Editing Group Policy in Windows uses the Local Group Policy Editor (gpedit.msc), accessible on Pro, Enterprise, and Education editions via Run, Search, or Command Prompt.
Most Windows administrators rely on the Group Policy Editor daily, yet the fastest way to open it isn’t always the one you’d expect. The tool controls everything from password requirements to desktop restrictions across dozens of settings — but only if you can get to it. Below you’ll find every access method for the local editor and the separate console used in Active Directory environments, plus the installation steps if you’re running a Home edition.
What Is the Local Group Policy Editor?
The Local Group Policy Editor (gpedit.msc) is a Microsoft management console that lets you configure operating system, security, and application settings at the machine level. It organizes policies under two main branches: Computer Configuration (applies to the machine regardless of who logs in) and User Configuration (applies to individual user accounts). Each branch contains subcategories like Administrative Templates, Security Settings, and Windows Components.
For enterprise environments with multiple machines, the Group Policy Management Console (gpmc.msc) handles Group Policy Objects across Active Directory domains, sites, and OUs. The local editor is the right tool when you need to change settings on a single computer that isn’t domain-managed.
Who Can Use the Group Policy Editor? Edition Limits
The Local Group Policy Editor ships built-in on Windows 10 Pro, Windows 11 Pro, Enterprise, and Education editions. It does not come with Windows 10/11 Home by default — users on Home editions will see “Windows cannot find gpedit.msc” when they try to open it. A workaround exists (covered below), but Microsoft officially includes the editor only on the higher-tier editions.
Administrator privileges are required regardless of edition. Even on Pro, a standard user account cannot open or modify policy settings without an elevation prompt.
How Do You Open the Local Group Policy Editor?
Six methods work on any edition that has the editor installed. The Run dialog is the most consistent across Windows versions and doesn’t depend on the Start menu layout.
| Method | Steps |
|---|---|
| Run Dialog | Press Win + R, type gpedit.msc, click OK |
| Start Search | Click Start, type Edit group policy, select the result |
| Settings Search | Right-click Start > Settings, search Edit group policy, click the result |
| Control Panel | Open Control Panel > Windows Tools, search Edit group policy |
| Command Prompt | Open CMD or PowerShell, type gpedit.msc, press Enter |
| Start Menu Control Panel | Open Control Panel, type group policy or gpedit, click the result |
The Run Dialog method is the fastest and works identically on all supported Windows versions. Once the console opens, navigate the tree on the left to find the policy you need.
Editing a Policy Setting in the Editor
Once gpedit.msc is open, the actual edit takes about ten seconds per setting. Navigate through Computer Configuration or User Configuration to the category that contains the policy — Administrative Templates is the most common location. Double-click the policy name in the right pane to open its Properties dialog.
Each policy offers three states: Not Configured (the default — no change is applied), Enabled (the policy takes effect with its configured options), and Disabled (the policy is explicitly turned off). Select the state you need, adjust any sub-options if available, and click OK. Changes take effect immediately on the local machine without a reboot in most cases, though some policies — particularly security settings — may require a restart or a gpupdate /force command from an elevated Command Prompt to apply.
Group Policy Management Console for Active Directory
Managing policies across multiple domain-joined machines requires the Group Policy Management Console (gpmc.msc). This tool runs on Windows Server and can be added to Windows 10/11 Pro and Enterprise as an RSAT (Remote Server Administration Tools) capability.
To install the GPMC on Windows 11 via an elevated Command Prompt, run:
DISM.exe /online /add-capability /CapabilityName:Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0Alternatively, navigate to Settings > Optional Features > Add a Feature and select Group Policy Management Console. After installation, open it from Start by searching Group Policy Management.
Inside the console, each Group Policy Object (GPO) must be linked to a Site, Domain, or Organizational Unit before it takes effect. Right-click the target container and select Link an Existing GPO; to edit a specific GPO, expand Group Policy Objects, right-click it, and choose Edit.
Editing Group Policy on Windows Home: When the Built-In Editor Is Missing
Windows 10 and 11 Home editions don't ship with gpedit.msc, but the necessary package files exist in the system image. Installing them takes two DISM commands run from an elevated Command Prompt (right-click CMD and select Run as administrator). Run each command one at a time:
FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package~*.mum") DO (DISM /Online /NoRestart /Add-Package:"%F")FOR %F IN ("%SystemRoot%\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientExtensions-Package~*.mum") DO (DISM /Online /NoRestart /Add-Package:"%F")The same operation works via PowerShell as Administrator:
Get-ChildItem "C:\Windows\servicing\Packages\Microsoft-Windows-GroupPolicy-ClientTools-Package*.mum" | ForEach-Object { dism.exe /online /norestart /add-package:"$_" }No reboot is required. After the commands complete, gpedit.msc opens normally using any of the methods above.
| Edition | Built-In Editor | Installation Option |
|---|---|---|
| Windows 10/11 Home | No | DISM method (above) |
| Windows 10/11 Pro | Yes | Not needed |
| Windows 10/11 Enterprise | Yes | Not needed |
| Windows 10/11 Education | Yes | Not needed |
| Windows Server (any) | GPMC included | Server Manager |
Common Mistakes That Trip Up New Users
Several gotchas cause the Group Policy Editor to behave differently than expected. NinjaOne's guide on opening the editor covers the basics, but these five errors are the most frequent.
Assuming Home users have it. The "Windows cannot find gpedit.msc" error on Home editions means the editor simply isn't installed — the DISM method above resolves this. Changes not applying. In Active Directory, a GPO produces zero effect until it is linked to a Site, Domain, or OU — editing the GPO without linking it does nothing. Skipping the refresh. After changing a local or domain policy, affected machines need a reboot or gpupdate /force to pick up the new settings. Using the wrong console. gpedit.msc edits local machine policies; gpmc.msc manages domain-level GPOs. Mixing them up wastes time. Manual registry edits. Changing policy-related registry keys directly with PowerShell or Regedit can destabilize Windows if a value is wrong — always use the Group Policy Editor interface instead.
Editing Group Policy Safely
Stick to the official editor rather than third-party scripts or manual registry tweaks. The gpedit.msc interface validates inputs before applying them, while a direct registry write can leave the system in an inconsistent state. Before making changes, note the original setting — Not Configured is always a safe revert point. For domain environments, test new GPOs on a small OU before deploying domain-wide. Administrative rights are required for every step; if you lack them, the editor won't launch regardless of the method you choose.
References & Sources
- NinjaOne. "How to Open the Local Group Policy Editor in Windows 11." Covers all access methods for opening gpedit.msc on supported Windows editions.