45

I want to make some changes to Windows that require using the Group Policy Editor (gpedit.msc).

Unfortunately the Group Policy Editor is not included with the Starter Edition, Home and Home Premium editions of Windows.

How can I install it?

5
  • 1
    I had been under the impression that gpedit was missing because these editions lack the group policy infrastructure to do anything with group policy registry entries. This Q&A suggests that isn't the case; that as long as you create the entries, either manually or via gpedit, those policies will be implemented. Is that correct?
    – fixer1234
    May 15, 2016 at 3:47
  • @fixer1234 For things I've done with it yes. Mostly enabling event logging for different things.
    – DavidPostill
    May 15, 2016 at 6:48
  • 1
    I should have done more research. It looks like group policy is basically just a collection of settings (no supplementary infrastructure). A reference guide is available from Microsoft in spreadsheet form. That and other information available from here.
    – fixer1234
    May 15, 2016 at 8:01
  • 1
    @fixer1234 That's a very useful link! I will add to my answer. Thanks.
    – DavidPostill
    May 15, 2016 at 8:03
  • You can also try the alternative Policy Plus.
    – not2qubit
    Nov 23, 2023 at 21:34

5 Answers 5

33

How do I install gpedit.msc on Windows Starter Edition, Home and Home Premium?

I used the following procedure to successfully install gpedit.msc on Windows 7 64 bit Home Premium.

Notes:

  • Confirmed as working on Windows 10 by Moab

  • It apparently works on Windows 8, Windows 8.1 and Windows 10 as well. I have not personally tested this.

UPDATE: According to our readers, this tool also works fine in Windows 8, Windows 8.1 and Windows 10.

Today we are going to share a simple installer which installs the required system files in Windows so that you can enjoy Group Policy Editor in all Windows 7 editions.

  1. First download the setup file using following link:

    Download Group Policy Editor Installer

    You'll find the download link in right-side section of the above mentioned page: download link

  2. After downloading the ZIP file, extract it using WinRAR or 7-Zip.

  3. Run the extracted setup.exe file.

    It will install the files and you'll be able to access gpedit.msc command via RUN or Start Menu search box.

Note:

  • For Windows 7 64-bit (x64) users! You'll also need to go to "SysWOW64" folder present in "C:\Windows" folder and copy "GroupPolicy", "GroupPolicyUsers" folders and gpedit.msc file from there and paste them in "C:\Windows\System32" folder.

If you are getting "MMC could not create the snap-in" error message while running gpedit.msc, check out following steps to fix the problem. Basically it happens when your username in Windows contains more than one word.

  1. Run the installer and leave it at the last step (do not click on the "Finish" button).

  2. Now go to C:\Windows\Temp\gpedit\ folder.

  3. If you are running 32-bit (x86) edition of Windows 7, right-click on x86.bat file and choose "Open With -> Notepad" option. If you are running 64-bit (x64) edition of Windows 7, right-click on x64.bat file and choose "Open With -> Notepad" option.

  4. You'll find a total of 6 lines containing the following string in the file:

    %username%:f

  5. Edit those lines and replace %username%:f with "%username%":f

    Original: icacls %WinDir%\SysWOW64\gpedit.dll /grant:r %username%:f

    New: icacls %WinDir%\SysWOW64\gpedit.dll /grant:r "%username%":f

  6. Save and run the file (right-click -> Run as Administrator).

  7. That's it. You'll have working gpedit.msc.

Source How to Enable "Group Policy Editor" (gpedit.msc) in Windows 7 Home Premium, Home Basic and Starter Editions?


Group Policy Settings Reference Guide

Microsoft has updated and made available as a download, the complete Group Policy Settings Reference Guide for Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows Server 2003 SP2, Windows Server 2008 R2 and Windows Server 2012 R2.

The download is available in the form of spreadsheets for different operating systems. So you can download the spreadsheet only for those operating system/s which you may be interested in.

Spreadsheet Download Link

...

What is also very useful in these spreadsheets, is that it also lists the registry keys which are affected when the settings are changed. Of course, you can always use the Group Policy Settings Search, to know the registry key and value name that backs a particular policy setting, but these spreadsheets put them all in one place.

The Administrative Template spreadsheet contains three columns that provide more information about each policy setting’s behavior related to reboots, logoffs, and schema extensions. These columns are the following:

  1. Logoff Required: A “Yes” in this column means that the Windows operating system requires the user to log off and log on again before it applies the described policy setting.
  2. Reboot Required: A “Yes” in this column means that the Windows operating systems requires a restart before it applies the described policy setting.
  3. Active Directory Schema or Domain Requirements: A “Yes” in this column means that you must extend the Active Directory schema before you can deploy this policy setting.
  4. Status: A “New” in this column means that the setting did not exist prior to Windows Server 2012 and Windows 8. It does not mean that the setting applies only to Windows Server 2012 and Windows 8. Refer to the column entitled “supported on” to determine to which operating system the policy setting applies.

