Local Group Policy Editor

Local Group Policy Editor

The Local Group Policy Editor is a Microsoft Management Console (MMC) snap-in that provides a single user interface through which all the settings of Local Group Policy objects can be managed.

This section includes these topics:

  • Open the Local Group Policy Editor

  • Administrative Template Policy Settings

  • Use Startup, Shutdown, Logon, and Logoff Scripts

  • Edit a Local Group Policy Object

  • Edit Multiple Local Group Policy

  • Disable User or Computer Settings in Local Group Policy

  • Delete Multiple Local Group Policy Objects

  • Resources for Group Policy

Note

Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.


Open the Local Group Policy Editor

You can open the Local Group Policy Editor by using the command line or by using the Microsoft Management Console (MMC).

To open the Local Group Policy Editor from the command line

  • Click Start, type gpedit.msc in the Start Search box, and then press ENTER.
To open the Local Group Policy Editor as an MMC snap-in

  1. Open MMC. (Click Start, click in the Start Search box, type mmc, and then press ENTER.)

  2. On the File menu, click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, click Group Policy Object Editor, and then click Add.

  4. In the Select Group Policy Object dialog box, click Browse.

  5. Click This computer to edit the Local Group Policy object, or click Users to edit Administrator, Non-Administrator, or per-user Local Group Policy objects.

  6. Click Finish.
Note

If you want to save a Local Group Policy Editor console and choose which GPO opens in it from the command line, select the Allow the focus of the Group Policy Snap-in to be changed when launching from the command line check box in the Select Group Policy Object dialog box.
Additional considerations
  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.


Administrative Template Policy Settings

Administrative Templates are registry-based policy settings that appear in the Local Group Policy Editor under the Administrative Templates node of both the Computer and User Configuration nodes. This hierarchy is created when the Local Group Policy Editor reads XML-based Administrative Template files (.admx).

This section contains these topics:

  • Edit Administrative Template Policy Settings

  • Filter the View of Administrative Templates

  • Add Comments to Administrative Template Policy Settings

  • Add or Remove Classic Administrative Templates

Additional considerations

  • For more information about editing administrative templates, go to http://go.microsoft.com/fwlink/?LinkID=66002.


Edit Administrative Template Policy Settings

To edit Administrative Templates policy settings

  1. Using the Local Group Policy Editor, open the Local Group Policy object you want to edit.

  2. In the console tree, click the folder under Administrative Templates that contains the policy settings you want to configure.

  3. In the Setting column, click the name for a policy setting to read a description of the policy setting.

  4. To change that policy setting from its current state, double-click the name of the policy setting.

  5. In the policy setting dialog box, click one of the following:

    • Not Configured: The registry is not modified.

    • Enabled: The registry reflects that the policy setting is selected.

    • Disabled: The registry reflects that the policy setting is not selected.

  6. Select any other options that you want, and then click OK.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • In the Local Group Policy Editor, there are two Administrative Templates branches. Settings for HKEY_LOCAL_MACHINE are under Computer Configuration, and settings for HKEY_CURRENT_USER are under User Configuration.

  • If computer policy conflicts with user policy, computer policy generally takes precedence. However, if application authors disregard this convention, Group Policy cannot enforce it.

  • Administrative Template policy settings are also known as registry-based policy settings.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Administrative Template Policy Settings


Filter the View of Administrative Templates

The Local Group Policy Editor provides the option to filter Administrative Template policy settings based on:

  • Managed, Configured, or Commented policy settings.

  • Keywords within the title, Help text, or comment of policy settings.

  • Platform or application requirements of policy settings.

Apply filters on Administrative Template policy settings when you want to find a specific policy setting or when you want to limit the number of policy settings displayed in the Local Group Policy Editor.

This section includes these topics:

  • Filter with Property Filters

  • Filter with Keyword Filters

  • Filter with Requirement Filters

Additional considerations

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Administrative Template Policy Settings


Filter with Property Filters

The Local Group Policy Editor allows you to change the criteria for displaying Administrative Template policy settings. By default, the editor displays all policy settings, including unmanaged policy settings. However, you can use property filters to change how the Local Group Policy Editor displays Administrative Template policy settings.

There are three inclusive property filters that you can use to filter Administrative Templates. These property filters include:

  • Managed

  • Configured

  • Commented

Managed

There are two kinds of Administrative Template policy settings: Managed and Unmanaged. The Group Policy Client service governs Managed policy settings and removes a policy setting when it is no longer within scope of the user or computer.

