How to Open Group Policy Editor in Windows 11

To open Group Policy Editor in Windows 11, press the Windows logo key + R to open the Run box, type gpedit.msc, and press Enter. The Local Group Policy Editor opens with Local Computer Policy at the top of the left pane. You can also select Start, type gpedit.msc, and select Edit group policy. The editor is part of Windows 11 Pro, Enterprise and Education. Windows 11 Home doesn’t include it, so on Home you’ll need to upgrade to Pro or make your change in Settings instead.

Applies to: Windows 11 Pro, Enterprise and Education (with notes for Windows 11 Home). Checked against Microsoft Support and Microsoft Learn on October 7, 2026.

What Group Policy Editor is

Group Policy is a set of rules that controls how Windows behaves for a computer and for the people who sign in to it. The Local Group Policy Editor is the Microsoft Management Console (MMC) tool, or “snap-in,” that you use to view and change those rules on one PC. Its file name is gpedit.msc, which is why that’s what you type to open it.

Unlike most options in Settings, a policy is enforced. When a policy controls a setting, the matching switch in Settings or Control Panel usually can’t be changed by the user. That makes the editor useful for locking down a shared family PC or a small-office computer, and it’s also why it’s worth changing policies carefully.

Before you start

Two things decide whether the editor will open for you: your Windows 11 edition and your account type.

Check your Windows 11 edition

1. Right-click Start and select Settings, or press the Windows logo key + I.
2. Select System, then select About.
3. Look under Windows specifications. If the edition is Windows 11 Pro, Enterprise or Education, you can use the steps below. If it says Windows 11 Home, skip to If you have Windows 11 Home.

Use an account that can make changes

Microsoft’s documentation says security policy settings require administrator rights on the device. If you sign in with a standard account, ask the person who manages the PC to sign in, or to approve the change when Windows asks for an administrator’s permission. On a work or school PC, the IT department may manage policies centrally, which is covered in the troubleshooting section.

Open Group Policy Editor with the Run box

This is the quickest route and works the same way every time.

1. Press the Windows logo key + R on your keyboard. The Run box opens.
2. Type gpedit.msc in the box. Include the .msc ending, because that’s the actual file name of the console.
3. Press Enter. If Windows asks for permission to make changes, approve it, or enter an administrator’s password if you’re using a standard account.
4. The Local Group Policy Editor window opens. In the left pane you’ll see Local Computer Policy, with Computer Configuration and User Configuration beneath it.

If you’re new to the Run box, our guide on how to open the Run box in Windows 11 shows the other ways to reach it.

Other ways to open Group Policy Editor

From Start search

1. Select Start on the taskbar.
2. Start typing gpedit.msc.
3. Select Edit group policy in the results.

Search is handy if you can’t remember the exact command, because the result is labeled with a plain name rather than the file name.

From Command Prompt, PowerShell or Windows Terminal

If you already have a command window open, type gpedit.msc and press Enter. The editor opens in its own window, and the command window stays available for follow-up commands such as gpupdate, described later in this guide.

As a snap-in, to set policies for specific users

Running gpedit.msc edits the policy for the whole computer. Windows also keeps separate local policies for administrators, for non-administrators and for individual user accounts. To edit one of those, load the editor into a blank console:

1. Press the Windows logo key + R, type mmc, and press Enter. An empty console window opens.
2. On the File menu, select Add/Remove Snap-in.
3. In the Add or Remove Snap-ins dialog box, select the Group Policy editor snap-in in the list and select Add.
4. In the Select Group Policy Object dialog box, select Browse.
5. Select Users, then choose Administrators, Non-Administrators or a specific user account.
6. Select Finish, then close the snap-in dialog. The console now shows the policy for the group or user you picked.

Policies you set this way apply only to the chosen accounts. This is useful when you want to restrict a child’s account without affecting your own administrator account.

Find your way around the editor

The left pane is a folder tree, and the right pane lists the settings inside whichever folder you select.

• Computer Configuration holds settings that apply to the PC itself. Microsoft says these are applied when the computer starts and during the periodic background refresh.
• User Configuration holds settings that apply to people who sign in. These are applied at sign-in and during the background refresh.
• Administrative Templates, inside each of those, is where most everyday settings live, such as Windows Update options. For example, Windows Update policies are under Computer Configuration > Administrative Templates > Windows Components > Windows Update.
• Windows Settings > Security Settings, under Computer Configuration, contains Account Policies (password and account lockout rules) and Local Policies (audit policy, user rights and security options).

Change a setting

1. Expand the folders in the left pane until you reach the area you want, then select the folder.
2. In the right pane, double-click a setting to open it. The help text in the window explains what the setting does, which versions of Windows support it, and what happens when you enable or disable it. Read it before you change anything.
3. Choose Not Configured, Enabled or Disabled.
4. Select OK to save the change.

Be careful with double negatives. A setting named “Turn off” something does the opposite of what you might expect: choosing Enabled turns the feature off. For a deeper walk-through with examples, see our guide on how to edit Group Policy in Windows 11.

Before you change a setting, write down its full folder path and its current state. If something doesn’t behave as you expected, you can go straight back to the same setting and restore the state you noted.

Apply the change and confirm it worked

Windows doesn’t always apply a new policy the moment you select OK. According to Microsoft, computer settings are applied at startup, user settings at sign-in, and Windows checks for policy changes in the background every 90 minutes by default, with a random delay of up to 30 minutes added.