Source Group Policy Settings Reference Guide for Windows 10/8.1/7/Server

13
  • 22
    deviantart is a wierd place to get it from. It also probably uses an exe from windows professional. gpedit not being installed is on purpose.
    – Journeyman Geek
    Dec 26, 2015 at 11:22
  • @JourneymanGeek I know, but it is useful to have it installed ;)
    – DavidPostill
    Dec 26, 2015 at 11:23
  • 5
    The problem is that you are not obtaining the Group Policy Editor from Microsoft, as well as that it could possibly be altered. Jan 19, 2017 at 18:17
  • 1
    --- not working for me after the lastest Windows Update :-( . I didn't diagnose a lot, but it just didn't leave me with a new copy of gpedit.msc at all. The windows\system32 folder was also wonky, making the "GroupPolicy" folder magically invisible... not Hidden, just not shown in Windows Explorer or dir in a command window. It makes me feel they are trying to prevent this.
    – Mike M
    Jun 2, 2017 at 8:44
  • 1
    @ShieldOfSalvation Sounds Shifty as f***, and definatetly sounds like Xss or Bodged Iframe manipulation/ code injection if the buttons moving around or Weird images are overlaid. I wouldn't trust that at all.. Specially not being from a verified source or vendor.. Why would that program even be uploaded to DeviantArt. Its an art website not a software one, I know you used to be able to Code basic stuff on there but still sounds Shifty.. Probably not up there anymore since the moved to Eclipse/Wix Anyway...
    – Ryan Stone
    Oct 13, 2020 at 10:43
29

Windows (at least Windows 10 home) comes with Group Policy Editor packages, but it is disabled by default. You can install it just like any other optional feature using dism.

The Group Policy package files can be found in

%SystemRoot%\servicing\Packages

With filenames matching

Microsoft-Windows-GroupPolicy-ClientExtensions-Package*.mum
Microsoft-Windows-GroupPolicy-ClientTools-Package*.mum

And command for installing would follow the following format:

dism /online /norestart /add-package:"%SystemRoot%\servicing\Packages\{{PackageFileName}}"

/online used to tell it to apply to the running OS

/norestart tells it to not auto reboot

After installing these gpedit.msc will be available. No need to download an external executable that you have to trust or find out if it is safe or not.

9
  • Both of those are language packs....installing then doesn't enable group editor on Windows 10 Home
    – Ramhound
    Jul 14, 2017 at 20:32
  • Well Group Policy Editor was enabled on my machine (from a clean install) after doing this and nothing else. Used on earlier version (104** or something like that) and latest update.(1703, 15063). So if they are just language packs, then installing them forced gpedit to be enabled. Either way it is how I got it working on the Home versions I used. Jul 15, 2017 at 1:24
  • 13
    Here is for those impatient for /f "tokens=*" %G IN ('dir /b "%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-Client*.mum"') do (dism /online /norestart /add-package:"%SystemRoot%\servicing\Packages\%G")
    – mlt
    Mar 10, 2018 at 4:33
  • 2
    Works for win10 Home
    – deerchao
    Aug 27, 2018 at 4:25
  • 2
    After installing the packages, if you look at the DISM log, you will see that a reboot was required, but was suppressed with /norestart. For me, gpedit.msc did not appear under c:\windows\system32 until after I rebooted.
    – James L.
    Jul 12, 2019 at 19:50
7

Since Alternative to gpedit.msc for Windows Home editions? is marked as a duplicate of this question (although it technically isn't), I'll post an alternative to gpedit here.

Every group policy corresponds to a registry value, which you can edit with regedit. The correspondences, including the different values, are documented on gpsearch.azurewebsites.net. It is apparently maintained by a Microsoft employee, so it's pretty reliable.

1
  • 1
    So why doesn't someone make a registry-easy-disable-winupdate tool? It could be four lines of powershell.
    – Warren P
    Sep 30, 2019 at 16:48
6

Buy an upgraded version of Windows that includes gpedit functionality or unlock the included gpedit package.

The lower grades of Windows versions do not include gpedit as a feature while the more expensive ones do. On the Microsoft website, the feature sets are explained for each version of Windows.

Gpedit can be unlocked, which indicates that Microsoft gives another way. If you don't want to buy the upgrade, you can add gpedit.msc On Home edition, Gpedit may not allow Administrative Template changes to have any effect.

David Postill linked to a script and some have found that it doesn't work. If you have just now tried to install the script from Davit Postill's answer, then follow the steps here to reverse some of the changes made by the script. Or, you can skip to the next part Adding gpedit.msc.

Reverse the script changes from Deviant Art

It is possible that the third party software from Deviant Art was legitimate when it was compiled, however it is now over two years since this question was posted and the third party software may have become incompatible with today's Windows infrastructure.

The third party script from Deviant Art creates a folder and backs up a copy of the gpedit associated files. Navigate to %WinDir%\SysWOW64\GPBAK.

