%3CLINGO-SUB%20id%3D%22lingo-sub-701049%22%20slang%3D%22en-US%22%3ENew%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-701049%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3EFirst%20published%20on%20TechNet%20on%20Jan%2022%2C%202016%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20Policy%20Analyzer%20is%20a%20utility%20for%20analyzing%20and%20comparing%20sets%20of%20Group%20Policy%20Objects%20(GPOs).%20It%20can%20highlight%20when%20a%20set%20of%20Group%20Policies%20has%20redundant%20settings%20or%20internal%20inconsistencies%2C%20and%20can%20highlight%20the%20differences%20between%20versions%20or%20sets%20of%20Group%20Policies.%20It%20can%20also%20compare%20GPOs%20against%20current%20local%20policy%20settings%20and%20against%20local%20registry%20settings.%20And%20you%20can%20export%20its%20findings%20to%20a%20Microsoft%20Excel%20spreadsheet.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Policy%20Analyzer%20lets%20you%20treat%20a%20set%20of%20GPOs%20as%20a%20single%20unit.%26nbsp%3B%20This%20makes%20it%20easy%20to%20determine%20whether%20particular%20settings%20are%20duplicated%20across%20the%20GPOs%20or%20are%20set%20to%20conflicting%20values.%26nbsp%3B%20It%20also%20lets%20you%20capture%20a%20baseline%20and%20then%20compare%20it%20to%20a%20snapshot%20taken%20at%20a%20later%20time%20to%20identify%20changes%20anywhere%20across%20the%20set.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20For%20example%2C%20the%20US%20Government%20Configuration%20Baseline%20(USGCB)%20for%20Windows%207%20includes%20seven%20different%20GPOs.%26nbsp%3B%20Policy%20Analyzer%20can%20treat%20them%20as%20a%20single%20set%2C%20and%20show%20all%20the%20differences%20between%20them%20and%20the%20Microsoft%20recommended%20baselines%20for%20Windows%2010%20and%20Internet%20Explorer%2011%20with%20a%20single%20comparison.%26nbsp%3B%20You%20can%20also%20use%20it%20to%20verify%20changes%20that%20were%20made%20to%20your%20production%20GPOs.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20The%20following%20screenshot%20shows%20two%20baselines%20compared%20with%20each%20other%20and%20to%20corresponding%20registry%20values%20on%20the%20local%20system.%20The%20lower%20pane%20displays%20the%20Group%20Policy%20setting%2C%20location%2C%20and%20other%20information%20associated%20with%20the%20selected%20row.%20Conflicting%20settings%20are%20highlighted%20in%20yellow%3B%20absent%20settings%20are%20shown%20as%20a%20grey%20cell.%20Policy%20Analyzer%20also%20offers%20options%20to%20display%20only%20rows%20containing%20conflicts%20or%20other%20differences.%20%3CBR%20%2F%3E%3CP%20style%3D%22margin-left%3A%2030px%3B%22%3E%3CIMG%20alt%3D%22%22%20border%3D%220%22%20original-url%3D%22http%3A%2F%2Fblogs.technet.com%2Fresized-image.ashx%2F__size%2F550x0%2F__key%2Fcommunityserver-blogs-components-weblogfiles%2F00-00-00-40-62%2FViewCompare.png%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F119320i7FDC58E883D5F3BA%22%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%20The%20following%20screenshot%20shows%20Policy%20Analyzer%E2%80%99s%20Excel%20output.%20Policy%20Analyzer%20sorts%20results%20primarily%20by%20the%20Group%20Policy%20path%20and%20setting%20name%20columns%2C%20which%20are%20the%20leftmost%20columns.%20%3CBR%20%2F%3E%3CP%20style%3D%22margin-left%3A%2030px%3B%22%3E%3CIMG%20alt%3D%22%22%20border%3D%220%22%20original-url%3D%22http%3A%2F%2Fblogs.technet.com%2Fresized-image.ashx%2F__size%2F550x0%2F__key%2Fcommunityserver-blogs-components-weblogfiles%2F00-00-00-40-62%2FExportToExcel.png%22%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F119321i3E69AD9EA5121875%22%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%20Policy%20Analyzer%20is%20a%20lightweight%20standalone%20application%20that%20doesn%E2%80%99t%20require%20installation%2C%20and%20doesn%E2%80%99t%20require%20administrative%20rights%20(except%20for%20the%20%E2%80%9Clocal%20policy%E2%80%9D%20feature).%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20The%20downloadable%20attachment%20to%20this%20blog%20post%20contains%20Policy%20Analyzer%2C%20its%20full%20documentation%20and%20sample%20GPO%20sets%20taken%20from%20the%20Microsoft%20security%20configuration%20baselines.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CSTRONG%3E%20%5BUpdated%203%20February%202016%3A%20download%20now%20includes%20representations%20of%20all%20Windows%2C%20IE%2C%20and%20Office%20GPOs%20published%20in%20the%20Security%20Compliance%20Manager.%5D%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20%3CSPAN%20style%3D%22color%3A%20%23ff0000%3B%22%3E%20%5BUpdate%3A%20the%20latest%20version%20of%20Policy%20Analyzer%20is%20%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fdownload%2Fdetails.aspx%3Fid%3D55319%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20here%20%3C%2FA%3E%20.%5D%3C%2FSPAN%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-701049%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20TechNet%20on%20Jan%2022%2C%202016%20Policy%20Analyzer%20is%20a%20utility%20for%20analyzing%20and%20comparing%20sets%20of%20Group%20Policy%20Objects%20(GPOs).%3C%2FLINGO-TEASER%3E%3CLINGO-SUB%20id%3D%22lingo-sub-888005%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-888005%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20would%20be%20very%20helpful%20add%20the%20policy%20name%20retrieved%20when%20you%20specify%20a%20root%20folder%20for%20GP%20within%20the%20File%20Name%20field%20when%20you%20click%20on%20Import%2C%20it%20would%20speed%20up%20the%20import%20process%2C%20imagine%20you%20have%20to%20deal%20with%20hundreds%20of%20policies....