gpmclisted

# Group Policy inventory (read-only LDAP) Use this skill when the user asks about domain Group Policy Objects, what is linked where, unlinked/orphaned GPOs, GPO enabled/disabled flags, or what applies to the **current** interactive user on this PC. ## What this skill does - Inventory all GPOs under `CN=Policies,CN=System,<domainDN>` - Parse `gPLink` on domain / OU / site objects (link order, disabled, enforced) - Find GPOs that exist but are **not linked** anywhere - Search GPOs by display name - Show `gpresult` for the **current user** on this workstation - Prefer the helper script so link/flag parsing stays consistent Domain DN is discovered automatically via `LDAP://RootDSE` — no hardcoded domain. ## What this skill does **not** do - Edit, create, delete, or link GPOs - Open the GPMC GUI or require the RSAT `GroupPolicy` module - Claim full computer RSoP without elevation (`gpresult /scope computer` is Access Denied for a non-elevated user) - Answer “exactly what applies to another user/PC” as true RSoP (security filtering + WMI need modeling rights). Best-effort: show GPOs linked on their OU path ## Important mental model | Source | Answers | |---|---| | Local client cache / applied history | Only what applied to **this** machine/user | | Domain LDAP (`groupPolicyContainer` + `gPLink`) | Domain-wide inventory + **linked vs unlinked** | | `gpresult /scope user` | Applied user GPOs for **this** session user | Clients do **not** sync the full link topology. Do