The Group Policy Client service does not govern unmanaged policy settings. These policy settings are persistent. The Group Policy Client service does not remove unmanaged policy settings, even if the policy setting is not within scope of the user or computer. Typically, you use these types of policy settings to configure options for operating system components that are not policy enabled. You can also use unmanaged policy settings for application settings.

The Managed property filter has three states: Any, Yes, and No. Setting this property filter to Any causes the Local Group Policy Editor to display all Administrative Template policy settings. Setting this property filter to Yes causes the editor to show only managed Administrative Template policy settings, hiding all unmanaged Administrative Template policy settings. Setting this property filter to No causes the editor to show only unmanaged Administrative Template policy settings, hiding all managed Administrative Template policy settings.

To set the Administrative Templates Managed property filter

  1. Open the Local Group Policy Editor.

  2. Right-click Administrative Templates located under Computer Configuration\Policies or User Configuration\Policies. Click Filter Options.

  3. In the Managed list, click the appropriate filter.

  4. Click OK to apply the new filter settings, and close the Filter Options dialog box.

Configured

You can configure Administrative Template policy settings to one of three states: Not Configured, Enabled, and Disabled. Not Configured is the default state for all policy settings. Policy settings set to Not Configured do not affect users or computers. Enabling an Administrative Template policy setting activates the policy setting. When Enabled, the action described in the title of the policy setting applies to the user or computer. When Disabled, the opposite action described in the title of the policy setting applies to the user or computer. Usually Not Configured and Disabled policy settings produce the same results. The difference is that Not Configured policy settings do not apply to the user, but Disabled policy settings apply to a user.

Each Administrative Template policy setting provides detailed information about its Enabled, Disabled, and Not Configured states. You can view this information in the Help pane of each Administrative Template policy setting. Or, you can view this information for the selected policy setting in the Extended View of the editor.

The Configured property filter has three states: Any, Yes, and No. Setting this property filter to Any causes the Local Group Policy Editor to display all Administrative Template policy settings and is the default setting for this filter. Setting this property filter to Yes causes the editor to show only configured Administrative Template policy settings, hiding not configured policy settings. Setting this property filter to No causes the editor to show only not configured Administrative Template policy settings, hiding configured policy settings.

To set the Administrative Templates Configured property filter

  1. Open the Local Group Policy Editor.

  2. Right-click Administrative Templates located under Computer Configuration\Policies or User Configuration\Policies. Click Filter Options.

  3. In the Configured list, click the appropriate filter.

  4. Click OK to apply the new filter settings, and close the Filter Options dialog box.

Commented

Each Administrative Template policy setting has a comment property. The Commented property allows you to enter text associated with a specific policy setting.

The Commented property filter has three states: Any, Yes, and No. Setting this property filter to Any causes the Local Group Policy Editor to display all Administrative Template policy settings and is the default setting for this filter. Setting this proper filter to Yes causes the editor to show only commented Administrative Template policy settings, hiding policy settings without comments. Setting this property filter to No causes the editor to show only Administrative Template policy settings without comments, hiding commented policy settings.

To set the Administrative Templates Commented property filter

  1. Open the Local Group Policy Editor.

  2. Right-click Administrative Templates located under Computer Configuration\Policies or User Configuration\Policies. Click Filter Options.

  3. In the Commented list, click the appropriate filter.

  4. Click OK to apply the new filter settings and close the Filter Options dialog box.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Filters are inclusive, so select items you want to display rather than items you want to be removed.

  • Filters do not work with Classic Administrative Templates.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Filter the View of Administrative Templates


Filter with Keyword Filters

The Local Group Policy Editor allows you to change the criteria for displaying Administrative Template policy settings. By default, the editor displays all policy settings. However, you can use keyword filters to change how the Local Group Policy Editor displays Administrative Template policy settings.

To set the Administrative Templates Keyword filter

  1. Open the Local Group Policy Editor.

  2. Right-click Administrative Templates located under Computer Configuration or User Configuration. Click Filter Options.

  3. Select the Enable Keyword Filters check box.

  4. Type one or more keywords in the Filter for word(s) box, and click the appropriate filter:

    • Any: The filter includes any of the words in the Filter for word(s) box.

    • All: The filter includes all of the words in the Filter for word(s) box.

    • Exact: The filter includes exact matches of the words in the Filter for word(s) box.

