01 / REQUIREMENT

Compare the policy content without importing the GPOs

The GPOs had been exported using the standard Microsoft backup format. Each backup was stored in a separate GUID-named folder.

The tool needed to:

  • Compare backups from different environments.
  • Analyse both Computer and User policy.
  • Identify added, removed and modified settings.
  • Avoid importing the GPOs into Active Directory.
  • Produce an output suitable for technical and change review.
  • Support repeatable comparisons for future policy migrations.

A manual comparison through Group Policy Management would have required each policy area to be opened and reviewed separately. It also would not have produced a consistent report that could be regenerated when either GPO changed.

02 / DESIGN

Build a common comparison model for different policy formats

A GPO backup stores its settings across several files and formats. The tool therefore used a modular design in which each supported policy area was analysed separately and converted into a common internal model.

The supported areas included:

  • Administrative Template registry policy
  • Security settings
  • Startup, shutdown, logon and logoff scripts
  • Group Policy Preferences registry settings
  • Restricted Groups and Local Users and Groups settings
  • Relevant GPO metadata

Before processing started, the tool validated both backup folders and confirmed that the expected GPO structure was present. This allowed invalid or incomplete backups to be identified before the comparison was performed.

03 / PROCESSING

Convert the backup contents into comparable records

Each policy format required a different extraction method.

The tool processed policy data from sources including:

Registry.pol
GptTmpl.inf
Group Policy Preferences XML
Script configuration files

The extracted settings were converted into structured PowerShell objects containing the policy scope, policy area, setting location and configured value.

The data was then normalised so that differences in formatting, registry-hive notation and source-file ordering did not produce false changes.

PUBLIC BUILD NOTE

The internal parsing, normalisation and comparison logic remains part of the tool and is not included in the public implementation notes.

04 / COMPARISON

Classify meaningful differences between the backups

After both backups were converted into the common model, the tool compared the resulting data sets.

Each setting was classified as:

  • Added
  • Removed
  • Modified
  • Unchanged

The comparison also accounted for known operating-system-generated entries that were not relevant to the policy review. This produced a focused result showing changes that required investigation rather than every difference found in the underlying files.

05 / REPORTING

Generate a workbook for technical review

The comparison results were exported to a timestamped Excel workbook.

The report included enough context to identify:

  • Whether the setting belonged to Computer or User policy
  • The policy area from which it was extracted
  • The affected setting
  • The values present in each backup
  • The comparison result

The workbook was sorted and filterable, allowing reviewers to focus on added, removed or modified settings. It could also be attached to a change record or retained with migration documentation.

A comparison involving approximately 100 settings could be completed in under a minute, replacing a manual review across multiple Group Policy sections.

06 / VALIDATION AND LIMITATIONS

Backup comparison and effective policy are different checks

Selected results were checked against the original GPOs to confirm that changes were classified correctly.

The tool currently supports one-to-one comparisons only, with a maximum of two GPO backups per run.

It compares the contents of two offline backups. It does not calculate the effective policy applied to a computer or user after considering:

  • GPO link order
  • Inheritance
  • Security filtering
  • WMI filters
  • Loopback processing
  • Conflicting settings from other GPOs

Effective policy must therefore be validated separately using tools such as gpresult or Resultant Set of Policy.

The comparison tool provides the change-level view: what differs between the two GPO backups. Effective-policy tools confirm what ultimately applies to the target.