Resultant Set of Policy

Resultant Set of Policy (RSoP) is an addition to Group Policy, and it is an integral part of Change and Configuration Management. RSoP gathers information from Active Directory, Group Policy, and IntelliMirror to help reduce the amount of troubleshooting for Group Policy objects (GPO). It tests policy implementation, software installation deployment scenarios, and script deployment.

  • Before running RSoP, see Checklist: Preparing to run RSoP.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For troubleshooting information, see Troubleshooting.


Checklist: Preparing to run RSoP

For logging mode

Step | Reference
Verify that the NTFS file system is installed. |
Configure Local Policy. | Local Group Policy
Configure Group Policy. | To open Group Policy from Active Directory Users and Computers


How to...

  • Access RSoP data for an existing computer and user (logging mode)
  • Run the gpresult tool
  • View an RSoP report in HTML
  • Manage Resultant Set of Policy
  • View policy settings with RSoP


Access RSoP data for an existing computer and user (logging mode)

Microsoft Windows graphic

To access RSoP data for an existing computer and user (logging mode)

  1. Open Microsoft Management Console.
  2. On the File menu, click Add/Remove Snap-in.
  3. On the Standalone tab, click Add.
  4. In the Add Standalone Snap-in dialog box, click Resultant Set of Policy, and then click Add.
  5. In the Resultant Set of Policy Wizard, click Next.
  6. Click Logging mode, and then click Next. (Do not click Planning mode).
  7. On the Browse Existing Data page, click a target computer. To search for another computer, click Another computer, and then click Browse. When the information is complete, click Next.
  8. On the Browse Existing Data page, click a target user, and then click Next.
  9. On the Finished Gathering Resultant Set of Policy Data page, click Finish, and then wait for processing to complete.
  10. In the Add Standalone Snap-in dialog box, click Close.
  11. In the Add/Remove Snap-in dialog box, click OK.
  12. Click the RSoP folders in the console tree to view the data.

Notes

  • To open Microsoft Management Console, click Start, click Run, type mmc, and then press ENTER.
  • Only users and computers that have logged on to the domain are visible.
  • To run RSoP for an existing user and computer, you must either be logged on to the local computer as a user or be a member of the local administrators group, a domain administrator, or an enterprise administrator, or you must have delegated RSoP authority over the organizational unit that contains the computer accounts and user accounts.
  • Planning mode is reserved for a future release.

Related Topics


Run the gpresult tool

Microsoft Windows graphic

To run the gpresult tool

  1. Open Command Prompt.
  2. Type gpresult /z >gp.txt to redirect the output to a text file.
  3. Type notepad gp.txt to open the file.

Notes

  • To open the command prompt, click Start, click Run, type cmd, and then click OK.
  • To view a list of all the command-line parameters, see Related Topics.

Related Topics


View an RSoP report in HTML

Microsoft Windows Graphic

View an RSoP report in HTML

  1. Click Start, and then click Help and Support.
  2. Under Pick a task, click Use tools to view your computer information and diagnose problems.
  3. Under Tools, click Advanced System Information.
  4. Under Advanced System Information, click View Group Policy settings applied.
  5. Scroll to the results that you want to view.
  6. Click the arrow in the upper-right corner of a category to hide details.

Related Topics


Manage Resultant Set of Policy

  • Save an RSoP query
  • Save the data from an RSoP query
  • Reuse an existing RSoP query


Save an RSoP query

Microsoft Windows graphic

To save an RSoP query

  1. After you have created a query, on the File menu, click Save.
  2. In the File name box, type the name of the file, and then click Save.

Notes

  • You cannot save a console that you open from Active Directory Users and Computers or from Active Directory Sites and Services.
  • The saved query file has an .msc extension.

Related Topics


Save the data from an RSoP query

Microsoft Windows graphic

To save the data from an RSoP query

  1. From within an existing RSoP query, in the console tree click Console Root, and then in the details pane double-click user account on computer account - RSoP.
  2. On the View menu, click Archive data in console file.
  3. On the File menu, click Save.
  4. In File name, type a name for the file, and then click Save.

Notes

  • You cannot save a console that was started from Active Directory Users and Computers or from Active Directory Sites and Services.
  • The saved file has an .msc extension.

