none
Command Line, PowerScript or Registry Key to Enable/Disable Group Policy? RRS feed

  • Question

  • In Windows 7 you could enable or disable group policy by simply changing a registry key. This key does not work in Windows 10.  I am trying to enable group policy (Computer and User) via a batch file or script. Is this possible in Windows 10?

    Monday, October 9, 2017 4:36 PM

All replies

  • Would you mind sharing that key? Normally, I would expect it work identically on 10.
    Monday, October 9, 2017 5:55 PM
  • The registry entry should work, unless it changed in windows 10.  You can also use the PolicyFileEditor powershell module, which is almost the same thing, but the changes will show up in the group policy utilities.  And you can see what registry entries get changed.  https://www.powershellgallery.com/packages/PolicyFileEditor/2.0.2 http://brandonpadgett.com/powershell/Local-gpo-powershell/


    • Edited by JS2010 Monday, October 9, 2017 6:15 PM
    Monday, October 9, 2017 6:14 PM
  • Hi,

    Based on my test, you could not find the MMC key value in Windows 10 as Windows 7. But you could use the command below to enable and disable group policy.

    To Disable Group Policy:

    REG add "HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}" /v Restrict_Run /t REG_DWORD /d 1 /f

    To Enable Group Policy:

    REG add "HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}" /v Restrict_Run /t REG_DWORD /d 0 /f

    To finish please close command prompt window.

    Hope it will be helpful to you


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, October 10, 2017 9:40 AM
    Moderator
  • I tried this. This is the exact key I was talking about. It only enables or disables (restricts) the "ability" to turn group policy on or off through the MMC, but does not actually enable or disable the Group policies set for the computer or user.
    Tuesday, October 10, 2017 1:01 PM
  • "but does not actually enable or disable the Group policies set for the computer or user." - right. just as with win7. That reg key is just for restricting the mmc, but won't do anything else.
    Tuesday, October 10, 2017 1:09 PM
  • Hi EcoTronix,

    How to change group policy from the command line? Use LGPO.exe tool to check. https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/

    There is some command that you can use for do many group policy tasks. https://technet.microsoft.com/en-us/library/ee461027.aspx

    If it's only Administrative Templates settings, the easiest way is to replace the registry.pol files (%Systemroot%\System32\GroupPolicy\ and %Systemroot%\System32\GroupPolicyUsers)


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 1, 2017 2:04 PM
    Moderator
  • You can modify c:\windows\system32\grouppolicy\gpt.ini

    Add or modify the line with the word "Options"

    Options=0 Running all the policies

    Options=3 Disabled user and machine policies

    and next: gpupdate /force

    Example of gpt.ini

    [General]
    gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}{DB159913-A5EC-4974-B435-36983CFC0F15}]
    Version=15728888
    gPCUserExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{DB159913-A5EC-4974-B435-36983CFC0F15}]
    Options=3

    Thursday, June 28, 2018 8:44 AM