within the tool, you have to adapt the GP from gpedit or any other tool made for editing them.

 

 

Senior Member

How we will get the Policy name for which the conflict has occurred. It would be very tedious task for those who have large number of group policy in place.  

Occasional Contributor

@Amitsinghrajput - one way is to import all your policies at once into a single policy set, then view that one set, and View | Show only Conflicts.

New Contributor

Is there a getting started guide or video for the Policy Analyzer? I have just downloaded the Security Compliance toolkit and Window 10 21H1 Security Baseline. Simply want to compare the baseline with our deployed policies. "Policy Analyzer.pdf" is a technical reference but not instructional.

Senior Member

@Steve_Pogue  I'm having similar challenge as well. Microsoft should create simple guide. 

Occasional Visitor

Hi. Aaron.

@Aaron Margosis 

Thank you for putting so much effort in this tool.

Unfortunately it is only an interactive tool and cannot simply be used for automation. It does not have an interface that can be used to automatically create the .policyrule files or to compare them. Of course, ones the .policyrule files are created you can write a script to do so. But the GUI does include all those features but cannot be used in a command line.

It would be so cool if that could be implemented. Or make it open source so the community can use the algorithms to read the various setting details as the GUI does.

Thank you for considering to open source the tool or to implement a command line version or an API.

 

Occasional Visitor

Hello @Aaron Margosis 

I am trying to run policy analyzer v4.0.2004.13001 and click on add to import GPOs'. Now it ask me to import it to a policy file. After that nothing happens. Please provide step-by-step instructions on how to use this new tool. Even the GUI shown in the screenshot differs from the original. Please help.

Occasional Contributor

@Soumya1575 - this page is an old article about the original release. This page is more up to date. The Policy Analyzer download includes a PDF that should explain usage comprehensively.

