Local Group Policy Editor

Local Group Policy Editor

The Local Group Policy Editor is a Microsoft Management Console (MMC) snap-in that provides a single user interface through which all the settings of Local Group Policy objects can be managed.


Opening the Local Group Policy Editor

You can open the Local Group Policy Editor by using the command line or by using the Microsoft Management Console (MMC).

To open the Local Group Policy Editor from the command line

  • Click Start, click All Programs, click Accessories, and then click Run. Type gpedit.msc in the box, and then click OK or press ENTER.
To open the Local Group Policy Editor as an MMC snap-in

  1. Open MMC. (Click Start, click in the Start Search box, type mmc, and then press ENTER.)

  2. On the File menu, click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, click Local Group Policy Editor, and then click Add.

  4. In the Select Group Policy Object dialog box, click Browse.

  5. Click This computer to edit the Local Group Policy object, or click Users to edit Administrator, Non-Administrator, or per-user Local Group Policy objects.

  6. Click Finish, click Close, and then click OK. The Local Group Policy Editor opens the Group Policy object (GPO) for you to edit.
Note

If you want to save a Local Group Policy Editor console and choose which GPO opens in it from the command line, select the Allow focus of the Group Policy Snap-in to be changed when launching from the command line check box in the Select Group Policy Object dialog box.


Administrative Templates

Administrative Templates are registry-based policy settings that appear in the Local Group Policy Editor under the Administrative Templates node of both the Computer and User Configuration nodes. This hierarchy is created when the Local Group Policy Editor reads XML-based Administrative Template files (.admx).

This section contains these topics:

  • Add or Remove Classic Administrative Templates

  • Edit Administrative Templates Policy Settings

  • Filter the View Provided by Administrative Templates

Additional considerations

  • For more information about editing administrative templates, go to http://go.microsoft.com/fwlink/?LinkID=66002.


Add or Remove Classic Administrative Templates

Classic Administrative Template files (also known as ADM files) are not authored using XML. Earlier versions of the Local Group Policy Editor (previously called Group Policy Object Editor) displayed these settings under the Administrative Templates node.

The current version of Administrative Template files are authored using XML (known as ADMX files). The Local Group Policy Editor displays these settings under the Administrative Templates node. However, the Local Group Policy Editor still recognizes ADM files and displays these settings under the Classic Administrative Templates node, which is a child node to Administrative Templates.

To add or remove a classic Administrative Template file (.adm file)

  1. Using the Local Group Policy Editor, open the Local Group Policy object you want to edit.

  2. In the console tree, under either Computer Configuration or User Configuration, right-click Administrative Templates.

  3. Click Add/Remove Templates.

  4. Do one of the following:

    • To add a template, click Add. In the Policy Templates dialog box, click the template you want to add, and then click Open.

    • To remove a template, in the Current Policy Templates list, click the template, and then click Remove.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

Additional references

  • Administrative Templates


Edit Administrative Templates Policy Settings

To edit Administrative Templates policy settings

  1. Open the Local Group Policy Editor.

  2. In the console tree, click the folder under Administrative Templates that contains the policy settings you want to set.

  3. In the Setting column, click the name for a policy setting to read a description of the policy setting.

  4. To change that policy setting from its default (not configured) state, double-click the name of the policy setting.

  5. On the Setting tab, click one of the following:

    • Not Configured: The registry is not modified.

    • Enabled: The registry reflects that the policy setting is selected.

    • Disabled: The registry reflects that the policy setting is not selected.

  6. Select any other available options that you want on the Setting tab, and then click OK.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • In the Local Group Policy Editor, there are two Administrative Templates branches. Settings for HKEY_LOCAL_MACHINE are under Computer Configuration, and settings for HKEY_CURRENT_USER are under User Configuration.

  • If computer policy conflicts with user policy, computer policy generally takes precedence. However, if application authors disregard this convention, Group Policy cannot enforce it.

  • Administrative Template policy settings are also known as registry-based policy settings.

Additional references

  • Administrative Templates


Filter the View Provided by Administrative Templates

To filter the view provided by Administrative Templates

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Administrative Templates, or click a folder under Administrative Templates that contains the policy settings that you want to filter.

  3. On the View menu, click Filtering.

  4. Select the Filter by Requirements information check box.

  5. In the list box, select the check boxes for the categories you want to make visible.

  6. To hide settings that are not configured, select the Only show configured policy settings check box. If you do this, only enabled or disabled settings will be visible.

