Machine\Registry.pol C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Binary file of local Group Policy settings for the computer configuration; written by gpedit.msc, applied under HKLM.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

Registry.pol holds the Registry-based settings of local Group Policy for the computer configuration. gpedit.msc writes it, and when policy is processed Windows applies its values under HKLM. LGPO.exe, shipped with Microsoft’s Security Compliance Toolkit, can parse and import it.

What it contains

A binary file in the “PReg” format: a signature header, then entries made of a key, a value, a type and data.
The “Administrative Templates” settings and other Registry-based settings. Security settings are elsewhere, in .inf files.
For the user configuration, see GroupPolicyUsers and the neighboring User folder.

Risks and best practices

Change settings with gpedit.msc, LGPO.exe or domain GPOs: the binary format is not meant to be edited by hand.
Deleting the file does not necessarily remove values already applied. After a deletion, run gpupdate /force and check the Registry.
The file gives away hardening choices and disabled protections, so treat it as sensitive configuration.
Domain GPOs do not use this file. They go through SYSVOL and the policy client.

Useful commands

# Computer policies actually applied
gpresult /scope computer /r

# Decode the file (download LGPO.exe with the Security Compliance Toolkit)
.\LGPO.exe /parse /m "$env:windir\System32\GroupPolicy\Machine\Registry.pol"

# The file only exists if a local computer policy is set
Get-Item -Force "$env:windir\System32\GroupPolicy\Machine\Registry.pol" | Select-Object FullName, Length, LastWriteTime

# Reset the local policy (as administrator); simulate the deletion first
Remove-Item "$env:windir\System32\GroupPolicy\Machine\Registry.pol" -WhatIf
gpupdate /force

Report a mistake