%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1260657%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1260657%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20this%20tool%20seems%20like%20it'd%20be%20really%20useful%20but%20I'm%20having%20an%20issue%20where%20it's%20not%20importing%20all%20the%20backed%20up%20GPOs.%20I%20got%20the%20backups%20using%20PowerShell's%20Backup-GPO.%20I've%20tested%20the%20backups%20with%20Group%20Policy%20Management%20and%20it%20sees%20them%20all%20fine.%20At%20a%20loss%20what%20to%20try%20next%2C%20it's%20no%20good%20to%20me%20if%20I%20can't%20get%20all%20my%20policies%20in%20it%20to%20compare.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1260800%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1260800%22%20slang%3D%22en-US%22%3E%3CP%3EDid%20you%20check%20which%20policies%20have%20not%20been%20imported%20and%20which%20settings%20they%20contains%2C%20reason%20why%20I'm%20asking%20is%20because%20some%20settings%2C%20such%20as%20wifi%20networks%20or%20AppLocker%20are%20not%20visible%20within%20PolicyAnalyzer%2C%20other%20reason%20could%20be%20if%20permission%20are%20not%20enough%20on%20that%20specific%20policy.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1382745%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1382745%22%20slang%3D%22en-US%22%3E%3CP%3EDear%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F226779%22%20target%3D%22_blank%22%3E%40Intune%20Support%20Team%3C%2FA%3E%20do%20you%20know%20if%20there%20is%20a%20plan%20to%20get%20something%20like%20%22Policy%20Analyzer%22%20but%20with%20Graph%20API%20support%20for%20comparing%20intune%20%2F%20Microsoft%20endpoint%20manager%20policies%3F%20Thank%20you!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1384192%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1384192%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F283216%22%20target%3D%22_blank%22%3E%40Sergg%3C%2FA%3E%2C%20have%20you%20seen%20our%26nbsp%3BGraphAPI%20docs%20for%20the%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fgraph%2Fapi%2Fresources%2Fintune-deviceconfig-deviceconfiguration%3Fview%3Dgraph-rest-1.0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EdeviceConfiguration%20resource%20type%3C%2FA%3E%3F%20We%20also%20have%20several%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmicrosoftgraph%2Fpowershell-intune-samples%2Ftree%2Fmaster%2FDeviceConfiguration%23intune-device-configuration-policy-script-samples%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EIntune%20Device%20Configuration%20Policy%20script%20samples%3C%2FA%3E%20to%20retrieve%2C%20create%2C%20delete%20or%20update%20data%20within%20your%20Intune%20tenant.%20Hope%20this%20helps!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1459443%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1459443%22%20slang%3D%22en-US%22%3E%3CP%3Edoes%20it%20analyse%20now%20the%20%22%20GP%20preferences%22%3F%26nbsp%3B%20sometimes%20settings%20are%20configured%20using%20GPpreferences%20instead%20of%20GPPolicies%3CBR%20%2F%3E%3CBR%20%2F%3Ei%20cannot%20find%20release%20notes%20information%20and%20the%20instruction%20PDF%20inside%20the%20.ZIP%20still%20dates%20back%202016.%3CBR%20%2F%3E%3CBR%20%2F%3Ei%20think%20it%20is%20a%20great%20tool%20to%20compare%20and%20cleanup%20GPOs%2C%20but%20without%20including%20the%20GP%20preferences%2C%20it%20is%20half%20a%20tool%2C%20like%20a%20hammer%20without%20a%20handle.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1460484%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1460484%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F384979%22%20target%3D%22_blank%22%3E%40sbonn%3C%2FA%3Eat%20time%20being%20it%20does%20not%20include%20policy%20preferences%2C%20nor%20other%20settings%20e.g.%20wifi%20or%20applocker%2C%20I%20agree%20including%20the%20full%20spectrum%20you%20can%20push%20via%20policy%20it%20would%20be%20a%20complete%20tool%2C%20but%20still%20it's%20very%20useful%20on%20scenarios%20where%20you%20have%20dozens%20of%20policies%20with%20settings%20that%20overlap%20or%20not%20organized%20very%20well%20and%20find%20rapidly%20where%20that%20particular%20one%20is%20located.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1476890%22%20slang%3D%22fr-FR%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1476890%22%20slang%3D%22fr-FR%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F226779%22%20target%3D%22_blank%22%3E%40Intune%20Support%20Team%3C%2FA%3E%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F171536%22%20target%3D%22_blank%22%3E%40Aaron%20Margosis%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhen%20we%20use%20Policy%20Analyser%20is%20it%20possible%20to%20use%20result%20to%20modify%20and%20correct%20GPO%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1477028%22%20slang%3D%22en-US%22%3ERe%3A%20New%20tool%3A%20Policy%20Analyzer%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1477028%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F704651%22%20target%3D%22_blank%22%3E%40LeaIT%3C%2FA%3E%26nbsp%3B%20It's%20a%20read%20and%20compare%20tool%2C%20you%20can't%20edit%20or%20write%20new%20policies%20within%20the%20tool%2C%20you%20have%20to%20adapt%20the%20GP%20from%20gpedit%20or%20any%20other%20tool%20made%20for%20editing%20them.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Former Employee
First published on TechNet on Jan 22, 2016
Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). It can highlight when a set of Group Policies has redundant settings or internal inconsistencies, and can highlight the differences between versions or sets of Group Policies. It can also compare GPOs against current local policy settings and against local registry settings. And you can export its findings to a Microsoft Excel spreadsheet.

