Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. GroupPolicyUsers
FolderRisk: Caution

GroupPolicyUsers C:\Windows\System32\GroupPolicyUsers

Multiple local Group Policy objects (MLGPO): user configuration settings for a group or a specific user, one folder per SID.

Updated on By AltF4 Formation

What it’s for

GroupPolicyUsers holds the local Group Policy objects specific to certain users or groups. Multiple Local Group Policy Objects (MLGPO) let you apply different user configuration settings to administrators, non-administrators or a specific user, on a machine that is not domain-managed or on top of domain policy.

What it contains

  • Subfolders named by SID: S-1-5-32-544 for the Administrators group, S-1-5-32-545 for the Users group, or the SID of a specific user.
  • In each one, a User folder with a Registry.pol file.
  • The folder only exists if a per-user or per-group policy has been created.

Risks and best practices

  • Create these policies with gpedit.msc (the “Group Policy Object Editor” snap-in) instead of editing the files.
  • To reset all local policies, delete GroupPolicy and GroupPolicyUsers as administrator, then run gpupdate /force. Back up first.
  • A non-administrator must not be able to write here, so check the ACLs during an audit.

Useful commands

Fenêtre de terminal
# List per-user or per-group local policies (folders named by SID)
Get-ChildItem -Force "$env:windir\System32\GroupPolicyUsers" -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime


# Find the account matching a SID
([System.Security.Principal.SecurityIdentifier]"S-1-5-32-545").Translate([System.Security.Principal.NTAccount])
Fenêtre de terminal
:: Which policies actually apply to the current user?
gpresult /scope user /r

Report a mistake