List all GPOs applied to every user in the AD

Question

Hi,
I would like to generate a report with the GPOs applied to every user and every computer in the AD. The output will be like:
users_gpo.csv:
user1;gpo1,gpo2;gpo3
computers_gpo.csv:
computer1;gpo4,gpo5,gpo6
How I can do it using Powershell or some automatic tool?.
I tried it with gpresult but it only works if the user has a profile on the target system.
Thanks!

Answer 1

Finally, It works for computers:
Write-Host "Computers" -ForegroundColor Green
$computers = Get-ADComputer -Filter * -Properties 'Name' | Select 'Name'
$namespace = "root\rsop\computer"
foreach ($computer in $computers){
    Write-host $computer.Name -ForegroundColor Yellow
    Try {
        Get-WmiObject -Namespace $namespace -Class RSOP_GPLink -Filter "AppliedOrder <> 0"  -ComputerName $computer.Name -ErrorAction Stop | Foreach-Object {
            $GPO_FILTER = $_.GPO.ToString().Replace("RSOP_GPO.","")
            #$linkOrder = $_.linkOrder
            #$appliedOrder = $_.appliedOrder
            $Enabled = $_.Enabled
            #$noOverride = $_.noOverride
            #$SourceOU = $_.SOM
            #$somOrder = $_.somOrder
            if ($enabled){
                Get-WmiObject -Namespace $namespace -Class RSOP_GPO -Filter $GPO_FILTER -ComputerName $computer.Name -ErrorAction Stop | Foreach-Object {
                    Write-host "`t" $_.Name
    Catch [System.UnauthorizedAccessException]{
        Write-host "Unauthorized Access" -ForegroundColor Red
    Catch [Exception]{
        if ($_.Exception.GetType().Name -eq "COMException") {
            Write-host "`tServer unavailable" -ForegroundColor Red
    Write-host ""
But It doesn't work for users:
Write-Host "Users" -ForegroundColor Green
$users = Get-ADUser -Filter * -Properties 'Name' | Select 'Name', 'SID'
$namespaceBase = "root\rsop\user\"
foreach ($user in $users){
    Write-host $user.Name -ForegroundColor Yellow
    $namespace = $namespaceBase + $user.SID -replace '-', '_'
    Write-host $namespace -ForegroundColor Gray
    Try {
        Get-WmiObject -Namespace $namespace -Class RSOP_GPLink -Filter "AppliedOrder <> 0" -ErrorAction Stop | Foreach-Object {
            $GPO_FILTER = $_.GPO.ToString().Replace("RSOP_GPO.","")
            Write-host "`t" $GPO_FILTER
            #$linkOrder = $_.linkOrder
            #$appliedOrder = $_.appliedOrder
            $Enabled = $_.Enabled
            #$noOverride = $_.noOverride
            #$SourceOU = $_.SOM
            #$somOrder = $_.somOrder
            if ($enabled){
            Get-WmiObject -Namespace $namespace -Class RSOP_GPO -Filter $GPO_FILTER -ErrorAction Stop | Foreach-Object {
                    Write-host "`t" $_.Name
    Catch [System.UnauthorizedAccessException]{
        Write-host "Unauthorized Access" -ForegroundColor Red
    Catch {
        Write-Host "`t$_" -ForegroundColor Red
    Write-host ""
It is working for some user but not for all, part of the output is:
test test. test
root\rsop\user\S_1_5_21..._1231
LocalGPO
Default Domain Policy
gpoguy gpoguy
root\rsop\user\S_1_5_21_..._1232
Invalid namespace
Why I get "Invalid namespace"?
Thanks Martin!