  7. To hide preference policy settings, select the Only show policy settings that can be fully managed check box. This option is recommended, and it is selected by default. (Values for preference policy settings are set by the user or by the operating system at installation time. The registry values that store preferences are located outside the approved Group Policy registry key locations. Users can typically change their preferences at any time.)

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • This filtering procedure is useful if there are too many Administrative Templates settings at one time in the Local Group Policy Editor. This filtering determines which settings are visible in the console. Filtering does not affect whether the settings apply to users or computers, and it is not the same as filtering the scope of Group Policy according to security group membership.

  • These filter settings are not saved when you close the Local Group Policy Editor.

Additional references

  • Administrative Templates


Use Startup, Shutdown, Logon, and Logoff Scripts

Group Policy allows you to associate one or more scripting files with four triggered events:

  • Computer startup

  • Computer shutdown

  • User logon

  • User logoff

You can author scripts in any language supported by the client computer, with Windows Script Host (WSH) supported languages being the most common. WSH-supported languages include VBScript and Jscript.

This section contains these topics:

  • Assign Computer Startup Scripts

  • Assign Computer Shutdown Scripts

  • Assign User Logon Scripts

  • Assign User Logoff Scripts

Additional considerations

For more information about scripting, see the Group Policy Script Center (http://go.microsoft.com/fwlink/?LinkID=66013).


Assign Computer Startup Scripts

To assign computer startup scripts

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Scripts (Startup/Shutdown). The path is Computer Configuration\Windows Settings\Scripts (Startup/Shutdown).

  3. In the details pane, double-click Startup.

  4. In the Startup Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In the Script Name box, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In the Script Parameters box, type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Startup Properties dialog box, specify the options that you want:

    • Startup Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it and then click Up. To move a script down in the list, click it and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    • Remove: Removes the selected script from the Startup Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Startup scripts are run under the Local System account, and they have the full rights that are associated with being able to run under the Local System account.

  • In Windows Vista, startup scripts are run asynchronously, by default. This is a different behavior from earlier operating systems.

  • Setting startup scripts to run synchronously may cause the boot process to run slowly.

  • In Windows Vista, startup scripts that are run asynchronously will not be visible. Enabling the Run Startup Scripts Visible Group Policy setting will have no effect when running startup scripts asynchronously.

Additional references

  • Use Startup, Shutdown, Logon, and Logoff Scripts


Assign Computer Shutdown Scripts

To assign computer shutdown scripts

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Scripts (Startup/Shutdown). The path is Computer Configuration\Windows Settings\Scripts (Startup/Shutdown).

  3. In the details pane, expand Shutdown.

  4. In the Shutdown Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Shutdown Properties dialog box, specify the options that you want:

    • Shutdown Scripts for <Group Policy object>: Lists all the scripts that are currently assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it and then click Up. To move a script down in the list, click it and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    • Remove: Removes the selected script from the Shutdown Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Shutdown scripts are run as Local System, and they have the full rights that are associated with being able to run as Local System.

  • Setting shutdown scripts to run synchronously may cause the shutdown process to run slowly.

Additional references

  • Use Startup, Shutdown, Logon, and Logoff Scripts


Assign User Logon Scripts

To assign user logon scripts

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Scripts (Logon/Logoff). The path is User Configuration\Windows Settings\Scripts (Logon/Logoff).

  3. In the details pane, expand Logon.

  4. In the Logon Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Logon Properties dialog box, specify the options that you want:

    • Logon Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it and then click Up. To move a script down in the list, click it and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    • Remove: Removes the selected script from the Logon Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Setting logon scripts to run synchronously may cause the logon process to run slowly.

  • Logon scripts are run as User, not Administrator, and their rights are limited accordingly.

Additional references

  • Use Startup, Shutdown, Logon, and Logoff Scripts


Assign User Logoff Scripts

To assign user logoff scripts

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Scripts (Logon/Logoff). The path is User Configuration\Windows Settings\Scripts (Logon/Logoff).

  3. In the details pane, expand Logoff.

  4. In the Logoff Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Logoff Properties dialog box, specify the options the you want:

    • Logoff Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it and then click Up. To move a script down in the list, click it and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    • Remove: Removes the selected script from the Logoff Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Logoff scripts are run as User, not Administrator, and their rights are limited accordingly.

  • Setting logoff scripts to run synchronously may cause the logoff process to run slowly.

Additional references

  • Use Startup, Shutdown, Logon, and Logoff Scripts


Edit Multiple Local Group Policy

Multiple Local Group Policy is a collection of Local Group Policy objects (LGPOs) designed to provide improved management for computers that are not part of a domain. This collection consists of the following LGPOs:

  • Local Computer Policy. This LGPO applies policy settings to the computer and any users logging on to the computer. This is the same LGPO that was included in earlier versions of Microsoft Windows.

