--- title: "RSoP scan option (Windows)" description: "Collect the Group Policy Objects in effect on Windows nodes." product: "Guardian" edition: "Classic" type: "workflow" url: "https://docs.cloudhouse.com/guardian/classic/inventory/monitored/scan-options/enabled-options-rsop/" --- # RSoP scan option (Windows) The Resultant Set of Policy (**RSoP**) feature identifies the Group Policy Objects (**GPO**) in effect on Windows nodes. This feature can be enabled as a scan option for a selected node group. In Guardian, RSoP is treated as a scan item within the **Enabled Options** category that can generate policies, compare differences, identify governance inconsistencies, and integrate information with additional platforms. For more information on the other scan options available to configure, see [Scan Options](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/scan-options/scan-options/index.md). Applies to: `Guardian Classic` !!! warning The **Enabled Options** category is only displayed for top-level Windows/Linux groups. ## Add RSoP via scan options On the **Scan Options** page in the **Monitored** tab (**Inventory** > **Monitored**), you can select different categories in order to customise the scans of your node groups. Each category specifies a particular area of interest that is always checked when a node group is scanned. Here, you can edit the **Enabled Options** category to configure which sections of your node group you want to be scanned, including RSoP. !!! note Alternatively, you can edit the **Enabled Options** category or add other scan options directly within the node group settings page. For more information, see [Edit Node Group](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/node-groups/settings/edit-node-group/index.md). To add RSoP to a node group's scan options, complete the following steps: 1. In the Guardian web application, navigate to the **Monitored** tab. By default, all currently monitored nodes are displayed within the 'All Nodes' node group. ![Monitored tab](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/scan-options/monitored-tab.png) !!! note If you want to display the list of monitored nodes contained within a different node group, select a node group from the **Node Groups** drop-down menu. ![](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/scan-options/node-groups-dropdown-menu.png) 2. Select the node you want to edit from the list of monitored nodes. The node scan results page is displayed. 3. Click the **Edit** drop-down and select **Scan Options**. The **Scan Options** page is displayed. ![Edit scan options rsop](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/scan-options/edit-scan-options-rsop.png) 4. Select the node group you want to add RSoP to from the list of **Node Groups**. !!! warning By default, the 'All Nodes' node group is displayed. However, scan options on the 'All Nodes' node group are not available to edit. Select a different node group to edit the corresponding scan options. ![](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/scan-options/node-groups-rsop.png) 5. Select **Enabled Options** from the list of **Categories**. The node sections to be scanned are displayed. ![Enabled options rsop category](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/scan-options/enabled-options-rsop-category.png) 6. Here, select 'Yes' from the **RSoP** drop-down list item to add this to your scan preferences. ![Rsop enabled yes](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/scan-options/rsop-enabled-yes.png) !!! note Optionally, next to the RSoP drop-down list, you can set a priority number in the field provided, from 1 - 1000, '1' being the highest priority. By default, if a scan option does not have a priority value set, then it defaults to '1000'. For more information on how you can set a custom priority for a file scan option, see [Custom Order of Precedence](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/scan-options/scan-options/index.md#custom-order-of-precedence). 7. Once complete, click the **Save** button to add the RSoP section to your node group's scan options. Once you add or edit an item from the **Categories** section, the scan options are saved and applied to the selected node group the next time the nodes are scanned. RSoP results are then displayed in the scan results page where you can generate policies, compare differences, identify governance inconsistencies, and integrate information with additional platforms. For more information on how you can analyse results and configure the output to access the data you require, see [Node Scan Results](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/nodes/node-scan-results/index.md). ![Rsop results](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/inventory/monitored/scan-options/rsop-results.png) ## Troubleshooting If you are experiencing issues with adding RSoP to your node group's scan options, try the following: - If you can’t see the RSoP section in the scan results page or if the section is empty, check the Connection Manager or agent logs at `C:\Program Files\Guardian\logs`. - If the following warning 'The user [...] does not have RSoP data' is displayed, it means the user account the Agent or service is running under doesn't have access to any valid RSoP data to generate valid results. - You can alter the user the Guardian service runs under by right clicking the Guardian service in the **Services** window, selecting **Properties** and altering the user the service is run as. - If the following warning message is displayed after a scan, 'Cannot find path `C:\Windows\Temp...\RSOPReport` because it does not exist.' it means that the user the Guardian service is being run under doesn't have access to enough RSoP data to generate a valid report. !!! note Windows Agent version 4.21.0 onwards replaces this error message with an empty RSoP section in the resulting scan and a warning message indicating that the particular user doesn’t have access to RSoP data.