Related Topics


Reuse an existing RSoP query

Microsoft Windows graphic

To reuse an existing RSoP query

  1. Open Microsoft Management Console.
  2. On the File menu, click Open.
  3. In the Open dialog box, click the previously saved query, and then click Open.
  4. Click the folders in the console tree to view the data.

Note

  • To open Microsoft Management Console, click Start, click Run, type mmc, and then press ENTER.

Related Topics


View policy settings with RSoP

  • View individual policy settings with RSoP
  • View a list of all Group Policy objects that are associated with an RSoP query
  • View the scope of management that is associated with an RSoP query
  • View Group Policy object revision information in RSoP


View individual policy settings with RSoP

Microsoft Windows graphic

To view individual policy settings with RSoP

  1. Open an RSoP query. The query results are visible in the details pane of the Microsoft Management Console.
  2. In the console tree, double-click user account on computer account - RSoP, and then click the folders under it. The individual policy settings are visible in the details pane.

Notes

  • To open RSoP, see Related Topics.
  • See Related Topics for explanations of the Software Settings, Windows Settings, Administrative Templates, and Extra Registry Settings folders and their contents.

Related Topics


View a list of all Group Policy objects that are associated with an RSoP query

Microsoft Windows graphic

To view a list of all Group Policy objects that are associated with an RSoP query

  1. Open an RSoP query. The query results are visible in the details pane of the Microsoft Management Console.
  2. Right-click Computer Configuration or User Configuration, and then click Properties.
  3. On the General tab, select the Display all GPOs and filtering status check box.

    The list of Group Policy objects appears in the Group Policy Object column. Filtering status appears in the Filtering column as either Applied or Not Applied (Empty).

Notes

  • To open RSoP, see Related Topics.
  • The list includes Group Policy objects that are not applied to the object that is queried.

Related Topics


View the scope of management that is associated with an RSoP query

Microsoft Windows graphic

To view the scope of management that is associated with an RSoP query

  1. Open an RSoP query. The query results are visible in the details pane of the Microsoft Management Console.
  2. Right-click Computer Configuration or User Configuration, and then click Properties.
  3. On the General tab, select the Display scope of management check box.

    4. The CNAME of each Group Policy object in Active Directory appears in the Scope of Management column.

Note

  • To open RSoP, see Related Topics.

Related Topics


View Group Policy object revision information in RSoP

Microsoft Windows graphic

To view Group Policy object revision information in RSoP

  1. Open an RSoP query. The query results are visible in the details pane of the Microsoft Management Console.
  2. Right-click Computer Configuration or User Configuration, and then click Properties.
  3. On the General tab, select the Display revision information check box.

    4. The location of the revision information appears in the Revision column.

Note

  • To open RSoP, see Related Topics.

Related Topics


Concepts

This section provides general background information about Resultant Set of Policy (RSoP).

  • Logging mode
  • RSoP results
  • Understanding RSoP


Logging mode

Resultant Set of Policy (RSoP) logging mode helps administrators review existing policy, software installation applications, and security.

Logging mode is most helpful in the following situations:

  • You want to discover failed or overwritten policy settings.
  • You want to see how security groups affect policy settings.
  • You want to discover how local policy is affecting group policies.

Occasionally, you might want to poll the system to help with a deployment problem or to find a security leak. To do this, you must tell RSoP on which user account and computer account the problem exists.

When you execute an RSoP query, RSoP reports each of the applications that are available for installation, which folders will be redirected (and to where), and each policy setting that will be applied to the user or computer, as well as what the security group’s effect on those policies is. By using RSoP, you can see if there are any problems.

For example, "Always install with elevated privileges" in the Group Policy template might be set to Disabled, while at the same time Software Installation attempts to install into directories to which the user does not have access. Because RSoP reports this, the amount of time you spend troubleshooting the problem is reduced.

For more information, see:

  • Access RSoP data for an existing computer and user (logging mode)
  • View individual policy settings with RSoP


RSoP results

This section covers:

  • Software Settings results
  • Windows Settings results
  • Administrative Templates results
  • Extra Registry Settings results
  • HTML RSoP results


Software Setting results

Microsoft Windows Graphic

Software Settings results

You can view the Resultant Set of Policy (RSoP) results for Software Settings in the details pane of the Microsoft Management Console (MMC). In the details pane for Software Settings, there are five default columns, as described in the following table.

