How to Set Up Windows Server 2016 Group Policy Modelling

Group Policy Modelling (also known as RSoP Planning Mode) is a what-if analysis tool built into the Group Policy Management Console on Windows Server 2016. It allows administrators to simulate the Resultant Set of Policy for a user or computer before making changes, answering questions like: What policies would apply if this user logged onto that computer? What would change if I moved this account to a different OU? This makes it invaluable for testing policy designs, diagnosing access issues, and documenting expected behaviour before deploying changes in production.

Group Policy Modelling vs Group Policy Results

There are two related tools that are often confused:

Group Policy Modelling (this tutorial) simulates policy application based on parameters you specify. No actual policy processing occurs on a client machine; the domain controller performs the simulation using the Kerberos ticket for the simulated user and computer.

Group Policy Results (covered in the next tutorial) queries a live machine to report what policies actually applied during the last Group Policy processing cycle.

Running the Group Policy Modelling Wizard

In GPMC, right-click the Group Policy Modelling node under your domain and select Group Policy Modelling Wizard. The wizard walks through several screens:

Domain Controller Selection: Choose any Windows Server 2016 domain controller. The simulation runs on this server using its copy of Active Directory.

User and Computer Information: Specify the user or group, and the computer or OU you want to simulate. You can simulate a user from one OU logging onto a computer in a different OU, which is useful for remote work or shared workstation scenarios.

Advanced Simulation Options: Optionally specify slow link detection, loopback processing mode (Replace or Merge), and site. These options let you test how policy behaves in specific network conditions.

Alternative Active Directory paths: Simulate the result if the user or computer were in a different OU, making it easy to preview the effect of object moves before making them.

WMI Filters: Specify whether all, no, or selected WMI filters should be assumed true for the simulation.

Running Group Policy Modelling from PowerShell

The GPMC COM object exposes Group Policy Modelling programmatically, but the most practical scripted approach is to generate the report via GPMC and export it. Alternatively, use the built-in RSoP WMI namespace to query simulation results. The following PowerShell block calls the GPMC wizard programmatically to generate an HTML report:

$gpmc = New-Object -ComObject GPMgmt.GPM
$constants = $gpmc.GetConstants()
$domain = $gpmc.GetDomain("contoso.com", "", $constants.UseAnyDC)
$rsopQueryTarget = $gpmc.CreateGPMRSOPData($domain, $null, 2)  # 2 = Planning mode

For a simpler scripted workflow, use the standalone GPResult tool with explicit targeting:

gpresult /s ClientPC01 /user CONTOSOjsmith /h C:Reportsmodelling_jsmith.html /f

Simulating OU Moves

One of the most common use cases for Group Policy Modelling is verifying what will happen when you move an account from one OU to another. In the wizard, on the User Information screen, click Skip to the next page without selecting a user and instead use the Alternate user location option to specify the destination OU. This shows the policies that would apply after the move without requiring you to actually move the account.

Testing Loopback Processing

Loopback processing is a computer-side setting that causes user-side policies from the computer’s OU (rather than the user’s OU) to apply when a user logs on. This is common in kiosk, lab, and shared workstation environments. To test its effect:

# Enable loopback policy on the test GPO first
Set-GPRegistryValue -Name "Kiosk Baseline" `
    -Key "HKLMSoftwarePoliciesMicrosoftWindowsSystem" `
    -ValueName UserPolicyMode -Type DWord -Value 1

Then run the Modelling Wizard with Loopback Processing Mode: Replace enabled and compare the results to a simulation without loopback to see exactly which user settings are overridden.

Interpreting the Modelling Results

The wizard produces a report identical in format to the Group Policy Results report. Key sections to review include:

Summary: Lists the simulated user and computer, the OU locations used, and the site. Applied GPOs: Every GPO that would apply in priority order. Denied GPOs: GPOs that were filtered by security, WMI filter, or block inheritance. Settings: The winning value for each policy setting, with the GPO that provided it—useful for identifying conflicts.

gpresult /h C:Reportsfull_model.html /f /v

The /v flag (verbose) includes the full settings detail in the HTML output, making it comprehensive enough for documentation and change management submissions.

Group Policy Modelling is a risk-free way to validate Group Policy changes before they impact users. Making it part of your change management process prevents misconfigured GPOs from disrupting production environments.