41

I want to make some changes to Windows that require using the Group Policy Editor (gpedit.msc).

Unfortunately the Group Policy Editor is not included with the Starter Edition, Home and Home Premium editions of Windows.

How can I install it?

  • I had been under the impression that gpedit was missing because these editions lack the group policy infrastructure to do anything with group policy registry entries. This Q&A suggests that isn't the case; that as long as you create the entries, either manually or via gpedit, those policies will be implemented. Is that correct? – fixer1234 May 15 '16 at 3:47
  • @fixer1234 For things I've done with it yes. Mostly enabling event logging for different things. – DavidPostill May 15 '16 at 6:48
  • 1
    I should have done more research. It looks like group policy is basically just a collection of settings (no supplementary infrastructure). A reference guide is available from Microsoft in spreadsheet form. That and other information available from here. – fixer1234 May 15 '16 at 8:01
  • 1
    @fixer1234 That's a very useful link! I will add to my answer. Thanks. – DavidPostill May 15 '16 at 8:03
29

How do I install gpedit.msc on Windows Starter Edition, Home and Home Premium?

I used the following procedure to successfully install gpedit.msc on Windows 7 64 bit Home Premium.

Notes:

  • Confirmed as working on Windows 10 by Moab

  • It apparently works on Windows 8, Windows 8.1 and Windows 10 as well. I have not personally tested this.

UPDATE: According to our readers, this tool also works fine in Windows 8, Windows 8.1 and Windows 10.

Today we are going to share a simple installer which installs the required system files in Windows so that you can enjoy Group Policy Editor in all Windows 7 editions.

  1. First download the setup file using following link:

    Download Group Policy Editor Installer

    You'll find the download link in right-side section of the above mentioned page: download link

  2. After downloading the ZIP file, extract it using WinRAR or 7-Zip.

  3. Run the extracted setup.exe file.

    It will install the files and you'll be able to access gpedit.msc command via RUN or Start Menu search box.

Note:

  • For Windows 7 64-bit (x64) users! You'll also need to go to "SysWOW64" folder present in "C:\Windows" folder and copy "GroupPolicy", "GroupPolicyUsers" folders and gpedit.msc file from there and paste them in "C:\Windows\System32" folder.

If you are getting "MMC could not create the snap-in" error message while running gpedit.msc, check out following steps to fix the problem. Basically it happens when your username in Windows contains more than one word.

  1. Run the installer and leave it at the last step (do not click on the "Finish" button).

  2. Now go to C:\Windows\Temp\gpedit\ folder.

  3. If you are running 32-bit (x86) edition of Windows 7, right-click on x86.bat file and choose "Open With -> Notepad" option. If you are running 64-bit (x64) edition of Windows 7, right-click on x64.bat file and choose "Open With -> Notepad" option.

  4. You'll find a total of 6 lines containing the following string in the file:

    %username%:f

  5. Edit those lines and replace %username%:f with "%username%":f

    Original: icacls %WinDir%\SysWOW64\gpedit.dll /grant:r %username%:f

    New: icacls %WinDir%\SysWOW64\gpedit.dll /grant:r "%username%":f

  6. Save and run the file (right-click -> Run as Administrator).

  7. That's it. You'll have working gpedit.msc.

Source How to Enable "Group Policy Editor" (gpedit.msc) in Windows 7 Home Premium, Home Basic and Starter Editions?


Group Policy Settings Reference Guide

Microsoft has updated and made available as a download, the complete Group Policy Settings Reference Guide for Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows Server 2003 SP2, Windows Server 2008 R2 and Windows Server 2012 R2.

The download is available in the form of spreadsheets for different operating systems. So you can download the spreadsheet only for those operating system/s which you may be interested in.

Spreadsheet Download Link

...

What is also very useful in these spreadsheets, is that it also lists the registry keys which are affected when the settings are changed. Of course, you can always use the Group Policy Settings Search, to know the registry key and value name that backs a particular policy setting, but these spreadsheets put them all in one place.

The Administrative Template spreadsheet contains three columns that provide more information about each policy setting’s behavior related to reboots, logoffs, and schema extensions. These columns are the following:

  1. Logoff Required: A “Yes” in this column means that the Windows operating system requires the user to log off and log on again before it applies the described policy setting.
  2. Reboot Required: A “Yes” in this column means that the Windows operating systems requires a restart before it applies the described policy setting.
  3. Active Directory Schema or Domain Requirements: A “Yes” in this column means that you must extend the Active Directory schema before you can deploy this policy setting.
  4. Status: A “New” in this column means that the setting did not exist prior to Windows Server 2012 and Windows 8. It does not mean that the setting applies only to Windows Server 2012 and Windows 8. Refer to the column entitled “supported on” to determine to which operating system the policy setting applies.

