JSI Tip 7989. The GPResult.exe tool does NOT return a complete list of security policies in Windows Server 2003?

When you run the GPResult.exe (Group Policy Results) tool on a Windows Server 2003 PDC emulator, you may receive:

Account Policies----------------   GPO: Default Domain Policy   Policy:            MaxServiceAge   Computer Setting:  600   GPO: Default Domain Policy   Policy:            MaxTicketAge   Computer Setting:  10   GPO: Default Domain Policy   Policy:            MinimumPasswordAge   Computer Setting:  N/A   GPO: Default Domain Policy   Policy:            PasswordHistorySize   Computer Setting:  3   GPO: Default Domain Policy   Policy:            MaxClockSkew   Computer Setting:  5   GPO: Default Domain Policy   Policy:            MinimumPasswordLength   Computer Setting:  N/A   GPO: Default Domain Policy   Policy:            LockoutBadCount   Computer Setting:  N/A   GPO: Default Domain Policy   Policy:            MaximumPasswordAge   Computer Setting:  43   GPO: Default Domain Policy   Policy:            MaxRenewAge   Computer Setting:  7

When you run the GPResult.exe tool on a computer that is not the PDC emulator, you may receive:

Account Policies----------------GPO: Default Domain PolicyPolicy:            MaxServiceAgeComputer Setting:  600GPO: Default Domain PolicyPolicy:            MaxTicketAgeComputer Setting:  10GPO: Default Domain PolicyPolicy:            MaxClockSkewComputer Setting:  5GPO: Default Domain PolicyPolicy:            MaxRenewAgeComputer Setting:  7

This behavior will occur when you run the GPResult.exe tool on a computer that is not the PDC emulator.

Some policies are designed to be automatically replicated by Active Directory, and are NOT reported on replicas.