Gets the permission level for one or more security principals on a specified GPO.
Active Directory · Risk: Low · Documentation Verified
Last verified: 2026-10-26
Microsoft GroupPolicy reference: Gets the permission level for one or more security principals on a specified GPO. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Get-GPPermission. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / GroupPolicy · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-All
Indicates that the cmdlet gets the permission level for each user, group, or computer that has permissions on the GPO.
-DomainName
Specifies the domain for this cmdlet. You must specify the fully qualified domain name (FQDN) of the domain. The GPO specified must exist in this domain. If you don't specify the Domain parameter, the domain of the user that's running the current session is used. If the cmdlet is being run from a computer startup or shutdown script, the domain of the computer is used. For more information, see the Notes section in the full Help. If you specify a domain that's different from the domain of the user that's running the current session (or, for a startup or shutdown script, the computer), a trust must exist between that domain and the domain of the user or the computer. You can also refer to the Server parameter by its built-in alias, domain. For more information, see about_Aliases.
-Guid (required)
Specifies the GPO from which to retrieve the permission level by its globally unique identifier (GUID). The GUID uniquely identifies the GPO. You can also refer to the Guid parameter by its built-in alias, Id. For more information, see about_Aliases.
-Name (required)
Specifies the GPO from which to retrieve the permission level by its display name. The display name isn't guaranteed to be unique in the domain. If another GPO with the same display name exists in the domain an error occurs. You can use the Guid parameter to uniquely identify a GPO. You can also refer to the Name parameter by its built-in alias, DisplayName. For more information, see about_Aliases.
-Server
Specifies the name of the domain controller that this cmdlet contacts to complete the operation. You can specify either the fully qualified domain name (FQDN) or the host name. If you don't specify the name using the Server parameter, the PDC emulator is contacted. You can also refer to the Server parameter by its built-in alias, DC. For more information, see about_Aliases.
-TargetName
Specifies the name of the security principal for which to get the permission level. You can specify a user, a security group, or a computer. You can use either the domain-qualified name of the security principal (domain\account) or just its name. For instance, in the contoso.com domain, to specify: - The username, use contoso\someuser or someuser. - The Domain Admins security group, use contoso\Domain Admins or Domain Admins. - The computer name, use contoso\computer-01 or computer-01.
-TargetType
The type of security principal for which to get the permission level. The acceptable values for this parameter are: - Computer - User - Group
Prerequisites
Windows with the GroupPolicy module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This is a read-oriented cmdlet; protect any sensitive results and check the documented effects of your selected parameters.
Examples
Example 1: Get the permission level for group on the specified GPO
Get-GPPermission -Name "TestGpo" -TargetName "Domain Users" -TargetType Group
This command gets the permission level for the Domain Users group on the GPO named TestGpo. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.