To reverse some of the effects of the script, copy the backed up files back into the %WinDir%\SysWOW64 folder. Namely the gpedit.dll, fde.dll, gptext.dll, appmgr.dll, fdeploy.dll.

Go to the %WinDir%\System32\ folder and remove or replace the gpedit.msc that was manually copied over. You may want to delete gpedit.msc from the %WinDir%\SysWOW64 folder also.

Remove your account from the security permissions that were added to these files if necessary.

The %WinDir%\SysWOW64\GroupPolicy, %WinDir%\SysWOW64\GroupPolicyUsers folders are created and modified by the script as well. There are reverses to be made here.

Unfortunately, the Deviant Art script doesn't appear to make backups of these directories. We are not sure how to handle this. You can try deleting the folders possibly. You can maybe delete them from the %WinDir%\SysWOW64 folder as well.

After reversing the script and then adding the gpedit.msc feature, we fount that Start Menu -> Windows Administrative Tools -> Local Security Policy app was now present. We couldn't get the gpedit.msc to load directly from command line until Resetting the Installation from Settings -> Updates -> Recovery.

Adding gpedit.msc

The Group Policy package files can be found in

%SystemRoot%\servicing\Packages

Look for file names matching:

Microsoft-Windows-GroupPolicy-ClientExtensions-Package*.mum and Microsoft-Windows-GroupPolicy-ClientTools-Package*.mum

Get the names of those .mum files and one by one run the following dism command using the Package File Names.

dism /online /add-package:"%SystemRoot%\servicing\Packages\{{PackageFileName}}"

If asked to restart, then press the Y key to restart and finish adding any remaining packages.

It may also be necessary to re-register dll files if gpedit.msc gives a missing token error. Otherwise, it may be better to avoid re-registering the dll. To correct a missing token error, try navigating to %WinDir%\System32\ and run this command taken from this social.technet.microsoft.com article:

For /F %s in ('dir /b *.dll') do regsvr32 /s %s

It may be necessary to Reset This PC for a clean gpedit.msc. Back up your files first.

An alternative solution from Microsoft Support in case of dll corruption

Microsoft support has recommended to download a new Windows ISO from a different computer. Make certain you have drivers for you media drives, network interfaces and such. Further research has shown that to obtain a retail version of Windows ISO, run the Windows Media Creation Tool from an earlier version of Windows or even from Ubuntu or MacOS, otherwise, the Media Creation Tool will try to generate an ISO that inherits packages from the current system that it is run from.

  • a final note: Please use ethics when modifying the Windows operating system. The default behavior is that there is no Group Policy editing in Windows Home. By unlocking this package that is not listed as an "official feature" we should use good ethics in efforts to maintain Microsoft intended system behavior. *

  • also note: The only reason we have attempted to use these techniques is to try to correct some malware intrustions on our system that otherwise would be untreatable. Microsoft has not been very helpful in solving our issues. At some point, some of the Microsoft Licensing Parameters should probably become inapplicable since Microsoft hasn't followed through with their end of the Terms Of Service in our case. We were left with no choice but to try to fix this issue ourselves, or else abandon our Fair and Square purchased version of Windows 10 that somehow became severely corrupted by little or no fault of our own.*

13
  • 2
    How is this better than accepted answer?
    – Toto
    May 28, 2018 at 7:58
  • 3
    @Toto:  Isn’t it obvious?  The accepted answer recommends downloading unverified software from an unapproved source, and possibly compromising your system security and license compliance by installing it.  This answer give the right way to do it. May 28, 2018 at 9:03
  • 1
    This partially works - gpedit.msc exists and runs on a Home edition after doing this. However, it appears that the settings in the Administrative Templates branch have no effect because Home editions do not have the infrastructure that transcribes the POL files into the Registry. This seems to work for at least the parts of the Security Settings branch that I tested, though!
    – Ben N
    May 28, 2018 at 16:45
  • 2
    But in fairness to @Toto, this answer has already been edited 14 times in less than 12 hours. It essentially started out as little more than Buy an upgraded version of Windows that includes gpedit functionality. While that may technically be accurate, it doesn't really fulfill the spirit of the original question.
    – Run5k
    May 28, 2018 at 19:23
  • @Toto: To buy an upgraded version of Windows is a sure fix. The comments on the accepted answer verify what Scott mentioned. Windows has updated past the point of the third party patch's ability to add gpedit. The safest way is to buy an upgrade.
    – user908668
    May 29, 2018 at 11:15
5

This worked for me:

Create a new batch file that has this content in it (based on this link), and run as admin :

@echo off 
pushd "%~dp0" 

dir /b %SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~3*.mum >List.txt 
dir /b %SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~3*.mum >>List.txt 

for /f %%i in ('findstr /i . List.txt 2^>nul') do dism /online /norestart /add-package:"%SystemRoot%\servicing\Packages\%%i" 
pause
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .