Any way to check for altered group policy entries en masse?

So after some errors in my event viewer, and some changes I made years ago that were probably not well thought out, I'd like to take stock.

I know i could technically go through and check every single folder and entry in group policy to see whats changed, but id prefer if i could automate this somehow.

Someone mentioned checking the event viewers security log but mine has been cleared a dozen times over.

Hoping there is some script floating around or easy way to simply see what policies ARENT set to "not configured" or something along those lines.

rsop.msc

thanks for the replies guys.

I ended up running rsop.msc which seemed to be just what the doctor ordered, however im getting this error.



any ideas?

did you open it twice??? Try restarting the system.

xaccell said:

did you open it twice??? Try restarting the system.

I did yes. unfortunately I did restart the system as well. When i tried after the restart, i was greeted with the same error.

Is that some kind of rule with it? you can run it one time then not again until you restart the pc or something?

brb im going to restart the pc and try to open it again, for posterity.

if i click okay i get this


- - - Updated - - -

and if i click close there, im greeted with this.



so in short, no.

did it work the first time?

- - - Updated - - -

it sounds like you enabled logging...

Turn off Resultant Set of Policy logging | Windows security encyclopedia

xaccell said:

did it work the first time?

- - - Updated - - -

it sounds like you enabled logging...

Turn off Resultant Set of Policy logging | Windows security encyclopedia

it did seem to work the first time. I was just exploring it so i knew how it functioned, and the result was the aforementioned.

let me try looking into that link you provided and thank you

- - - Updated - - -

it appears that registry key that the article references doesnt exist. I checked the group policy for rsop logging and its not configured, and says that rsop logging is enabled by default.

- - - Updated - - -

well, it does seem disabling rsop logging via group policy allows it to function properly.

I find this odd since windows itself says that rsop logging is on by default. Does this mean that everyone that wants to use RSOP needs to modify this group policy to disable it?

also when closing it, im asked


what should i be hitting?