Column | Information
Name | Name of the deployed package
Version | Software version of the deployed package
Deployment state | Indicates whether the package is assigned or published
Source | Source location of the deployed package
Origin | Name of the Group Policy object that deployed the package

To add more columns to the details pane for Software Settings results

  1. Right-click in the details pane, point to View, and then click Add/Remove Columns.
  2. In the Available columns box, click the columns that you want, and then click Add.
  3. When all the columns that you want appear in the Displayed columns box, click OK. The columns that you add appear in the details pane for Software Settings.

There are three buttons for Software Settings at the top of the details pane, as described in the following table.

Button | Function
Installed applications | Lists all installed applications
Available applications | Lists all available applications
Removed applications | Lists all removed applications

For information about other RSoP results, see:

  • Windows Settings results
  • Administrative Templates results
  • Extra Registry Settings results
  • HTML RSoP results


Windows Settings results

You can view the Resultant Set of Policy (RSoP) results for Windows Settings in the details pane of the Microsoft Management Console (MMC). Windows Settings contains three possible subcategories:

  • Scripts results
  • Internet Explorer Maintenance results
  • Security Settings results

Scripts results

There are four default columns in the details pane, as described in the following table.

Column | Information
Name | Name of the script
Parameters | Lists any parameters that are assigned to the script
Last Executed | Date that the script was last run
GPO Name | Name of the Group Policy object that assigned the script

Internet Explorer Maintenance results

The Internet Explorer Maintenance results appear the same way that they do for Group Policy, except that there is a Precedence tab, or sometimes more than one Precedence tab.

The Precedence tab indicates which Group Policy objects affect this setting, in order from newest to oldest.

Security Settings results

The Security Settings results in Windows Settings under Computer Configuration appear the same way that they do for Group Policy, except that when you double-click the setting, there is a Security tab and a Precedence tab.

Tab | Information
Security | Similar in appearance to Group Policy, but unavailable
Precedence | Indicates Group Policy object precedence, from newest to oldest

For information about other RSoP results, see:

  • Software Settings results
  • Administrative Templates results
  • Extra Registry Settings results
  • HTML RSoP results


Administrative Templates results

You can view the Resultant Set of Policy (RSoP) results for Administrative Templates in the details pane of the Microsoft Management Console (MMC). The details pane appears the same way that it does for Group Policy, except that only those settings that have been changed from the default setting appear and there is one more column, which is described in the following table.

Column | Information that the column contains
GPO Name | Name of the last Group Policy object affecting this policy setting

To view more information about a setting, in the details pane double-click the setting. A dialog box appears with three tabs, which are described in the following table.

Tab | Information that the tab contains
Setting | Similar in appearance to Group Policy, but unavailable
Explain | Describes what this policy setting does
Precedence | Indicates Group Policy object precedence, from newest to oldest

For information about other RSoP results, see:

  • Software Settings results
  • Windows Settings results
  • Extra Registry Settings results
  • HTML RSoP results


Extra Registry Settings results

You can view the Resultant Set of Policy (RSoP) results for Extra Registry Settings in the details pane of the Microsoft Management Console (MMC). Extra Registry Settings is a collection of policy-based registry settings that do not have an administrative template associated with them. Because there is no association with an administrative template, there is no explanation of the setting except for the following items:

  • The registry key
  • The Group Policy object that set the key

For information about other RSoP results, see:

  • Software Settings results
  • Windows Settings results
  • Administrative Templates results
  • HTML RSoP results


HTML RSoP results

The HTML report of Resultant Set of Policy (RSoP) results displays general information for the following categories:

  • User name and associated domain
  • Computer name, associated domain, and current site
  • Security group memberships for the computer and user
  • The last time that policy was applied and where it was applied from

It also displays details for the following categories:

  • Scripts: Logon, Logoff, Startup, Shutdown
    • Name
    • Parameters
    • Source GPO
  • Folder Redirection
    • Name of folder
    • Redirected path
    • Type
    • Source GPO
  • Software Installation (installed software and software that is available in Add or Remove Programs)
    • Name
    • Version
    • Source Path
    • Type
    • Source GPO
  • Registry Settings
    • Location
    • Keyname
    • Value

Note

  • The results of the HTML request for RSoP information are obtained from RSoP logging mode.

