Key points
- Use Local Group Policy on Windows 10/11 to manage specific user or group settings.
- For granular control, use a custom MMC to target specific users or groups.
- Use GPOs to define computer or user-level policy enforcement.
- Consider third-party endpoint solutions for robust policy deployment and compliance monitoring.
This guide provides detailed instructions on how to apply Local Group Policies to specific users or groups in Windows 11 and Windows 10. This setup is ideal for retaining control over which certain apps and functionality can be used or modified by certain users.
If you’re looking to apply Local Group Policy to a different user group or specific user, check out:
- How to Apply Local Group Policies to Administrators
- How to Apply Local Group Policy to Non-Administrators
Otherwise, you may proceed to the step-by-step tutorial below.
💡If you want a visual walkthrough, you can watch our video guide: How to Apply Local Group Policy to Non-Administrators in Windows 11 & 10
Get an in-depth explanation of how to manage and deploy group policies.
📖 Read our “Group Policy Management Console Overview“.
Understanding Local Group Policy in Windows
Group Policy is a Windows feature that enables the centralized administration of Windows devices, including system and user settings, as well as application configuration. This includes managing security policies, user permissions, network configuration, and user profile management. Group Policy is only available in Pro and Enterprise versions of Windows — if you’re using Windows 11 Home or Windows 10 Home, you won’t be able to access this functionality.
Group Policies contain Group Policy Objects (GPOs), which are sets of configuration options that affect how the associated Windows feature or application behaves. GPOs are set up as either Computer Configuration (which applies to a specific Windows device and any user logged in to that device) or User Configuration (which applies to only a single specific user account for the duration of their login to a Windows device).
You may configure Local Group Policy for an individual user using Local Windows Group Policies and Group Policy Objects to:
- Automatically connect to network shares and online printers.
- Run scripts when the user logs on or off.
- Configure web browser security settings.
- Make sure that the firewall and antivirus are enabled (and that they can’t be turned off).
- Block access to specific applications or Windows features (for example, to disable access to the Command Prompt for certain users).
Windows Group Policy can be set up on the local machine, or as part of a Windows domain for enterprise usage:
- Local Group Policy: Local group policies are only applied to the specific machine they are set up. In the case of a conflict, Local Group Policy Objects are overruled by Domain Group Policy Objects from Group Policy in Active Directory.
- Group Policy in Active Directory: Group Policy Objects can also be defined in a Windows Active Directory domain (for example in a small business, education, or enterprise scenario). This grants you centralized control of users and computers connected to a network. Group policies in Active Directory are scoped based on the user’s or device’s Organizational Unit.
Why apply Group Policy to specific users?
Group Policy is typically configured in enterprise environments as part of an Active Directory domain to control Windows devices within a larger corporate IT infrastructure. However, it is also useful for enforcing targeted actions, such as:
- Setting default applications, such as a secure web browser or mail client.
- Configuring Windows Updates and making sure they are installed in a timely manner.
- Enforcing system settings to prevent users from disabling important security features, such as anti-malware and Windows Firewall.
Additionally, this restriction can stop unauthorized users from installing apps or running scripts, and restrict specific users to approved applications, such as kiosk or demonstration setups.
Prerequisites to set Local Group Policies for certain users
Home editions of Windows do not let you manage Local Group Policy. To use Local Group Policy or Group Policy in Active Directory, you will need to be running one of the following versions of Windows:
- An administrator user account.
- Windows 7/8 Pro, Enterprise, or Ultimate (EOL versions).
- Windows 10 (EOL) & 11 Pro, Enterprise, or Education.
Note that risks apply when using end-of-life (EOL) or unsupported versions of the Windows OS.
Creating users and groups in Windows 11
To add, remove, or edit local users and groups on a Windows PC, follow these steps:
1. Right-click on the Start button and click Run.
2. Enter lusermgr.msc and click OK to open the Local User Manager.
3. To add a new user, click “Users” in the sidebar, then select “Action” from the menu bar, and finally, click “New User”.
4. To add a new group, click Groups in the sidebar, then click Action > New Group.
5. Under Members, click the Add… button to select the users you want to add to a new group.
6. Enter the usernames of the users you want to add to the group, and press OK.
Once users and groups are added, target them with Local Group Policies. For efficiency, add users to a group to manage settings collectively, rather than configuring them individually.
Meanwhile, if you want to delete a user, watch our video guide: How to Delete User Profiles in Windows 10 and Windows 11.
Steps for applying Local Group Policy to specific users
To apply Local Group Policies to individual users in Windows, you need to create a custom MMC window that edits group policies only for those users or a specified group:
1. Right-click on the Start button, then select Run.
2. Enter mmc, click OK, and click Yes on the User Account Control Prompt to open the MMC.
3. Click File in the menu bar, then select Add/Remove Snap-In…
4. Select Group Policy Object Editor from the list of Available snap-ins.
5. Click the Add → button to add it to the list of Selected snap-ins.
6. Click on the Browse button in the Select Group Policy Object window.
7. Select the Users tab and then select the specific users or user group and then press OK.
8. Click Finish in the Select Group Policy window and then press OK in the Add or Remove Snap-ins window.
9. The MMC window will now show your Local Group Policy Editor for specific users in the navigation pane.
10. Navigate to File → Save As, and save this custom MMC view to the desktop as Group Policy Editor for specific users (for convenience, include the group name in the MMC name).
Now, you can skip all of the above steps whenever you want to manage user policies for that user or group, and use the MMC file saved to your desktop.
Any group policy changes you make in this MMC window will apply only to the specified users or group. For example, you could configure a group policy preventing members of a certain group from accessing the control panel:
1. Open the MMC using the file you created above.
2. Navigate to Local Computer/specific users Policy/User Configuration/Administrative Templates/Control Panel.
3. Double-click Prohibit access to Control Panel and PC settings.
4. Select Enabled in the setting window and then click OK.
5. To apply the changes, reboot or run the command gpupdate /force from PowerShell or the command prompt.
These changes can be rolled back by revisiting the Prohibit access to Control Panel and PC settings setting. Then, select Disabled or Not Configured.
It is important to test any Group Policy Objects you create to make sure they have the desired effect.
Troubleshooting common Local Group Policy issues
To troubleshoot setting up Local Group Policy per-user, you can check the following:
- Make sure that the policies are assigned to the intended user or group.
- Confirm that the users you are trying to create policies for are members of the group the policy is assigned to.
To troubleshoot further, run gpresult /r to list all currently active group policies. Note that in case of a conflict, the most restrictive of the conflicting policies takes effect.
If you make a mistake when creating Local Group Policies or can’t narrow down the source of a problem, you can revert all group policies by running the following commands as an administrator:
gpupdate /force
secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose
After running the commands above and restarting your Windows PC, the computer configuration and user configuration policies will have been reset to their default.
Centralize and automate group policies with NinjaOne Windows Endpoint Management.
How to manage Windows Group Policy at enterprise scale
Using Local Group Policy at scale can be time-consuming and prone to errors. For enterprise environments, setting up an Active Directory domain enables centralized management of Group Policy and Windows configurations, providing greater control and visibility. To maintain consistency, reliability, and security across your IT infrastructure, a dedicated endpoint management solution can streamline administration and reduce risks.
Related topics:
