COMMAND EVERYTHING.

Get-GPInheritance

Gets Group Policy inheritance information for a specified domain or OU.

Active Directory · Risk: Low · Documentation Verified

Last verified: 2026-10-26

Microsoft GroupPolicy reference: Gets Group Policy inheritance information for a specified domain or OU. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Get-GPInheritance [-Target] <String> [-Domain <String>] [-Server <String>] [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Get-GPInheritance. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / GroupPolicy · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-Domain: Specifies the domain for this cmdlet. You must specify the fully qualified domain name (FQDN) of the domain. For the Get-GPInheritance cmdlet, this is typically the domain of the container (domain or OU) for which you want to retrieve inheritance information. If the specified domain is different than the domain of the container, a trust must exist between the two domains. If you do not specify the Domain parameter, the domain of the user that is running the current session is used. If the cmdlet is being run from a computer startup or shutdown script, the domain of the computer is used. For more information, see the Notes section in the full Help. If you specify a domain that is different from the domain of the user that is running the current session (or, for a startup or shutdown script, the computer), a trust must exist between that domain and the domain of the user or the computer. You can also refer to the Domain parameter by its built-in alias, DomainName. For more information, see about_Aliases.
-Server: Specifies the name of the domain controller that this cmdlet contacts to complete the operation. You can specify either the fully qualified domain name (FQDN) or the host name. If you do not specify the name by using the Server parameter, the primary domain controller (PDC) emulator is contacted. You can also refer to the Server parameter by its built-in alias, DC.
-Target (required): Specifies the domain or the OU for which to retrieve the Group Policy inheritance information by its Lightweight Directory Access Protocol (LDAP) distinguished name. For instance, the MyOU organizational unit in the contoso.com domain is specified as ou=MyOU,dc=contoso,dc=com. You can also refer to the Target parameter by its built-in alias, Path.

Prerequisites

Windows with the GroupPolicy module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This is a read-oriented cmdlet; protect any sensitive results and check the documented effects of your selected parameters.

Examples

Example 1: Get Group Policy inheritance information for a specific OU

Get-GPInheritance -Target 'ou=MyOU,dc=contoso,dc=com'

This command gets Group Policy inheritance information for the OU named MyOU in the contoso.com domain. The GpoLinks property contains a list of all the GPOs that are linked directly to the GPO, whether their links are enabled or not. The InheritedGpoLinks property contains a list of all the GPOs that are applied when Group Policy is processed on the client. TestGPO-2 and TestGPO-3 appear in this list because their links are enabled. The Default Domain Policy GPO is inherited from the contoso.com domain. If inheritance is blocked, it does not appear in the InheritedGpoLinks property unless its link is enforced at the domain. If its link is enforced, it appears first in the list. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/GroupPolicy/Get-GPInheritance.md

https://learn.microsoft.com/powershell/module/grouppolicy/get-gpinheritance?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands

Get-ADComputer

Get-ADGroup

Get-ADGroupMember

Get-ADPrincipalGroupMembership