For information about other types of RSoP results, see:

  • Software Settings results
  • Windows Settings results
  • Administrative Templates results
  • Extra Registry Settings results


Understanding RSoP

Resultant Set of Policy (RSoP) is an addition to Group Policy that makes policy implementation and troubleshooting easier. RSoP is a query engine that polls existing policies, and then reports the results of the query. It polls existing policies based on site, domain, domain controller, and organizational unit. RSoP gathers this information from the CIMOM database (commonly referred to as "WMI").

In addition to checking the policies set by Group Policy, RSoP also checks Software Installation for any applications that are associated with a particular user or computer and reports the results of these queries as well. RSoP details all the policy settings that are configured by an administrator. This includes Administrative Templates, Folder Redirection, Internet Explorer Maintenance, Security, and Scripts.

When policies are applied on multiple levels (e.g., site, domain, domain controller, and organizational unit), the results can be in conflict. If a conflicting policy is set, it can be difficult to track down and change. RSoP can help you determine the final set of policies that are applied and track down policy precedence, making troubleshooting easier.

For more information, see:

  • RSoP, IntelliMirror, the CIMOM database, and WMI
  • RSoP, Active Directory, and policy precedence
  • RSoP, Group Policy, and Software Installation
  • RSoP and security issues
  • Gpresult (gpresult.exe)


RSoP, IntelliMirror, the CIMOM database, and WMI

IntelliMirror is a set of features for desktop change and configuration management. IntelliMirror combines the advantages of centralized computing with the performance and flexibility of distributed computing.

Resultant Set of Policy (RSoP) interacts with several IntelliMirror features:

  • Active Directory (For more information, see RSoP, Active Directory, and policy precedence.)
  • Group Policy (For more information, see RSoP, Group Policy, and Software Installation.)
  • CIMOM database and WMI

RSoP takes advantage of one of these features in particular: the CIMOM database.

When a computer logs on to a network, information, such as information about the computer's hardware, software installation settings, Internet Explorer maintenance settings, scripts, folder redirection settings, and security settings, is written to the CIMOM database (commonly referred to as "WMI"). When you start RSoP in logging mode, it takes a mirror image of this database, checks it, and reports the Group Policy settings that are applied.

RSoP and Windows Firewall

In Microsoft Windows XP Service Pack 2, the Windows Firewall feature is on by default. Incoming requests against unopened ports are blocked by Windows Firewall. This blocking impacts the use of RSoP across the network. Requests originating from the local computer are not affected. For information about opening the required ports through the firewall, see Changes to Functionality in Microsoft Windows XP Service Pack 2 (http://www.microsoft.com/).

For more information, see Understanding RSoP.


RSoP, Active Directory, and policy precedence

The Active Directory directory service catalogs information about all the objects on a network (including users, computers, and printers), and it distributes the information throughout the network. For example, you can search Active Directory for a printer that prints in color and that is located near your computer, a group of users who are managed by a particular individual, or a shared folder to which a unique keyword has been assigned.

Group Policy uses Group Policy objects (GPO) in Active Directory to store settings for computers and users, and it affects those computers and users by giving an administrator the ability to:

  • Deploy registry keys (Administrative Templates)
  • Deploy software (Software Installation)
  • Deploy security: Safer, IPSec (Security)
  • Deploy scripts: Logon, Logoff, Startup, Shutdown (Scripts)
  • Configure the browser (Internet Explorer Maintenance)

After a policy is set for an object, it is applied the next time that object logs on to the domain. When an object logs on to the network, the policy settings are applied in this specific order:

  • Organizational unit policy
  • Domain controller policy (if the domain controller is left in the domain controller container)
  • Domain-level policy
  • Site-level policy
  • Local policy

A GPO can overwrite attributes that have been set by a previously applied GPO. In addition, an administrator can set policy by site or domain to contain a "no overwrite" attribute so that a particular GPO is applied last, which prevents other policies from overwriting it.

When a GPO overwrites a previously applied GPO's settings, it has precedence over that GPO. When a GPO has a "no overwrite" attribute, it has precedence over all policies that are applied subsequently. RSoP follows these steps of policy application and keeps track of each GPO's level of precedence. In this way, policy precedence can be tracked and, if it is causing unexpected results, it can be addressed.

For more information, see Understanding RSoP.


RSoP, Group Policy, and Software Installation

To use Resultant Set of Policy (RSoP) effectively, it is recommended that you review how Group Policy stores policy settings and how the logon process uses those settings.