  5. Select the appropriate check boxes next to Within.

    • Policy Setting Title: The filter includes searching the title of the policy setting.

    • Help Text: The filter includes searching the Help text of the policy setting.

    • Comment: The filter includes searching the comment of the policy setting

  6. Click OK to apply the new filter settings and close the Filter Options dialog box.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Filters are inclusive, so select items you want to display rather than items you want to be removed.

  • Filters do not work with Classic Administrative Templates.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Filter the View of Administrative Templates


Filter with Requirement Filters

The Local Group Policy Editor allows you to change the criteria for displaying Administrative Template policy settings. By default, the editor displays all policy settings. However, you can use requirement filters to change how the Local Group Policy Editor displays Administrative Template policy settings.

To set the Administrative Templates Requirement filter

  1. Open the Local Group Policy Editor.

  2. Right-click Administrative Templates located under Computer Configuration or User Configuration. Click Filter Options.

  3. Select the Enable Requirements Filters check box.

  4. Type one or more keywords in the Filter for word(s) box.

  5. In the Select the desired platform and application filter(s) list, click the appropriate filter:

    • Include settings that match any of the selected platforms.

    • Include settings that match all of the selected platforms.

      Note

      You can click Select All to select all of the items in the list, or you can click Clear All to clear all of the items in the list.

  6. Click OK to apply the new filter settings and close the Filter Options dialog box.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Filters are inclusive, so select items you want to display rather than items you want to be removed.

  • Filters do not work with Classic Administrative Templates.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Filter the View of Administrative Templates


Add Comments to Administrative Template Policy Settings

You can include comments on each Administrative Template policy setting. You can use this space to further document the policy setting and why its implementation is important to your environment. Commenting policy settings allows you to use keyword filters to help you quickly find policy settings with matching keywords.

To comment an Administrative Templates policy setting

  1. Open the Local Group Policy Editor.

  2. In the console tree, click the folder under Administrative Templates that contains the policy setting you want to configure.

  3. In the Setting column, double-click the name for the policy setting.

  4. Type your comments in the Comment box.

  5. Click OK.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Administrative Template Policy Settings


Add or Remove Classic Administrative Templates

Classic Administrative Template files (also known as ADM files) are not authored using XML. Earlier versions of the Local Group Policy Editor displayed these settings under the Administrative Templates node.

The current version of Administrative Template files are authored using XML (known as ADMX files). The Local Group Policy Editor displays these settings under the Administrative Templates node. However, the Local Group Policy Editor still recognizes ADM files and displays these settings under the Classic Administrative Templates node, which is a child node to Administrative Templates.

To add or remove a classic Administrative Template file (.adm file)

  1. Using the Local Group Policy Editor, open the Local Group Policy object you want to edit.

  2. In the console tree, under either Computer Configuration or User Configuration, right-click Administrative Templates.

  3. Click Add/Remove Templates.

  4. Do one of the following:

    • To add a template, click Add. In the Policy Templates dialog box, click the template you want to add, and then click Open.

    • To remove a template, in the Current Policy Templates list, click the template, and then click Remove.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Administrative Template Policy Settings


Use Startup, Shutdown, Logon, and Logoff Scripts

Group Policy allows you to associate one or more scripting files with four triggered events:

  • Computer startup

  • Computer shutdown

  • User logon

  • User logoff

You can use Windows PowerShell scripts, or author scripts in any other language supported by the client computer. Windows Script Host (WSH) supported languages are also used, including VBScript and Jscript.

This section contains these topics:

  • Assign Computer Startup Scripts

  • Assign Computer Shutdown Scripts

  • Assign User Logon Scripts

  • Assign User Logoff Scripts

Additional considerations

  • For more information about scripting, see the Group Policy Script Center (http://go.microsoft.com/fwlink/?LinkID=66013).


Assign Computer Startup Scripts

To assign computer startup scripts

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Scripts (Startup/Shutdown). The path is Computer Configuration\Windows Settings\Scripts (Startup/Shutdown).

  3. In the results pane, double-click Startup.

  4. In the Startup Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In the Script Name box, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In the Script Parameters box, type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Startup Properties dialog box, specify the options that you want:

    • Startup Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it and then click Up. To move a script down in the list, click it and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    • Remove: Removes the selected script from the Startup Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Startup scripts are run under the Local System account, and they have the full rights that are associated with being able to run under the Local System account.