Policy Analyzer lets you treat a set of GPOs as a single unit.  This makes it easy to determine whether particular settings are duplicated across the GPOs or are set to conflicting values.  It also lets you capture a baseline and then compare it to a snapshot taken at a later time to identify changes anywhere across the set.

For example, the US Government Configuration Baseline (USGCB) for Windows 7 includes seven different GPOs.  Policy Analyzer can treat them as a single set, and show all the differences between them and the Microsoft recommended baselines for Windows 10 and Internet Explorer 11 with a single comparison.  You can also use it to verify changes that were made to your production GPOs.

The following screenshot shows two baselines compared with each other and to corresponding registry values on the local system. The lower pane displays the Group Policy setting, location, and other information associated with the selected row. Conflicting settings are highlighted in yellow; absent settings are shown as a grey cell. Policy Analyzer also offers options to display only rows containing conflicts or other differences.


The following screenshot shows Policy Analyzer’s Excel output. Policy Analyzer sorts results primarily by the Group Policy path and setting name columns, which are the leftmost columns.


Policy Analyzer is a lightweight standalone application that doesn’t require installation, and doesn’t require administrative rights (except for the “local policy” feature).

The downloadable attachment to this blog post contains Policy Analyzer, its full documentation and sample GPO sets taken from the Microsoft security configuration baselines.

[Updated 3 February 2016: download now includes representations of all Windows, IE, and Office GPOs published in the Security Compliance Manager.]

[Update: the latest version of Policy Analyzer is here .]
9 Comments
Established Member

It would be very helpful add the policy name retrieved when you specify a root folder for GP within the File Name field when you click on Import, it would speed up the import process, imagine you have to deal with hundreds of policies....

Regular Visitor

Hi this tool seems like it'd be really useful but I'm having an issue where it's not importing all the backed up GPOs. I got the backups using PowerShell's Backup-GPO. I've tested the backups with Group Policy Management and it sees them all fine. At a loss what to try next, it's no good to me if I can't get all my policies in it to compare.

Established Member

Did you check which policies have not been imported and which settings they contains, reason why I'm asking is because some settings, such as wifi networks or AppLocker are not visible within PolicyAnalyzer, other reason could be if permission are not enough on that specific policy.

Occasional Contributor

Dear @Intune Support Team do you know if there is a plan to get something like "Policy Analyzer" but with Graph API support for comparing intune / Microsoft endpoint manager policies? Thank you!

Hi @Sergg, have you seen our GraphAPI docs for the deviceConfiguration resource type? We also have several Intune Device Configuration Policy script samples to retrieve, create, delete or update data within your Intune tenant. Hope this helps!

Occasional Contributor

does it analyse now the " GP preferences"?  sometimes settings are configured using GPpreferences instead of GPPolicies

i cannot find release notes information and the instruction PDF inside the .ZIP still dates back 2016.

i think it is a great tool to compare and cleanup GPOs, but without including the GP preferences, it is half a tool, like a hammer without a handle.

Established Member

@sbonnat time being it does not include policy preferences, nor other settings e.g. wifi or applocker, I agree including the full spectrum you can push via policy it would be a complete tool, but still it's very useful on scenarios where you have dozens of policies with settings that overlap or not organized very well and find rapidly where that particular one is located.

Occasional Visitor

@Intune Support Team @Aaron Margosis 

When we use Policy Analyser is it possible to use result to modify and correct GPO ?

Established Member

@LeaIT  It's a read and compare tool, you can't edit or write new policies within the tool, you have to adapt the GP from gpedit or any other tool made for editing them.