Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. GroupPolicy
  5. User\Registry.pol
FileRisk: Caution

User\Registry.pol C:\Windows\System32\GroupPolicy\User\Registry.pol

User\Registry.pol: local Group Policy settings (user configuration) for every account, written by gpedit.msc and applied under HKCU.

Updated on By AltF4 Formation

What it’s for

The Registry.pol in the User folder stores the registry-based settings of the local Group Policy user configuration. Edited with gpedit.msc, it applies to every account signing in to the machine, and Windows writes its values to each user’s HKCU hive (under Software\Policies). It only exists once a local user policy has been set.

What it contains

  • A binary file starting with the PReg signature and a version, followed by entries shaped like [key;value;type;size;data] in Unicode (UTF-16).
  • Only registry-based administrative settings are stored here; security settings are in the secedit database and logon scripts in Scripts.
  • It is the counterpart of Machine\Registry.pol for HKLM. Local policies targeting a group or account (MLGPO) live in GroupPolicyUsers.
  • In a domain, the reference copy of a GPO is in SYSVOL, under Policies\{GUID}\User\Registry.pol.

Risks and best practices

  • Do not edit it by hand: the binary format is easily corrupted. Use gpedit.msc, or LGPO.exe from the Security Compliance Toolkit to export, parse and reimport it across a fleet.
  • To undo a setting, set it back to Not Configured in gpedit.msc rather than deleting the file.
  • Domain policy is processed after local policy: in a conflict, the domain GPO wins. Diagnose with gpresult.

Useful commands

Fenêtre de terminal
:: Read the file as text (LGPO.exe from the Security Compliance Toolkit)
LGPO.exe /parse /u C:\Windows\System32\GroupPolicy\User\Registry.pol


:: Force reprocessing and see the applied policies
gpupdate /force
gpresult /scope user /v

Report a mistake