  • Beginning in Windows Vista, startup scripts are run asynchronously, by default. This is a different behavior from earlier operating systems.

  • Setting startup scripts to run synchronously may cause the boot process to run slowly.

  • In Windows 7 and Windows Vista, startup scripts that are run asynchronously will not be visible. Enabling the Run Startup Scripts Visible policy setting will have no effect when running startup scripts asynchronously.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Use Startup, Shutdown, Logon, and Logoff Scripts


Assign Computer Shutdown Scripts

To assign computer shutdown scripts

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Scripts (Startup/Shutdown). The path is Computer Configuration\Windows Settings\Scripts (Startup/Shutdown).

  3. In the results pane, double-click Shutdown.

  4. In the Shutdown Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Shutdown Properties dialog box, specify the options that you want:

    • Shutdown Scripts for <Group Policy object>: Lists all the scripts that are currently assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it and then click Up. To move a script down in the list, click it and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    • Remove: Removes the selected script from the Shutdown Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Shutdown scripts are run as Local System, and they have the full rights that are associated with being able to run as Local System.

  • Setting shutdown scripts to run synchronously may cause the shutdown process to run slowly.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Use Startup, Shutdown, Logon, and Logoff Scripts


Assign User Logon Scripts

To assign user logon scripts

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Scripts (Logon/Logoff). The path is User Configuration\Windows Settings\Scripts (Logon/Logoff).

  3. In the results pane, double-click Logon.

  4. In the Logon Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Logon Properties dialog box, specify the options that you want:

    • Logon Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it and then click Up. To move a script down in the list, click it and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    • Remove: Removes the selected script from the Logon Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Setting logon scripts to run synchronously may cause the logon process to run slowly.

  • Logon scripts are run as User, not Administrator, and their rights are limited accordingly.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Use Startup, Shutdown, Logon, and Logoff Scripts


Assign User Logoff Scripts

To assign user logoff scripts

  1. Open the Local Group Policy Editor.

  2. In the console tree, click Scripts (Logon/Logoff). The path is User Configuration\Windows Settings\Scripts (Logon/Logoff).

  3. In the results pane, double-click Logoff.

  4. In the Logoff Properties dialog box, click Add.

  5. In the Add a Script dialog box, do the following:

    • In Script Name, type the path to the script, or click Browse to search for the script file in the Netlogon shared folder on the domain controller.

    • In Script Parameters, type any parameters that you want, the same way as you would type them on the command line. For example, if your script includes parameters called //logo (display banner) and //I (interactive mode), type //logo //I.

  6. In the Logoff Properties dialog box, specify the options the you want:

    • Logoff Scripts for <Group Policy object>: Lists all the scripts that currently are assigned to the selected Group Policy object (GPO). If you assign multiple scripts, the scripts are processed in the order that you specify. To move a script up in the list, click it and then click Up. To move a script down in the list, click it and then click Down.

    • Add: Opens the Add a Script dialog box, where you can specify any additional scripts to use.

    • Edit: Opens the Edit Script dialog box, where you can modify script information, such as name and parameters.

    • Remove: Removes the selected script from the Logoff Scripts list.

    • Show Files: Displays the script files that are stored in the selected GPO.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.

  • Logoff scripts are run as User, not Administrator, and their rights are limited accordingly.

  • Setting logoff scripts to run synchronously may cause the logoff process to run slowly.

  • Local Group Policy Editor and the Resultant Set of Policy snap-in are available in Windows Server 2008 R2 and Windows 7 Professional, Windows 7 Ultimate, and Windows 7 Enterprise. For more information, see http://go.microsoft.com/fwlink/?LinkId=139815.

Additional references

  • Use Startup, Shutdown, Logon, and Logoff Scripts


Edit a Local Group Policy Object

To edit a local Group Policy object

  1. Open the Local Group Policy Editor.

  2. In the console tree, double-click the folders to view the policy settings in the details pane.

  3. In the results pane, double-click a policy setting to open the Properties dialog box, and then edit the policy setting.

Additional considerations

  • To complete this procedure, you must have Edit setting permission to edit a GPO. By default, members of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group have Edit setting permission to edit a GPO.


Edit Multiple Local Group Policy

Multiple Local Group Policy is a collection of Local Group Policy objects (LGPOs) designed to provide improved management for computers that are not part of a domain. This collection consists of the following LGPOs:

  • Local Computer Policy. This LGPO applies policy settings to the computer and any users logging on to the computer. This is the same LGPO that was included in earlier versions of Microsoft Windows.

