Using SCCM 2012 Compliance to check if a GPO applied

Is it possible to use SCCM 2012 Compliance feature to check if a AD GPO settings applied to a Device / User collection or not?

If Yes, then how?

January 13th, 2014 11:04am

GPO's get applied to a systems Registry. You might be able to build off of that...
Free Windows Admin Tool Kit Click here and download it now
January 13th, 2014 11:30am

TCRich is on the right track. You need to know some specific settings that the GPO will apply (change a registry key for example) and add this as your Configuration Item.
January 13th, 2014 11:43am

You can do this with SCM (Security Compliance Manager), download here: http://www.microsoft.com/en-us/download/details.aspx?id=16776

  1. Import your GPOs to SCM some guidelines here: http://4sysops.com/archives/microsoft-security-compliance-manager-scm-v2-part-1
  2. Export your GPO from SCM to DCM format guides here: http://blogs.msdn.com/b/scom_2012_upgrade_process__lessons_learned_during_my_upgrade_process/archive/2012/09/21/compliance-settings-sccm-2012.aspx
  3. Import your DCM to SCCM and off you go





  • Proposed as answer by narcoticoo 19 hours 18 minutes ago
  • Edited by narcoticoo 19 hours 14 minutes ago
Free Windows Admin Tool Kit Click here and download it now
January 13th, 2014 12:09pm

You can also just query WMI to verify if the GPO was applied or not: http://msmvps.com/blogs/daniel/archive/2008/04/04/using-sccm-dcm-to-verify-the-gpo-compliance-part-2.aspx
January 13th, 2014 1:21pm

thanks for the lead, we will check this out in a couple of days.
Free Windows Admin Tool Kit Click here and download it now
January 13th, 2014 8:37pm


thanks for the lead, we will check this out in a couple of days.
January 13th, 2014 8:37pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics