Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I try to use secpol.msc (Group Policy) I get an error:

Failed to open group policy object on this computer. You may not have appropriate rights.

I am an admin and I tried running it as a administrator but I still get it.

share|improve this question
Is your account part of a domain? If yes, try assigning it a Domain Administrator Role (Adding it to a domain administrator group). – Thomas May 10 '11 at 5:04
What version of Windows are you running? – Andrew Cooper May 10 '11 at 5:22
@AndrewCooper i have win7 ultimate – winter4w May 11 '11 at 0:31
@Thomas no I am not on a domain – winter4w May 11 '11 at 0:32

Sounds like the permissions on the Group Policy files are wrong. Navigate to C:\Windows\System32 and open the properties of the (hidden) GroupPolicy folder. Go to the Security tab. The correct permissions are Full control for Administrators and SYSTEM; Authenticated Users should have Read & execute, List folder contents, and Read. If the ACLs aren't right, open the advanced security settings and click Change permissions. Adjust the permission entries appropriately, check Replace all child object permission entries with inheritable permission entries from this object, and click OK.

correct settings

If that doesn't help, you'll need to look at the security on GroupPolicyUsers. That folder has the same settings on the folder itself, but do not replace all child object permissions! It has (hidden) subfolders, each named with the SID of the user it applies to. On each user policy folder, Administrators and SYSTEM must have Full control, but the user (not Authenticated Users) should have Read & execute, List folder contents, and Read. Those permissions should be inherited by the children of the per-user folders.

Finally, if none of that helps, check the permissions on C:\Windows\PolicyDefinitions. They should be the following:

  • TrustedInstaller has Full control on the folder and subfolders (not files)
  • SYSTEM has Modify on the folder itself, but Full control on subfolders and files
  • Administrators have Modify on the folder itself, but Full control on subfolders and files
  • Users have Read & execute, on the folder and everything in it
  • CREATOR OWNER has Full control on subfolders and files only
  • ALL APPLICATION PACKAGES have Read & execute on the folder and everything in it

correct PolicyDefinitions ACL

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .