Is there a way to get a list of all Domain Group Policy objects that have been changed from their default setting?

 

Not to my knowledge. The best thing I can tell you is to the whitepaper on Group Policy Objects for your server (2000 or 2003 I presume). The whitepaper will show all default settings and any attributes they may have. It is a long process, but...

 

I don't know the specific answer either. I can tell you howver, that the policies themselves are located at the path below on your DC's.

C:\Windows\SYSVOL\sysvol\[domain]\Policies

Once you dig down from there, you'll see that they're just .adm files. Perhaps you can come up with the info you need by doing some sorting on creation date or last modified date.

BTW - If you use GPO's msotly for desktop management, I'd recommend looking into the products from ScriptLogic. I'm pretty sure they don't do anything that can't already be done with Group Policy, but they make life a hell of a lot easier.

 

you can try to use group policy management tool from microsoft. this tool is available with windows 2003. you can generate reports that will tell you what is configured for each domain. not sure if there is a compare feature but if you load a default policy and generate a text report and then your modified goup policy, then you can use any basic diff tool to highlight the differences between the two.

http://www.microsoft.com/windowsserv...c/default.mspx

 

check this out too. The tree structure on the left is identical to the GPO tree on your server. It gives all the defaults and attributes of each setting (I think it is the 6th one down).

http://www.microsoft.com/resources/d...-us/gp/597.asp

you may have to copy this to your address bar.

 

Thanks! I played around with this a little bit this morning. It looks like the standard report prints out the mondified settings.