%3CLINGO-SUB%20id%3D%22lingo-sub-701049%22%20slang%3D%22en-US%22%3ENew%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-701049%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3EFirst%20published%20on%20TechNet%20on%20Jan%2022%2C%202016%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20Policy%20Analyzer%20is%20a%20utility%20for%20analyzing%20and%20comparing%20sets%20of%20Group%20Policy%20Objects%20(GPOs).%20It%20can%20highlight%20when%20a%20set%20of%20Group%20Policies%20has%20redundant%20settings%20or%20internal%20inconsistencies%2C%20and%20can%20highlight%20the%20differences%20between%20versions%20or%20sets%20of%20Group%20Policies.%20It%20can%20also%20compare%20GPOs%20against%20current%20local%20policy%20settings%20and%20against%20local%20registry%20settings.%20And%20you%20can%20export%20its%20findings%20to%20a%20Microsoft%20Excel%20spreadsheet.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Policy%20Analyzer%20lets%20you%20treat%20a%20set%20of%20GPOs%20as%20a%20single%20unit.%26nbsp%3B%20This%20makes%20it%20easy%20to%20determine%20whether%20particular%20settings%20are%20duplicated%20across%20the%20GPOs%20or%20are%20set%20to%20conflicting%20values.%26nbsp%3B%20It%20also%20lets%20you%20capture%20a%20baseline%20and%20then%20compare%20it%20to%20a%20snapshot%20taken%20at%20a%20later%20time%20to%20identify%20changes%20anywhere%20across%20the%20set.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20For%20example%2C%20the%20US%20Government%20Configuration%20Baseline%20(USGCB)%20for%20Windows%207%20includes%20seven%20different%20GPOs.%26nbsp%3B%20Policy%20Analyzer%20can%20treat%20them%20as%20a%20single%20set%2C%20and%20show%20all%20the%20differences%20between%20them%20and%20the%20Microsoft%20recommended%20baselines%20for%20Windows%2010%20and%20Internet%20Explorer%2011%20with%20a%20single%20comparison.%26nbsp%3B%20You%20can%20also%20use%20it%20to%20verify%20changes%20that%20were%20made%20to%20your%20production%20GPOs.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20The%20following%20screenshot%20shows%20two%20baselines%20compared%20with%20each%20other%20and%20to%20corresponding%20registry%20values%20on%20the%20local%20system.%20The%20lower%20pane%20displays%20the%20Group%20Policy%20setting%2C%20location%2C%20and%20other%20information%20associated%20with%20the%20selected%20row.%20Conflicting%20settings%20are%20highlighted%20in%20yellow%3B%20absent%20settings%20are%20shown%20as%20a%20grey%20cell.%20Policy%20Analyzer%20also%20offers%20options%20to%20display%20only%20rows%20containing%20conflicts%20or%20other%20differences.%20%3CBR%20%2F%3E%3CP%20style%3D%22margin-left%3A%2030px%3B%22%3E%3CIMG%20alt%3D%22%22%20border%3D%220%22%20original-url%3D%22http%3A%2F%2Fblogs.technet.com%2Fresized-image.ashx%2F__size%2F550x0%2F__key%2Fcommunityserver-blogs-components-weblogfiles%2F00-00-00-40-62%2FViewCompare.png%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F119320i7FDC58E883D5F3BA%22%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%20The%20following%20screenshot%20shows%20Policy%20Analyzer%E2%80%99s%20Excel%20output.%20Policy%20Analyzer%20sorts%20results%20primarily%20by%20the%20Group%20Policy%20path%20and%20setting%20name%20columns%2C%20which%20are%20the%20leftmost%20columns.%20%3CBR%20%2F%3E%3CP%20style%3D%22margin-left%3A%2030px%3B%22%3E%3CIMG%20alt%3D%22%22%20border%3D%220%22%20original-url%3D%22http%3A%2F%2Fblogs.technet.com%2Fresized-image.ashx%2F__size%2F550x0%2F__key%2Fcommunityserver-blogs-components-weblogfiles%2F00-00-00-40-62%2FExportToExcel.png%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F119321i3E69AD9EA5121875%22%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%20Policy%20Analyzer%20is%20a%20lightweight%20standalone%20application%20that%20doesn%E2%80%99t%20require%20installation%2C%20and%20doesn%E2%80%99t%20require%20administrative%20rights%20(except%20for%20the%20%E2%80%9Clocal%20policy%E2%80%9D%20feature).%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20The%20downloadable%20attachment%20to%20this%20blog%20post%20contains%20Policy%20Analyzer%2C%20its%20full%20documentation%20and%20sample%20GPO%20sets%20taken%20from%20the%20Microsoft%20security%20configuration%20baselines.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CSTRONG%3E%20%5BUpdated%203%20February%202016%3A%20download%20now%20includes%20representations%20of%20all%20Windows%2C%20IE%2C%20and%20Office%20GPOs%20published%20in%20the%20Security%20Compliance%20Manager.%5D%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CSPAN%20style%3D%22color%3A%20%23ff0000%3B%22%3E%20%5BUpdate%3A%20the%20latest%20version%20of%20Policy%20Analyzer%20is%20%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D55319%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%20here%20%3C%2FA%3E%20.%5D%3C%2FSPAN%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-701049%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20TechNet%20on%20Jan%2022%2C%202016%20Policy%20Analyzer%20is%20a%20utility%20for%20analyzing%20and%20comparing%20sets%20of%20Group%20Policy%20Objects%20(GPOs).%3C%2FLINGO-TEASER%3E%3CLINGO-SUB%20id%3D%22lingo-sub-888005%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-888005%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20would%20be%20very%20helpful%20add%20the%20policy%20name%20retrieved%20when%20you%20specify%20a%20root%20folder%20for%20GP%20within%20the%20File%20Name%20field%20when%20you%20click%20on%20Import%2C%20it%20would%20speed%20up%20the%20import%20process%2C%20imagine%20you%20have%20to%20deal%20with%20hundreds%20of%20policies....