Source Group Policy Settings Reference Guide for Windows 10/8.1/7/Server

  • 17
    deviantart is a wierd place to get it from. It also probably uses an exe from windows professional. gpedit not being installed is on purpose. – Journeyman Geek Dec 26 '15 at 11:22
  • @JourneymanGeek I know, but it is useful to have it installed ;) – DavidPostill Dec 26 '15 at 11:23
  • 4
    The problem is that you are not obtaining the Group Policy Editor from Microsoft, as well as that it could possibly be altered. – Tamara Wijsman Jan 19 '17 at 18:17
  • @TomWijsman , while those are certainly valid points this entire process has been very thoroughly vetted by DavidPostill and Moab. Needless to say, if you aren't comfortable with the limiting factors you don't need to utilize it, but it seems to be a viable option. – Run5k Jan 19 '17 at 18:30
  • 1
    --- not working for me after the lastest Windows Update :-( . I didn't diagnose a lot, but it just didn't leave me with a new copy of gpedit.msc at all. The windows\system32 folder was also wonky, making the "GroupPolicy" folder magically invisible... not Hidden, just not shown in Windows Explorer or dir in a command window. It makes me feel they are trying to prevent this. – Mike M Jun 2 '17 at 8:44
19

Windows (at least Windows 10 home) comes with Group Policy Editor packages, but it is disabled by default. You can install it just like any other optional feature using dism.

The Group Policy package files can be found in

%SystemRoot%\servicing\Packages

With filenames matching

Microsoft-Windows-GroupPolicy-ClientExtensions-Package*.mum
Microsoft-Windows-GroupPolicy-ClientTools-Package*.mum

And command for installing would follow the following format:

dism /online /norestart /add-package:"%SystemRoot%\servicing\Packages\{{PackageFileName}}"

/online used to tell it to apply to the running OS

/norestart tells it to not auto reboot

After installing these gpedit.msc will be available. No need to download an external executable that you have to trust or find out if it is safe or not.

  • Both of those are language packs....installing then doesn't enable group editor on Windows 10 Home – Ramhound Jul 14 '17 at 20:32
  • Well Group Policy Editor was enabled on my machine (from a clean install) after doing this and nothing else. Used on earlier version (104** or something like that) and latest update.(1703, 15063). So if they are just language packs, then installing them forced gpedit to be enabled. Either way it is how I got it working on the Home versions I used. – Patrick Evans Jul 15 '17 at 1:24
  • So does this work or not? I don't have a home edition to try it with. – Pimp Juice IT Sep 23 '17 at 5:52
  • 7
    Here is for those impatient for /f "tokens=*" %G IN ('dir /b "%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-Client*.mum"') do (dism /online /norestart /add-package:"%SystemRoot%\servicing\Packages\%G") – mlt Mar 10 '18 at 4:33
  • 2
    Works for win10 Home – deerchao Aug 27 '18 at 4:25
6

Since Alternative to gpedit.msc for Windows Home editions? is marked as a duplicate of this question (although it technically isn't), I'll post an alternative to gpedit here.

Every group policy corresponds to a registry value, which you can edit with regedit. The correspondences, including the different values, are documented on gpsearch.azurewebsites.net. It is apparently maintained by a Microsoft employee, so it's pretty reliable.

2

Buy an upgraded version of Windows that includes gpedit functionality or unlock the included gpedit package.

The lower grades of Windows versions do not include gpedit as a feature while the more expensive ones do. On the Microsoft website, the feature sets are explained for each version of Windows.

Gpedit can be unlocked, which indicates that Microsoft gives another way. If you don't want to buy the upgrade, you can add gpedit.msc On Home edition, Gpedit may not allow Administrative Template changes to have any effect.

David Postill linked to a script and some have found that it doesn't work. If you have just now tried to install the script from Davit Postill's answer, then follow the steps here to reverse some of the changes made by the script. Or, you can skip to the next part Adding gpedit.msc.

Reverse the script changes from Deviant Art

It is possible that the third party software from Deviant Art was legitimate when it was compiled, however it is now over two years since this question was posted and the third party software may have become incompatible with today's Windows infrastructure.

The third party script from Deviant Art creates a folder and backs up a copy of the gpedit associated files. Navigate to %WinDir%\SysWOW64\GPBAK.

To reverse some of the effects of the script, copy the backed up files back into the %WinDir%\SysWOW64 folder. Namely the gpedit.dll, fde.dll, gptext.dll, appmgr.dll, fdeploy.dll.

