Get-GPOReport | Taking on PowerShell one cmdlet at a time | Weekly Blog

Share this post:

This is a part of an on-going blog series written by Adam Gordon. Each week, Adam will walk you through a PowerShell command, showing you when and how to use each one. This week, Adam covers Get-GPOReport.

When to use Get-GPOReport?

The Get-GPOReport cmdlet generates a report in either XML or HTML format that describes properties and policy settings for a specified Group Policy Object (GPO) or for all GPOs in a domain. The information that is reported for each GPO includes: details, links, security filtering, Windows Management Instrumentation (WMI) filtering, delegation, and computer and user configurations.

You can specify the All parameter to generate a report for every GPO in the domain, or you can specify either the Name or Guid parameter to generate a report for a single GPO. You can also pipe GPO objects into this cmdlet. If you specify a file through the Path parameter, the report is written to a file; otherwise, it is printed to the display.

What version of PowerShell am I using for this blog?

Get the PowerShell Version from your machine:


This command shows you the PowerShell version information on your machine.

How to use Get-GPOReport?

Generate an HTML report for the specified GPO: 

Get-GPOReport -Name “PowerShell Policy” -ReportType HTML -Path “C:\GPOReports\PowerShell Policy.html”

This command gets the GPO named PowerShell Policy. The GPO must exist in the domain of the user that is running the session (or, for startup and shutdown scripts, the computer). The command gets the GPO information by contacting the primary domain controller (PDC).

Generate an XML report for each GPO in the specified domain:

Get-GPOReport -All -Domain “ITP.LOCAL” -Server “SCCMDC” -ReportType XML -Path “C:\GPOReports\GPOReportsAll.xml”

This command generates a report in XML format for each GPO in the ITP.LOCAL domain and writes it to the file C:\GPOReports\GPOReportsAll.xml. The SCCMDC.ITP.LOCAL domain controller is contacted to complete the operation.

If the domain of the user account (or, for startup and shutdown scripts, the computer account) is different from ITP.LOCAL, a trust must exist between the two domains.

Learn last week’s command: Get-GPO.

Need PowerShell training? Check out ITProTV’s PowerShell online IT training courses.