NetIQ Group Policy Administrator 3.0
NetIQ Group Policy Administrator 4.0
Comparison report is showing differences when the 'Security Descriptor' of the Group Policy Objects (GPOs) have the same groups listed.
This is due to the ordering of the security descriptor on the GPO.
When running a GPO Comparison report, NetIQ Group Policy Administrator (GPA) does a literal comparison of the security descriptor. If the security descriptors listed are in a different order, GPA will highlight this as a difference.
Example: If one GPO has security descriptor listed as Domain Admins, Group A, Everyone and the second GPO has the security listed as Everyone, Group A, Domain Admins then GPA will highlight these as different even though the groups are the same, just listed in a different order.
This issue has been corrected in Group Policy Administrator 4.5. Upgrade to the latest version of GPA to resolve this issue.