How to Set Up Windows Server 2019 Group Policy Modelling

March 31, 2026
Tutorials
Comment off

How to Set Up Windows Server 2019 Group Policy Modelling

Group Policy Modelling (also known as Resultant Set of Policy — Planning Mode) is a powerful analysis tool built into the Group Policy Management Console that predicts what Group Policy settings would apply to a user or computer given a specific set of conditions. Rather than deploying a GPO and then running gpresult to see what happened, Group Policy Modelling lets you simulate policy application before deployment. This is essential for testing policy changes in complex environments and for troubleshooting situations where the expected policy is not being applied. This guide covers configuring and using Group Policy Modelling on Windows Server 2019.

Understanding Group Policy Modelling vs. Results

Windows Server 2019 provides two complementary GP analysis tools. Group Policy Results (RSoP Logging Mode) shows what policies were actually applied to a user or computer based on a recent policy refresh. Group Policy Modelling (RSoP Planning Mode) simulates what would be applied under hypothetical conditions — a different OU, different group membership, slow link, or loopback processing. Modelling runs as a query against Active Directory and does not require access to the target computer.

Running Group Policy Modelling from GPMC

Open the Group Policy Management Console and navigate to the Group Policy Modelling node:

gpmc.msc

In the GPMC tree, right-click Group Policy Modelling and select Group Policy Modelling Wizard. The wizard guides you through the simulation parameters:

Group Policy Management Console > Forest: contoso.local >
Domains > contoso.local > Group Policy Modelling > 
Right-click > Group Policy Modelling Wizard

The wizard prompts for: target DC to run the simulation on, user information (specific user or simulated OU location), computer information (specific computer or simulated OU location), slow link simulation, loopback processing mode, and security group simulations.

Running Group Policy Modelling with PowerShell

The New-GPModelingQuery cmdlet from the GroupPolicy module allows scripted modelling queries. Run a modelling query for a specific user and computer:

New-GPModelingQuery `
    -Name "Finance User on Finance PC" `
    -Domain contoso.local `
    -DomainController "DC01.contoso.local" `
    -User "contosojsmith" `
    -Computer "WORKSTATION-01" `
    -ReportType Html `
    -Path "C:GPModellingjsmith-modelling.html"

Run a modelling query simulating a user in a different OU:

New-GPModelingQuery `
    -Name "Finance User in IT OU Simulation" `
    -Domain contoso.local `
    -UserOU "OU=IT,DC=contoso,DC=local" `
    -ComputerOU "OU=IT-Workstations,DC=contoso,DC=local" `
    -ReportType Html `
    -Path "C:GPModellingit-simulation.html"

Simulating Group Membership Changes

One of the most valuable Modelling features is the ability to simulate what would happen if a user or computer was added to or removed from a security group — without making any actual changes. In GPMC wizard, on the Security Groups page, add simulated groups to the user’s or computer’s context:

New-GPModelingQuery `
    -Name "Test Finance Policy with VPN Group" `
    -Domain contoso.local `
    -User "contosojsmith" `
    -Computer "WORKSTATION-01" `
    -UserSecurityGroup @("CONTOSOVPN-Users", "CONTOSORemote-Workers") `
    -ReportType Html `
    -Path "C:GPModellingvpn-simulation.html"

This simulates jsmith as if they were a member of the VPN-Users and Remote-Workers groups, showing exactly which additional GPOs would apply and what settings would change.

Simulating Loopback Processing

Test the effect of loopback processing on a specific computer, such as a terminal server:

New-GPModelingQuery `
    -Name "Loopback Replace on Terminal Server" `
    -Domain contoso.local `
    -User "contosojsmith" `
    -Computer "TERMSERV01" `
    -LoopbackMode Replace `
    -ReportType Html `
    -Path "C:GPModellingloopback-simulation.html"

This shows exactly which user-side settings would be overridden by the terminal server’s computer-linked GPOs when loopback Replace mode is active.

Simulating Slow Link Detection

Test what would happen if a user logs on over a slow WAN link (which disables certain GPO extensions like folder redirection and software installation):

New-GPModelingQuery `
    -Name "Slow Link Simulation" `
    -Domain contoso.local `
    -User "contosojsmith" `
    -Computer "LAPTOP-REMOTE" `
    -SlowLink:$true `
    -ReportType Html `
    -Path "C:GPModellingslowlink-simulation.html"

Batch Modelling for Multiple Users

Run modelling queries for all users in a specific OU to validate a planned GPO change:

$users = Get-ADUser -SearchBase "OU=Finance,DC=contoso,DC=local" -Filter * -Properties SamAccountName

$reportFolder = "C:GPModellingFinance_Batch_$(Get-Date -Format yyyyMMdd)"
New-Item -ItemType Directory -Path $reportFolder -Force

foreach ($user in $users) {
    $reportFile = "$reportFolder$($user.SamAccountName).html"
    try {
        New-GPModelingQuery `
            -Name "Batch-$($user.SamAccountName)" `
            -Domain contoso.local `
            -User "contoso$($user.SamAccountName)" `
            -ComputerOU "OU=Finance-Workstations,DC=contoso,DC=local" `
            -ReportType Html `
            -Path $reportFile
        Write-Output "Completed: $($user.SamAccountName)"
    } catch {
        Write-Warning "Failed for $($user.SamAccountName): $_"
    }
}

Write-Output "Modelling reports saved to $reportFolder"

Reading Modelling Results Programmatically

Parse saved modelling queries to extract applied GPO names:

$queries = Get-GPModelingQuery -Name "Finance User on Finance PC" -Domain contoso.local

$queries | Select -ExpandProperty UserResults |
    Select -ExpandProperty AppliedGPOs |
    Select DisplayName, GpoStatus, Reason |
    Format-Table

Automating Pre-Change Validation

Integrate GP Modelling into your change management process. Before deploying any new GPO, run a modelling simulation against representative users and computers and review the report for unexpected settings:

function Test-GPOChange {
    param(
        [string]$UserToTest = "contosotestuser",
        [string]$ComputerToTest = "TEST-WORKSTATION",
        [string]$NewGPOName
    )

    $reportPath = "C:GPModellingPreChange_$(Get-Date -Format yyyyMMdd_HHmm).html"

    New-GPModelingQuery `
        -Name "Pre-Change Simulation" `
        -Domain contoso.local `
        -User $UserToTest `
        -Computer $ComputerToTest `
        -ReportType Html `
        -Path $reportPath

    Write-Output "Pre-change modelling report: $reportPath"
    Start-Process $reportPath
}

Test-GPOChange -UserToTest "contosojsmith" -ComputerToTest "FINANCE-PC01"

Group Policy Modelling is an underutilized but extremely valuable tool in Windows Server 2019 environments. By simulating policy application before deploying changes, you can identify conflicts, unexpected exclusions, and unintended setting applications before they affect users in production. Incorporating modelling into your GPO change management workflow reduces the risk of policy-related incidents and provides a clear, auditable record of the expected impact of each change.

How to Set Up Windows Server 2019 Group Policy Modelling