Group Policy determines how programs, network resources, and the operating system behave for users and computers in an organization. Using objects in Active Directory, Group Policy changes the values of entries in the registry. When users start their computers, the computers load those settings automatically. When nonregistry changes are made, extensions to Group Policy convert certain data types and set values for them on the client computers. After this, the computers write those settings to the Common Information Management Object Model (CIMOM) database. RSoP is a query engine that checks the existing policy settings for an object as they are listed in the CIMOM database. RSoP then reports those settings in a form that is very similar in appearance to Group Policy. This process, in which RSoP polls an existing user and computer to report the existing policy, is called "logging mode." For more information, see Logging mode.

A significant part of Group Policy is the software settings extensions, which monitor the Software Installation service. When RSoP generates a report, the part of Group Policy that displays the Software Installation service shows which applications are available for any given user or computer, as well as any software setting changes that are advertised or applied. By clarifying for you all the software that is available for a given user, as well as updates and configuration changes, RSoP makes deployment scenario planning and implementation easier.

For more information, see Understanding RSoP.


RSoP and security issues

There are three areas in which Resultant Set of Policy (RSoP) can help you with security issues:

  • Security Templates
  • Group Policy filtering
  • Individual security settings

Security Templates

Security Templates is a tool for creating and assigning security templates for one or more computers. A security template is a file representation of a security configuration. It can be applied to a local computer or it can be imported to a Group Policy object (GPO) in Active Directory. When you import a security template to a GPO, Group Policy processes the security template and makes the corresponding changes to the members of that GPO, which can be users or computers.

RSoP verifies those changes. By polling the system and displaying the resultant policy, RSoP indicates a misapplied or overwritten policy setting and the policy's precedence, which enables you to fix a security breach.

For more information, see Administrative Templates.

Group Policy filtering

Administrators can use security groups to further refine which computers and users a GPO influences. For any GPO, administrators can filter it on computers that are members of specified security groups. Because RSoP takes security groups into consideration, the RSoP report reflects those security groups.

For more information, see Using security groups to filter Group Policy.

Individual security settings

Administrators can define a security policy in Active Directory that contains specific security settings for any and all security areas. They can also establish a security policy on a local computer. When there are conflicts, security settings that are defined in Active Directory always override any security settings that are defined locally. You can use RSoP to view the resulting policy for any user or computer.

RSoP and Windows Firewall

In Microsoft Windows XP Service Pack 2, the Windows Firewall feature is on by default. Incoming requests against unopened ports are blocked by Windows Firewall. This blocking impacts the use of RSoP across the network. Requests originating from the local computer are not affected. For information about opening the required ports through the firewall, see Changes to Functionality in Microsoft Windows XP Service Pack 2 (http://www.microsoft.com/).

For more information, see:

  • Security setting descriptions
  • Understanding RSoP


Gpresult (gpresult.exe)

Gpresult is a command-line tool that you run on the computer on which you want to test Group Policy. Gpresult provides general information about the operating system, user, and computer, as described in the following sections.

Operating system

  • Type: Windows 2000 Professional, Windows XP Professional, Windows 2000 Server, domain controller
  • Build number and Service Pack details
  • Whether Terminal Services is installed and, if so, the mode that it is using

User information

  • User name and location in Active Directory (if applicable)
  • Domain name and type (Windows 2000 or Windows NT)
  • Site name
  • Whether the user has a local profile or a roaming profile, and the location of the profile
  • Security group membership
  • Security privileges

Computer information

  • Computer name and location in Active Directory (if applicable)
  • Domain name and type (Windows 2000 or Windows NT)
  • Site name
  • Policy application information

Gpresult also provides the following information about Group Policy:

  • The last time that policy was applied and the domain controller that applied policy—for the user and for the computer
  • The complete list of applied Group Policy objects (GPO) and their details, including a summary of the extensions that each GPO contains
  • Registry settings that are applied and their details
  • Folders that are redirected and their details
  • Software management information, including details about assigned and published applications
  • Disk quota information
  • Internet Protocol Security (IPSec) settings
  • Scripts

For step-by-step instructions on running gpresult, see To run the gpresult tool.

For command-line switches and parameters, see Gpresult.


Troubleshooting

This section covers:

  • Error messages for RSoP
  • Information gathering


Error messages for RSoP

The Active Directory query for the specified user failed.