  • Administrators Local Group Policy. This LGPO applies user policy settings to members of the Administrators group.

  • Non-Administrators Local Group Policy. This LGPO applies user policy settings to users who are not included in the Administrators group.

  • User-Specific Local Group Policy. This LGPO applies user policy settings to a specific local user.

To edit Multiple Local Group Policy

  1. Open Microsoft Management Console.

  2. Click File and then click Add/Remove Snap-in.

  3. Click the Local Group Policy Editor in the Available Snap-ins list and click Add.

  4. Click the Browse button in the Select Group Policy Object dialog box.

  5. Click the Users tab in the Browse for the Group Policy Object dialog box.

  6. Click the user or group for which you want to create or edit local Group Policy. Click OK, click Finish, and then click OK.

  7. Locate and configure one or more policy settings.

Additional considerations

  • Multiple Local Group Policy objects (MLGPOs) are not available on domain controllers.

  • Local Group Policy is processed in the following order, with the final LGPO taking precedence over all others:

    1. Local Group Policy (also known as Local Computer Policy).

    2. Administrators or non-administrators Local Group Policy.

    3. User-specific Local Group Policy.

  • For more information about managing multiple local GPOs, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=65999).


Disable User or Computer Settings in Local Group Policy

Occasionally you may want to disable policy settings rather than delete the entire Local Group Policy.

To disable user or computer policy settings in a Local Group Policy object

  1. Open Microsoft Management Console.

  2. Click File and then click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, in the Available Snap-ins list box, click Local Group Policy Editor, and then click Add.

  4. In the Select Group Policy Object dialog box, click Browse.

  5. To specify Local Computer Policy, click OK and then click Finish. Proceed to Step 7.

  6. To specify Local Computer Policy for users or groups, click the Users tab, and select from the following Local Group Policy objects:

    • Administrator: Predefined Local Group Policy that applies to users included in the Administrators group.

    • Non-Administrator: Predefined Local Group Policy that applies to users not included in the Administrators group.

    • User-Specific: Local Group Policy objects associated with a specific local user account.

  7. Right-click the name of the Local Group Policy object, and then click Properties.

  8. Click Disable Computer Configuration settings or Disable User Configuration settings.

  9. Click OK, and then close Microsoft Management Console.

Additional considerations

  • Local Computer Policy allows you to disable both computer and user configurations. Administrators, Non-Administrators, and User-Specific Local Group Policies allow you to disable only the user configuration.


Delete Multiple Local Group Policy Objects

You can delete Multiple Local Group Policy objects. Use this procedure to delete Administrators, Non-Administrators, or User-Specific Local Group Policy objects.

To delete Multiple Local Group Policy

  1. Open Microsoft Management Console.

  2. Click File, and then click Add/Remove Snap-in.

  3. Click Local Group Policy Editor in the Available Snap-ins list and click Add.

  4. In the Select Group Policy Object dialog box, click Browse. Click the Users tab.

  5. Right-click the Administrators, Non-Administrators, or User-Specific Local Group Policy object. Click Remove Group Policy Object.

  6. Click Yes to confirm the deletion of the Local Group Policy object.

  7. Close Microsoft Management Console.
Note

The text located in the Group Policy Object Exists column next to the item selected in Step 4 will display No.

Additional considerations

  • Multiple Local Group Policy objects are not available on domain controllers.

  • You cannot delete the Local Group Policy object (also known as Local Computer Policy).

  • For more information about managing multiple local GPOs, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=4291).


Edit a Local Group Policy Object

To edit a local Group Policy object

  1. Open the Local Group Policy Editor.

  2. In the console tree, double-click the folders to view the policy settings in the details pane.

  3. In the details pane, double-click a policy setting to open the Properties dialog box, and then edit the policy setting.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.


Resources for Group Policy

Resources

This section contains links to more information about Group Policy and related technologies.

  • Group Policy TechCenter. This Web site provides an entry point for Group Policy documentation, including information about deployment, operations, training, support, and communities.

  • Group Policy Settings Reference. This document lists Group Policy settings described in Administrative Template (.admx or .adml) files and Security Settings. This includes all Administrative Template policy settings for Microsoft Windows Vista®.

  • Group Policy Management Console Software Development Kit (SDK). This SDK provides information about how to use the COM interfaces of Group Policy Management, which support scripting many of the operations supported by Group Policy Management Console.