Go to the %WinDir%\System32\ folder and remove or replace the gpedit.msc that was manually copied over. You may want to delete gpedit.msc from the %WinDir%\SysWOW64 folder also.

Remove your account from the security permissions that were added to these files if necessary.

The %WinDir%\SysWOW64\GroupPolicy, %WinDir%\SysWOW64\GroupPolicyUsers folders are created and modified by the script as well. There are reverses to be made here.

Unfortunately, the Deviant Art script doesn't appear to make backups of these directories. We are not sure how to handle this. You can try deleting the folders possibly. You can maybe delete them from the %WinDir%\SysWOW64 folder as well.

After reversing the script and then adding the gpedit.msc feature, we fount that Start Menu -> Windows Administrative Tools -> Local Security Policy app was now present. We couldn't get the gpedit.msc to load directly from command line until Resetting the Installation from Settings -> Updates -> Recovery.

Adding gpedit.msc

The Group Policy package files can be found in

%SystemRoot%\servicing\Packages

Look for file names matching:

Microsoft-Windows-GroupPolicy-ClientExtensions-Package*.mum and Microsoft-Windows-GroupPolicy-ClientTools-Package*.mum

Get the names of those .mum files and one by one run the following dism command using the Package File Names.

dism /online /add-package:"%SystemRoot%\servicing\Packages\{{PackageFileName}}"

If asked to restart, then press the Y key to restart and finish adding any remaining packages.

It may also be necessary to re-register dll files if gpedit.msc gives a missing token error. Otherwise, it may be better to avoid re-registering the dll. To correct a missing token error, try navigating to %WinDir%\System32\ and run this command taken from this social.technet.microsoft.com article:

For /F %s in ('dir /b *.dll') do regsvr32 /s %s

It may be necessary to Reset This PC for a clean gpedit.msc. Back up your files first.

An alternative solution from Microsoft Support in case of dll corruption

Microsoft support has recommended to download a new Windows ISO from a different computer. Make certain you have drivers for you media drives, network interfaces and such. Further research has shown that to obtain a retail version of Windows ISO, run the Windows Media Creation Tool from an earlier version of Windows or even from Ubuntu or MacOS, otherwise, the Media Creation Tool will try to generate an ISO that inherits packages from the current system that it is run from.

  • a final note: Please use ethics when modifying the Windows operating system. The default behavior is that there is no Group Policy editing in Windows Home. By unlocking this package that is not listed as an "official feature" we should use good ethics in efforts to maintain Microsoft intended system behavior. *

  • also note: The only reason we have attempted to use these techniques is to try to correct some malware intrustions on our system that otherwise would be untreatable. Microsoft has not been very helpful in solving our issues. At some point, some of the Microsoft Licensing Parameters should probably become inapplicable since Microsoft hasn't followed through with their end of the Terms Of Service in our case. We were left with no choice but to try to fix this issue ourselves, or else abandon our Fair and Square purchased version of Windows 10 that somehow became severely corrupted by little or no fault of our own.*

  • 2
    How is this better than accepted answer? – Toto May 28 '18 at 7:58
  • 1
    @Toto:  Isn’t it obvious?  The accepted answer recommends downloading unverified software from an unapproved source, and possibly compromising your system security and license compliance by installing it.  This answer give the right way to do it. – Scott May 28 '18 at 9:03
  • 1
    This partially works - gpedit.msc exists and runs on a Home edition after doing this. However, it appears that the settings in the Administrative Templates branch have no effect because Home editions do not have the infrastructure that transcribes the POL files into the Registry. This seems to work for at least the parts of the Security Settings branch that I tested, though! – Ben N May 28 '18 at 16:45
  • 1
    But in fairness to @Toto, this answer has already been edited 14 times in less than 12 hours. It essentially started out as little more than Buy an upgraded version of Windows that includes gpedit functionality. While that may technically be accurate, it doesn't really fulfill the spirit of the original question. – Run5k May 28 '18 at 19:23
  • @Toto: To buy an upgraded version of Windows is a sure fix. The comments on the accepted answer verify what Scott mentioned. Windows has updated past the point of the third party patch's ability to add gpedit. The safest way is to buy an upgrade. – Eeshwar Das May 29 '18 at 11:15
1

This worked for me:

Create a new batch file that has this content in it (based on this link), and run as admin :

@echo off 
pushd "%~dp0" 

dir /b %SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~3*.mum >List.txt 
dir /b %SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~3*.mum >>List.txt 

for /f %%i in ('findstr /i . List.txt 2^>nul') do dism /online /norestart /add-package:"%SystemRoot%\servicing\Packages\%%i" 
pause

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.