Simple questions: What is the Local Group Policy Editor and how do I use it?
Local Group Policy Editor is a Windows tool used by IT administrators. It is mostly unknown to casual computer users. Local Group Policy Editor lets you control the sign-in and shutdown processes, the settings and the apps that users are allowed to change or use, in Windows. This can be useful if you want to manage rules for the other users of your computer. Read on to find out what exactly the Local Group Policy is and how you can work with Local Group Policy Editor:
What is the Local Group Policy?
By definition, the Group Policy is a Windows feature that offers you a centralized way of managing and configuring the Windows operating system, the programs and user settings from the computers that are connected to the same domain. Group Policies are most useful if you are a network administrator and you need to enforce certain rules or settings on the computers or users found in the network that you manage.
Local Group Policy is a variant of Group Policy that also lets you control individual computers, as opposed to all the computers that are registered on a domain. A good example is your home computer with Windows 10, Windows 8.1 or Windows 7. That means that this tool can be useful to home users as well as to network administrators. To put it into simple terms, you should think about Local Group Policy as a set of rules that govern how Windows works on your computer or device.
Can I use Local Group Policy Editor?
Because Local Group Policy Editor is a rather advanced tool, you should know that it's not available in the Home or Starter editions of Windows. You can access it and use it only in:
- Windows 10 Pro and Windows 10 Enterprise
- Windows 7 Professional, Windows 7 Ultimate and Windows 7 Enterprise
- Windows 8.1 Professional and Windows 8.1 Enterprise
A few examples of what you can do with the Local Group Policy Editor
Let's list a few examples of what you can do with Local Group Policy Editor. You can configure Windows settings and you can enforce them so that the users on your computer cannot change them afterward. Here are just a few examples:
Allow users to access only some of the applications found on your computer.
Block users from using removable devices (ex. USB memory sticks) on the computer.
Block users' access to the Control Panel and to the Settings app.
Hide specific elements from the Control Panel.
Specify the wallpaper used on the Desktop and block users from changing it.
Block users from enabling/disabling LAN connections or block them from changing the properties of the computer's LAN (Local Area Network) connections.
Deny users to read and/or write data from CDs, DVD, removable drives etc.
Disable all the keyboard shortcuts that start with the Windows key. For instance, Windows + R (which opens the Run windows) and Windows + X (which opens the power user menu) stop working.
These are just a few examples. The Local Group Policy Editor from Windows allows you to configure many other settings.
How to open the Local Group Policy Editor in Windows
In Windows, an easy way to open the Local Group Policy Editor is to use the search. Enter "gpedit.msc" as a search text and then click the "gpedit" search result.
For all the methods, read 11 ways to open the Local Group Policy Editor in Windows.
NOTE: The Local Group Policy Editor looks and offers the same options, settings, and features regardless of whether you use Windows 7, Windows 8.1 or Windows 10. That's why, for simplicity, from now on we only use screenshots taken in Windows 10.
How to work with the Local Group Policy Editor
The Local Group Policy Editor is split into two panels: the left panel contains the Local Group Policy settings displayed in categories, while the right side panel shows the contents of the active category. The Local Group Policies are categorized into two large sections:
- Computer Configuration - holds Local Group Policy settings that control policies that are applied computer-wide, regardless of the user or users logged in.
- User configuration - holds Local Group Policy settings that control user policies. These policies are applied to users, rather than the whole computer. While it's outside the scope of this guide, you should know that user policies are applied for users regardless of which computer from your network they log into.
Both the Computer Configuration and the User Configuration categories are split into three sections:
- Software Settings - contains software policies and, by default, it should be empty.
- Windows Settings - holds Windows security settings. It's also the place where you can find or add scripts that should run when Windows starts or shuts down.
- Administrative Templates - has lots of settings that control many aspects in terms of how your computer works. This is the place where you can see, change and even enforce all kinds of settings and rules. To give you a few examples, you can manage how the Control Panel, Network, Start Menu, and Taskbar work and what users can change when using them.
How to edit Windows policies using the Local Group Policy Editor
In order for you to easily understand the process involved in editing policies, we are going to use an example. Let's say that you want to set a specific default wallpaper for your desktop, one that's going to be set for all existing or new users on your Windows computer.
To get to the Desktop settings, you will have to browse the User Configuration category from the left panel. Then, go to the Administrative Templates, expand Desktop and select the inner Desktop settings. On the right panel, you will see all the settings that you can configure for the currently selected Administrative Template. Note that, for each setting available, you have two columns on its right side:
- the State column tells you which settings are Not configured and which are Enabled or Disabled.
- the Comment column shows you the comments you or another administrator made for that setting.
The left side of this panel also shows detailed information about what a specific setting does and what are its effects on Windows. This information is displayed in the left part of the panel, whenever you select a certain setting. For instance, if you select the Desktop Wallpaper, on the left you will see that it can be applied on Windows versions from Windows 2000 on, and you can read its Description, which tells you that you can specify "the desktop background ('wallpaper') displayed on all users' desktops. [...]". If you want to edit a setting, in our case the Desktop Wallpaper, double click/tap on that setting, or right click/tap and hold on it and then select Edit from the contextual menu.
A new window that bears the name of the setting you selected is now opened. Inside that window, you can choose to Enable or Disable the setting, or you can choose to leave it "Not configured". If you want to enable the setting, first select it as Enabled. Then, read its Help section and, if there's also an Options section, make sure you fill in the details that are asked of you. Note that this window can include different options, depending on the setting you choose to edit. For instance, in our example about specifying a Desktop Wallpaper, we have to provide the path to the image file we want to set as wallpaper and we must select how we would like it to be positioned. Then, we can add a comment (if we want to - this is entirely optional) and, finally, we have to press the Apply or the OK button in order to activate our setting.
Disabling a setting or changing its status to "Not Configured" involves the simple selection of one of these options. As we mentioned earlier, different settings have different options. For instance, the Scripts you can set Windows to run when it starts or when it shuts down might look completely different.
Click or tap on Computer Configuration, then on Windows Settings and Scripts (Startup/Shutdown). Select the Startup or Shutdown in the right panel, and click on tap the link Properties in the right panel. Alternatively, double-click Startup or Shutdown.
Click or tap on "Add…" to add new scripts to the selected process.
In this case, you won't Enable or Disable anything. Instead, you can add or remove various scripts from being run at Windows Startup or Shutdown.
When you finish, click or tap OK.
Navigate to the Local Group Policy Editor and check what settings it offers, because there are lots of them. Consider it your playground for a while, as there are lots of things you can test.
What kind of changes do you want to make in Local Group Policy Editor?
The Local Group Policy Editor is a complex tool that makes it easy for you to set all kinds of policies and rules for your computers and their users. We hope that we gave you a taste for what you can accomplish with this tool and since you know the basics and how to navigate it, you can try it on your own. What kind of changes do you want to make in Local Group Policy Editor? Share with us your experience in a comment below.