%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1260657%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1260657%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20this%20tool%20seems%20like%20it'd%20be%20really%20useful%20but%20I'm%20having%20an%20issue%20where%20it's%20not%20importing%20all%20the%20backed%20up%20GPOs.%20I%20got%20the%20backups%20using%20PowerShell's%20Backup-GPO.%20I've%20tested%20the%20backups%20with%20Group%20Policy%20Management%20and%20it%20sees%20them%20all%20fine.%20At%20a%20loss%20what%20to%20try%20next%2C%20it's%20no%20good%20to%20me%20if%20I%20can't%20get%20all%20my%20policies%20in%20it%20to%20compare.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1260800%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1260800%22%20slang%3D%22en-US%22%3E%3CP%3EDid%20you%20check%20which%20policies%20have%20not%20been%20imported%20and%20which%20settings%20they%20contains%2C%20reason%20why%20I'm%20asking%20is%20because%20some%20settings%2C%20such%20as%20wifi%20networks%20or%20AppLocker%20are%20not%20visible%20within%20PolicyAnalyzer%2C%20other%20reason%20could%20be%20if%20permission%20are%20not%20enough%20on%20that%20specific%20policy.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1382745%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1382745%22%20slang%3D%22en-US%22%3E%3CP%3EDear%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F226779%22%20target%3D%22_blank%22%3E%40Intune%20Support%20Team%3C%2FA%3E%20do%20you%20know%20if%20there%20is%20a%20plan%20to%20get%20something%20like%20%22Policy%20Analyzer%22%20but%20with%20Graph%20API%20support%20for%20comparing%20intune%20%2F%20Microsoft%20endpoint%20manager%20policies%3F%20Thank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1384192%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1384192%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F283216%22%20target%3D%22_blank%22%3E%40Sergg%3C%2FA%3E%2C%20have%20you%20seen%20our%26nbsp%3BGraphAPI%20docs%20for%20the%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fgraph%2Fapi%2Fresources%2Fintune-deviceconfig-deviceconfiguration%3Fview%3Dgraph-rest-1.0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EdeviceConfiguration%20resource%20type%3C%2FA%3E%3F%20We%20also%20have%20several%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmicrosoftgraph%2Fpowershell-intune-samples%2Ftree%2Fmaster%2FDeviceConfiguration%23intune-device-configuration-policy-script-samples%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EIntune%20Device%20Configuration%20Policy%20script%20samples%3C%2FA%3E%20to%20retrieve%2C%20create%2C%20delete%20or%20update%20data%20within%20your%20Intune%20tenant.%20Hope%20this%20helps!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1459443%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1459443%22%20slang%3D%22en-US%22%3E%3CP%3Edoes%20it%20analyse%20now%20the%20%22%20GP%20preferences%22%3F%26nbsp%3B%20sometimes%20settings%20are%20configured%20using%20GPpreferences%20instead%20of%20GPPolicies%3CBR%20%2F%3E%3CBR%20%2F%3Ei%20cannot%20find%20release%20notes%20information%20and%20the%20instruction%20PDF%20inside%20the%20.ZIP%20still%20dates%20back%202016.%3CBR%20%2F%3E%3CBR%20%2F%3Ei%20think%20it%20is%20a%20great%20tool%20to%20compare%20and%20cleanup%20GPOs%2C%20but%20without%20including%20the%20GP%20preferences%2C%20it%20is%20half%20a%20tool%2C%20like%20a%20hammer%20without%20a%20handle.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1460484%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1460484%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F384979%22%20target%3D%22_blank%22%3E%40sbonn%3C%2FA%3Eat%20time%20being%20it%20does%20not%20include%20policy%20preferences%2C%20nor%20other%20settings%20e.g.%20wifi%20or%20applocker%2C%20I%20agree%20including%20the%20full%20spectrum%20you%20can%20push%20via%20policy%20it%20would%20be%20a%20complete%20tool%2C%20but%20still%20it's%20very%20useful%20on%20scenarios%20where%20you%20have%20dozens%20of%20policies%20with%20settings%20that%20overlap%20or%20not%20organized%20very%20well%20and%20find%20rapidly%20where%20that%20particular%20one%20is%20located.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1476890%22%20slang%3D%22fr-FR%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1476890%22%20slang%3D%22fr-FR%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F226779%22%20target%3D%22_blank%22%3E%40Intune%20Support%20Team%3C%2FA%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F171536%22%20target%3D%22_blank%22%3E%40Aaron%20Margosis%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20we%20use%20Policy%20Analyser%20is%20it%20possible%20to%20use%20result%20to%20modify%20and%20correct%20GPO%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1477028%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1477028%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F704651%22%20target%3D%22_blank%22%3E%40LeaIT%3C%2FA%3E%26nbsp%3B%20It's%20a%20read%20and%20compare%20tool%2C%20you%20can't%20edit%20or%20write%20new%20policies%20within%20the%20tool%2C%20you%20have%20to%20adapt%20the%20GP%20from%20gpedit%20or%20any%20other%20tool%20made%20for%20editing%20them.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Version history
Last update:
‎Jun 18 2019 01:15 PM
Updated by: