# GPO comparison contract

## Microsoft evidence reviewed on 2026-09-06

- [Microsoft Security Compliance Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=55319): official PolicyAnalyzer.zip, bundled **Policy Analyzer.pdf**, version 4.0, pages 1 and 6. Read directly from the official ZIP in memory; no executables run.
- [Policy Analyzer introduction](https://techcommunity.microsoft.com/blog/microsoft-security-baselines/new-tool-policy-analyzer/701049).
- [ControlPolicyConflict / MDMWinsOverGP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict).
- [Windows Hello for Business policy conflicts](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/configure#policy-conflicts-from-multiple-policy-sources).

Policy Analyzer distinguishes differing configured values from absent settings. Repeated definitions of the same setting are indicated separately. The comparison retains registry data types: a numeric 5 and a text "5" differ. It can compare policy sets and local effective state; the latter is a separate operation.

## User-facing outcomes

| Outcome | Evidence required |
| --- | --- |
| Fail / Misconfigured | Explicit Microsoft recommendation and a persisted deterministic mismatch. A missing required key or typed empty value is a mismatch; ordinary missing value recommendations remain Not configured. |
| Not configured | Explicit nonempty Microsoft recommendation and a missing customer setting; informational, excluded from Fail and Deviation. |
| Pass | Explicit Microsoft recommendation and a persisted deterministic match. For Registry.pol deletion requirements, target absence in the analyzed backup set is an explicit matching state. |
| Conflicts | Multiple distinct typed customer values for the same setting, or explicitly recorded contradictory recommendations within one baseline set. |
| Duplicates | Multiple source entries configuring the same setting to the same typed value. |

Registry addresses include computer/user scope (implicit HKLM/HKCU in Registry.pol), key and value name. Address matching ignores case; value data retains case and type. Different value names under the same key are distinct settings. Native security-template and advanced-audit settings use their resolved identities. Assessments and projects are never merged for collision detection.

Registry.pol `delete-value`, `delete-all-values` and `create-key` are compared as typed target states rather than discarded as missing values. A typed empty string remains a present value. These rules describe only the imported backup configuration; local effective state remains a separate Policy Analyzer operation and requires separate evidence.

Microsoft also calls configured differences *between* policy sets conflicts. ASSESSOR labels configured customer-versus-benchmark mismatches Fail. The user's 2026-09-06 correction replaces the earlier four-outcome contract: missing settings remain a separate informational outcome. GPO Deviation includes only Misconfigured, not Conflicts, Duplicates, missing values or review-only records. Other scanner deviation semantics remain unchanged. A conflict in the imported set is not a claim that both settings apply to the same endpoint: GPO backup analysis does not establish resultant policy.

One baseline comparison creates one Work row with all source references. One customer collision group creates one Conflicts/Duplicates row. A duplicate group may also have a separate Pass/Fail benchmark result; these are different questions. Multiple benchmarks do not themselves create duplicate customer settings.

Unsupported, unbound, not-evaluated, and ordinary review-only observations do not create Work rows. Diagnostics and original evidence remain available separately. Existing persisted data is not deleted or reclassified by this presentation change.

## Hybrid AD / Intune

A GPO and an Intune policy can prescribe conflicting values for an equivalent setting. This requires both policy sources, device/user assignments, an explicit CSP-to-GPO mapping, and applicable precedence rules. Matching raw registry strings is insufficient because equivalent GPO and CSP settings may use different locations.

MDMWinsOverGP is device-scoped, defaults to 0, and governs Policy CSP equivalents only. It is not a universal MDM priority rule. Microsoft documents separate behavior for PassportForWork/Windows Hello for Business, where mixed GPO/CSP configuration can prevent CSP settings from applying. MDM diagnostics can report GP settings blocked by an MDM equivalent.

The current importer does not provide Intune policy settings and assignment evidence. Hybrid status from another report alone cannot establish such a conflict. Hybrid conflict evaluation therefore remains an explicit future input/mapping task; no synthetic Intune conflict is inferred from GPO backups.

## Verification and remaining parity work

Synthetic regression coverage includes absent/empty baselines, missing customer values, typed collisions, address case, different value names, scope and timeslot isolation, baseline separation, duplicate read rows, source preservation, and a 2300-GPO group. Work and the analysis summary use the same builder.

This is not a claim of complete executable parity with Policy Analyzer. A differential run of the same synthetic packages through Policy Analyzer and ASSESSOR remains required, including cross-format Registry.pol/security-template equivalence, ordered delete instructions, supported type families and translated identifiers. Conditional Group Policy Preferences and resultant endpoint policy require additional semantics/evidence and stay excluded from automatic claims.