Cause: The search for the user failed. Possible causes include the following:

  • The domain controller that holds this object is unavailable.
  • Network problems are preventing completion of the request.
  • The client does not have access to the Read properties of the object that is queried.

Solution:

  1. Verify that the domain controller is available.
  2. Check the network connections, responses, and throughput.
  3. Verify that the client has access to the Read properties of the object that is queried.

The Active Directory query for the specified computer failed.

Cause: The search for the computer failed. Possible causes include the following:

  • The domain controller that holds this object is not responding to requests for information.
  • Network problems are preventing completion of this request.
  • The client does not have access to the Read properties of the object that is queried.

Solution:

  1. Verify that the domain controller is available.
  2. Check the network connections, responses, and throughput.
  3. Verify that the client has access to the Read properties of the object that is queried.

The Active Directory query for the specified user container failed.

Cause: The search for the user container failed. Possible causes include the following:

  • The domain controller that holds this object is unavailable.
  • Network problems are preventing completion of this request.
  • The client does not have access to the Read properties of the object that is queried.

Solution:

  1. Verify that the domain controller is available.
  2. Check the network connections, responses, and throughput.
  3. Verify that the client has access to the Read properties of the object that is queried.

The Active Directory query for the specified computer container failed.

Cause: The search for the computer container failed. Possible causes include the following:

  • The domain controller that holds this object is not responding to requests for information.
  • Network problems are preventing completion of this request.
  • The client does not have access to the Read properties of the object that is queried.

Solution:

  1. Verify that the domain controller is available.
  2. Check the network connections, responses, and throughput.
  3. Verify that the client has access to the Read properties of the object that is queried.

The selected computer currently does not have RSoP logging enabled. Do you want to continue?

Cause: The client is trying to poll a computer that does not have the "Turn off Resultant Set of Policy logging" policy setting disabled.

Solution: Disable the "Turn off Resultant Set of Policy logging" policy setting.

The RSoP snap-in was unable to enumerate the users on the selected computer due to the error listed below.

Cause: The RSoP tool cannot enumerate a list of users on a specific domain controller, usually because the client user does not have Read permissions for that domain controller.

Solution: Try a different domain controller, or get Read permissions for the user.

The selected computer does not support RSoP logging. RSoP logging support is available in operating system releases after Windows 2000.

Cause: The client is trying to poll a computer with Windows 2000, and Windows 2000 does not support RSoP logging.

Solution: Poll a different computer, or update the computer to Windows XP Professional.

For more information about error messages, see Information gathering.


Information gathering

RSoP does not show the path of a script.

Cause: A script that is specified in a Group Policy object (GPO) without an explicit path is stored in the GPO.

Solution: The name of the script that is displayed in RSoP is the GPO name, followed by the script name. To locate the script and view its path, open Group Policy, select the GPO in question, and look in the Scripts folders under Windows Settings for either Computer Configuration or User Configuration.

See also: Scripts.

RSoP does not list an execute time for scripts.

Cause: RSoP shows a blank execution time for one of two reasons:

  1. A script has failed to run. If this is the case, an entry appears in the Application event log, with the script name and the reason for the failure.
  2. The script has not run yet.

An "access denied" message appears persistently.

Cause: The person who is running the query does not have access to either the Container/User account or the Container/Computer account or both.

Solution: Have someone with RSoP authority over the object in question delegate RSoP authority to the person who is running the query.

When "Display all GPOs and filter status" is selected, it displays a group of numbers for the Group Policy object (GPO) name and its status is "Disabled."

Cause: A GPO that was linked to from this container has been deleted, but the link still exists.

Solution: Delete the GPO link from the container that is being queried.

See also: To view a list of all Group Policy objects that are associated with an RSoP query.

RSoP data cannot be retrieved across the network from clients running Windows XP Service Pack 2.

Cause: In Microsoft Windows XP Service Pack 2, the Windows Firewall feature is on by default. Incoming requests against unopened ports are blocked by Windows Firewall. This blocking impacts the use of RSoP across the network. Requests originating from the local computer are not affected.

Solution: You must open specific ports through the firewall in order for RSoP to work.

See also: Changes to Functionality in Microsoft Windows XP Service Pack 2 (http://www.microsoft.com/).

For more information, see Error messages for RSoP.