  • Administrators Local Group Policy. This LGPO applies user policy settings to members of the Administrators group.

  • Non-Administrators Local Group Policy. This LGPO applies user policy settings to users who are not included in the Administrators group.

  • User-Specific Local Group Policy. This LGPO applies user policy settings to a specific local user.

To edit Multiple Local Group Policy

  1. Open Microsoft Management Console.

  2. Click File and then click Add/Remove Snap-in.

  3. Click Group Policy Object Editor in the Available Snap-ins list and click Add.

  4. Click the Browse button in the Select Group Policy Object dialog box.

  5. Click the Users tab in the Browse for the Group Policy Object dialog box.

  6. Click the user or group for which you want to create or edit local Group Policy. Click OK, click Finish, and then click OK.

  7. Configure policy settings.

Additional considerations

  • Multiple Local Group Policy objects (MLGPOs) are not available on domain controllers.

  • Local Group Policy is processed in the following order, with the final LGPO taking precedence over all others:

    1. Local Group Policy (also known as Local Computer Policy).

    2. Administrators or non-administrators Local Group Policy.

    3. User-specific Local Group Policy.

  • For more information about managing multiple local GPOs, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=65999).


Disable User or Computer Settings in Local Group Policy

Occasionally you may want to disable policy settings rather than delete the entire Local Group Policy.

To disable user or computer policy settings in a Local Group Policy object

  1. Open Microsoft Management Console.

  2. Click File and then click Add/Remove Snap-in.

  3. In the Add/Remove Snap-in dialog box, in the Available Snap-ins list box, click Group Policy Object Editor, and then click Add.

  4. In the Select Group Policy Object dialog box, click Browse.

  5. To specify Local Computer Policy, click OK and then click Finish. Proceed to Step 7.

  6. To specify Local Computer Policy for users or groups, click the Users tab, and select from the following Local Group Policy objects:

    • Administrators: Predefined Local Group Policy that applies to users included in the Administrators group.

    • Non-Administrators: Predefined Local Group Policy that applies to users not included in the Administrators group.

    • User-Specific: Local Group Policy objects associated with a specific local user account.

  7. Right-click the name of the Local Group Policy object, and then click Properties.

  8. Click Disable Computer Configuration settings or Disable User Configuration settings.

  9. Click OK, and then close Microsoft Management Console.

Additional considerations

  • Local Computer Policy allows you to disable both computer and user configurations. Administrators, Non-Administrators, and User-Specific Local Group Policies allow you to disable only the user configuration.


Delete Multiple Local Group Policy Objects

You can delete Multiple Local Group Policy objects. Use this procedure to delete Administrators, Non-Administrators, or User-Specific Local Group Policy objects.

To delete Multiple Local Group Policy

  1. Open Microsoft Management Console.

  2. Click File, and then click Add/Remove Snap-in.

  3. Click Group Policy Object Editor in the Available Snap-ins list and click Add.

  4. In the Select Group Policy Object dialog box, click Browse. Click the Users tab.

  5. Right-click the Administrators, Non-Administrators, or User-Specific Local Group Policy object. Click Remove Group Policy Object.

  6. Click Yes to confirm the deletion of the Local Group Policy object.

  7. Close Microsoft Management Console.
Note

The text located in the Group Policy Object Exists column next to the item selected in Step 4 will display No.

Additional considerations

  • Multiple Local Group Policy objects are not available on domain controllers.

  • You cannot delete the Local Group Policy object (also known as Local Computer Policy).

  • For more information about managing multiple local GPOs, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=4291).


Resources for Group Policy

This section contains links to more information about Group Policy and related technologies.

  • For the Group Policy Tech Center see http://go.microsoft.com/fwlink/?linkid=66015. This Web site provides an entry point for Group Policy documentation, including information about deployment, operations, training, support, and communities.

  • For the Group Policy Settings Reference see http://go.microsoft.com/fwlink/?LinkId=131389. This document lists Group Policy settings described in Administrative Template (.admx or .adml) files and Security Settings. This includes all Administrative Template policy settings for Windows Server® 2008 R2 and Windows® 7.

  • For the GPMC Sample Scripts see http://go.microsoft.com/fwlink/?LinkId=65841. This set of sample scripts provides examples of how to use these interfaces for real-world administrative problems; scenarios are available as a downloadable package.