How can I protect local group policy? I want to put a password on gpedit.msc in Windows, how can I do this?


You don't.

What you do is using a policy, you simply disable certain groups from editing the policy and then put the users in that group.

Putting a password on this file is just a false sense of security as you are just disabling them from running this - but, whilst this is the main way of editing the policy, there are many other ways (and, they can always copy it from another computer or similar).

  • +1 for the concept, but i'd like to see screenshows of how to set ACLs on the security policy (i certainly can't find it) – Ian Boyd Apr 1 '12 at 19:27
  • @IanBoyd - Its there keep looking – Ramhound Apr 2 '12 at 13:01
  • @Ramhound Right-clicking on Local Computer Policy, and clicking Properties, has no Security Tab. i know it can't be inside the Local Computer Policy, Computer Configuration, or User Configuration, because then you wouldn't be able to set ACLs on the Local Computer Policy. There may be other tools in Windows to edit the security of the Local Computer Policy, but i don't know where they are. And since i'm not the person who asked the question i don't care enough to ask a new SU question. Maybe William could provide the answer. – Ian Boyd Apr 2 '12 at 13:49
  • @IanBoyd the fact that you can apply it locally isn't really there for this purpose... Home computers are designed for Guests, Users and Administrators - guests can barely do anything, users slightly more and administrators - anything. Policies are designed for large companies where an administrator would select to disable it, then, apply that to their users. As for where it is, I honestly can't remember... it is a local policy that you assign by groups... I will try to find it now. – William Hilsum Apr 2 '12 at 20:18

Well the thing is you don't keep the password for Group policy. But you can work around it. If you are the admin of the computer and don't want other user to change the setting than just log in on that user account and Run the following code on Command prompt.

REG add "HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}" /v Restrict_Run /t REG_DWORD /d 1 /f 

The catch is you should be able to log in to another account once to run this code. once you have run this code login to your admin account and open group policy:

User Configuration>Administrator templates>System. Search for something like: Access to programs for working to prevent the registry.(I had to translate, my computer is in german language) Double click on it and click on activate and ok. This is make sure that user will not be able to run registry to change the settings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.