Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. GroupPolicy
FolderRisk: Caution

GroupPolicy C:\Windows\System32\GroupPolicy

C:\Windows\System32\GroupPolicy: the computer's local Group Policy Object (LGPO), edited with gpedit.msc and applied before domain policies.

Updated on By AltF4 Formation

What it’s for

GroupPolicy holds the computer’s local Group Policy Object (LGPO), the one you edit with gpedit.msc. It is applied before domain policies, which are not here: they live in AD DS and in the SYSVOL folder of domain controllers. The folder may not exist until a local policy has been configured.

What it contains

  • Machine and User: computer and user configuration settings, in Registry.pol (binary), along with startup and logon scripts.
  • gpt.ini: the policy version tracking, updated on every change.
  • Local objects specific to a group or a user are not here. They sit in the neighboring GroupPolicyUsers folder, with one subfolder per SID (S-1-5-32-544 for Administrators, S-1-5-32-545 for non-administrators).

Risks and best practices

  • Change the policy with gpedit.msc or LGPO.exe (Security Compliance Toolkit), not in the files: Registry.pol is binary and gpt.ini has to follow its changes.
  • On a domain machine, a domain policy wins over the local one in a conflict. A setting that comes back after you delete the local policy therefore comes from the domain, and gpresult points to it.
  • To reset the local policy, back up the folder, delete its contents, then run gpupdate /force. This erases every local setting and its effects.

Useful commands

Fenêtre de terminal
# Contents (read-only)
Get-ChildItem "$env:windir\System32\GroupPolicy" -Recurse -Force -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime


# Report of applied policies, with the source GPO of each setting
gpresult /h "$env:TEMP\gpresult.html"


# As administrator: back up before resetting
Copy-Item "$env:windir\System32\GroupPolicy" "$env:USERPROFILE\Desktop\GroupPolicy-backup" -Recurse -WhatIf


# As administrator: reset the local policy (test with -WhatIf)
# Remove-Item "$env:windir\System32\GroupPolicy\*" -Recurse -Force -WhatIf
# gpupdate /force

Folder contents

Files 2

Report a mistake