To apply your change now:

1. Open Command Prompt, PowerShell or Windows Terminal.
2. Type gpupdate /force and press Enter. This reapplies all policy settings, not just the ones that changed.
3. Wait for the command to finish. If the setting you changed applies only at sign-in or at startup, sign out or restart before you test it.

A few useful variations, all documented by Microsoft:

• gpupdate /target:computer or gpupdate /target:user refreshes only computer or only user settings.
• gpupdate /logoff signs you out after the update, which some settings need before they take effect.
• gpupdate /boot restarts the PC after the update, for settings that apply only at startup.

To see which policies are actually in effect, type gpresult /r and press Enter. It shows a summary of the Resultant Set of Policy (RSoP), the combined result of every policy that applies to your account and PC. Add /scope user or /scope computer to see only one half of the report.

If you have Windows 11 Home

Windows 11 Home doesn’t include the Local Group Policy Editor, so typing gpedit.msc won’t open it. You have two legitimate options.

Option 1: Use Settings for the change you need

Many everyday changes that people look up in Group Policy also have a switch in Settings. Press the Windows logo key + I and use the search box in Settings to look for the option by name. If it’s there, you don’t need Group Policy at all.

Option 2: Upgrade to Windows 11 Pro

Upgrading to Pro adds features such as the Local Group Policy Editor, BitLocker and Remote Desktop. Microsoft recommends activating Windows 11 Home first.

1. Open Settings > System > Activation. Check that the edition shown is Windows 11 Home and that it’s activated.
2. If you don’t have a product key, expand Upgrade your edition of Windows. Next to Upgrade in the Microsoft app, select Open Store, sign in with your Microsoft account, and complete the purchase.
3. If you already have a Windows 11 Pro product key, select Change next to Change product key, sign in as an administrator if asked, enter the 25-character key, and select Next. Use a Pro key, not a Home key.
4. Let Windows install Pro and restart the PC. Then open the editor with gpedit.msc as described above.

If you don’t see an upgrade option, the PC may already be running Pro, or an upgrade may not be offered for that device. Microsoft’s page on upgrading Windows Home to Windows Pro has the current details.

Avoid scripts, installers and “gpedit enabler” downloads that claim to add the editor to Home. Microsoft doesn’t provide them, they modify system components, and they aren’t a supported way to get the editor.

Troubleshooting

Windows can’t find gpedit.msc, or search shows nothing

First check the spelling, including the .msc ending. If it’s spelled correctly, check your edition under Settings > System > About. On Windows 11 Home this is expected, because the editor isn’t included. Use the Settings app or upgrade to Pro as described above.

A setting in Settings is greyed out or says it’s managed

That usually means a policy is controlling it. Microsoft notes that when a local setting is inaccessible, a Group Policy Object currently controls it. Open the editor, find the policy that matches the setting, and return it to the state you want. If you didn’t set the policy yourself, it may come from your organization.

On a work or school PC, your changes don’t stick

Windows applies the local policy first, then policies from the organization’s network (site, domain and organizational unit). Microsoft states that policies from these Active Directory containers override local policy settings, so a local change can be replaced at the next refresh. Ask your IT department instead of fighting the organization’s policy. IT admins manage domain policy with a separate tool, Group Policy Management (gpmc.msc), not the local editor.

You get an access or permission error

Sign in with an administrator account, or ask the PC’s administrator to approve the change. Standard accounts can’t change computer-wide security settings.

The change didn’t take effect

Run gpupdate /force, then sign out and back in for user settings or restart for computer settings. Run gpresult /r to check whether the policy is listed as applied. If another policy, such as one from your organization, sets the same option, that policy wins.

Frequently asked questions

What is the command to open Group Policy Editor in Windows 11?

The command is gpedit.msc. Type it in the Run box (Windows logo key + R), in Start search, or in Command Prompt, PowerShell or Windows Terminal, then press Enter.

Is Group Policy Editor available in Windows 11 Home?

No. It’s included in Windows 11 Pro, Enterprise and Education. On Home, use the Settings app for the change you need, or upgrade to Pro through Settings > System > Activation.

What’s the difference between gpedit.msc and secpol.msc?

secpol.msc opens Local Security Policy, which contains only the Security Settings part of the policy, such as Account Policies and Local Policies. gpedit.msc opens the full editor, which includes those same security settings under Computer Configuration > Windows Settings > Security Settings plus all the Administrative Templates.

What’s the difference between gpedit.msc and gpmc.msc?

gpedit.msc edits the policy stored on your own PC. gpmc.msc is Group Policy Management, which IT administrators use to manage policies for an Active Directory domain. Home and small-office users only need gpedit.msc.

Do I need to restart after changing a policy?

Not always. Running gpupdate /force applies most changes right away. Settings that apply only at sign-in or startup take effect after you sign out or restart.

How do I undo a Group Policy change?

Open the same setting again and choose the state it had before you changed it, then select OK and run gpupdate /force. Writing down the path and original state before each change makes this quick.

Once the editor is open, the next step is finding the right policy: start in Administrative Templates, read each setting’s help text, and change one setting at a time so you can tell what each change does.

Related: how to remove an organization from Windows 11.

Related: how to enable long paths in Windows 11.

Related: how to get to administrative tools in Windows 11.