gpresult
Displays the Resultant Set of Policy (RSoP) information for a remote user and computer. Windows commands reference
On Windows 1 Sigma rule name it File gpresult.exe
Windows
Displays the Resultant Set of Policy (RSoP) information for a remote user and computer. To use RSoP reporting for remotely targeted computers through the firewall, you must have firewall rules that enable inbound network traffic on the ports.
gpresult [/s <system> [/u <username> [/p [<password>]]]] [/user [<targetdomain>\]<targetuser>] [/scope {user | computer}] {/r | /v | /z | [/x | /h] <filename> [/f] | /?}gpresult /s srvmain /user maindom\targetuser /scope user /rgpresult /s srvmain /user maindom\targetuser /z > policy.txtgpresult /s srvmain /u maindom\hiropln /p p@ssW23 /r/s <system>Specifies the name or IP address of a remote computer. Don't use backslashes. The default is the local computer./u <username>Uses the credentials of the specified user to run the command. The default user is the user who is signed in to the computer that issues the command./p [<password>]Specifies the password of the user account that is provided in the /u parameter. If /p is omitted, gpresult prompts for the password. The /p parameter can't be used with /x or /h./user [<targetdomain>\]<targetuser>]Specifies the remote user whose RSoP data is to be displayed./scope {user | computer}Displays RSoP data for either the user or the computer. If /scope is omitted, gpresult displays RSoP data for both the user and the computer.[/x | /h] <filename>Saves the report in either XML (/x) or HTML (/h) format at the location and with the file name that is specified by the filename parameter. Can't be used with /u, /p, /r, /v, or /z./fForces gpresult to overwrite the file name that is specified in the /x or /h option./rDisplays RSoP summary data./vDisplays verbose policy information. This includes detailed settings that were applied with a precedence of 1./zDisplays all available information about Group Policy. This includes detailed settings that were applied with a precedence of 1 and higher./?Displays help at the command prompt.