ExamWizardzExamWizardz
Start free
Operating Systems

What is Group Policy Editor?

The Group Policy Editor (gpedit.msc) is the Windows console that sets enforced policies on one PC under Computer Configuration and User Configuration.

What is the Group Policy Editor?

The Local Group Policy Editor is the MMC snap-in that edits the local Group Policy object stored on a single computer. Policies differ from ordinary settings: they are enforced, users cannot change them in Settings or Control Panel, and they persist across sign-ins and restarts. In a domain, administrators set the same kinds of options centrally in Group Policy Objects (GPOs) linked to sites, domains and organizational units, using the Group Policy Management Console (gpmc.msc) rather than gpedit.

Opening it and edition limits

Press Win+R and type gpedit.msc, approving the UAC prompt. The editor is included in Windows Pro, Enterprise and Education but not in Windows Home, which is one of the practical differences between editions. Local Security Policy (secpol.msc) shows only the security settings branch and has the same edition limit.

Layout

The tree has two halves, and each contains Software Settings, Windows Settings and Administrative Templates:

  • Computer Configuration applies to the machine no matter who signs in, and is processed at startup. Examples: Windows Update behavior, BitLocker options, password and account lockout policy (Windows Settings > Security Settings > Account Policies), startup and shutdown scripts.
  • User Configuration applies to user accounts and is processed at sign-in. Examples: hiding or restricting Control Panel and Settings, blocking the registry editor or Command Prompt, logon and logoff scripts, desktop restrictions.

Most settings sit under Administrative Templates, which are defined by .admx files in C:\Windows\PolicyDefinitions. Each policy is Not Configured, Enabled or Disabled, and its help text explains exactly what each state does. The All Settings node and the filter options help you find a policy when you know its name but not its folder.

Applying and checking policy

  • gpupdate refreshes policy, and gpupdate /force reapplies every setting rather than only the changed ones. Some settings still need a sign-out or restart, and gpupdate will offer one.
  • gpresult /r summarizes which GPOs applied to the computer and the user, and gpresult /h report.html saves a detailed report. Run it elevated to include the computer half.
  • Domain-joined computers also refresh policy in the background, by default about every 90 minutes with a random offset.

Local policy vs. domain policy

Policies apply in the order local, site, domain, then organizational unit (often remembered as LSDOU). When two settings conflict, the one applied last wins, so a domain or OU policy overrides a local setting made in gpedit. If a gpedit change does not stick on a domain-joined PC, run gpresult to find the domain GPO that sets the same option.

Troubleshooting cues

  • An option is greyed out or Windows says some settings are managed by your organization: a policy is set. Check gpresult and the editor before trying other fixes.
  • "Windows cannot find gpedit.msc" on a home PC: the edition is Home; upgrade to Pro or use another method.
  • Policy settings are stored in the registry's Policies keys. Change them in the editor rather than by hand, or the policy will simply apply again.

Group Policy Editor on the CompTIA A+ exam

The Group Policy Editor is one of the Windows tools in Core 2 (220-1202) objective 1.4, and its absence from Home is one of the edition differences in objective 1.3. Know the gpedit.msc command, Computer Configuration versus User Configuration, and the gpupdate /force and gpresult /r commands. Cues: enforce a password or lockout rule on a standalone Pro PC, think gpedit or secpol; a policy change is not taking effect, think gpupdate /force, then gpresult; gpedit is missing, think Windows Home.

Studying for CompTIA (Operating Systems)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

account lockout

Account lockout is a policy that blocks sign-in to an account after a set number of failed password attempts, to slow or stop password-guessing attacks.

Active Directory

Active Directory is a directory service developed by Microsoft that enables the management of identities, computers, and other resources within a network or domain.

Group Policy

Group Policy is a set of rules and configurations that administrators can define and apply to user accounts and computer systems within an Active Directory (AD) domain to centrally manage and secure the computing environment.

MMC

MMC (Microsoft Management Console) is the Windows framework, mmc.exe, that hosts administrative snap-ins such as Device Manager and Event Viewer.

Windows editions

Windows editions are the versions of one Windows release, such as Home, Pro, Enterprise and Education, that differ in features and licensing.

Windows Registry

The Windows Registry is the hierarchical database storing settings for Windows, hardware, services, apps and each user profile, edited with regedit.

← Back to the full CompTIA glossary