Key points
- Local Group Policy can be applied to administrators only using the MMC snap-in method in Windows Pro, Enterprise, or Education.
- A custom Group Policy Editor targets the local Administrators group to provide precise user-specific control.
- Running gpupdate /force or a reboot applies new GPO settings, and gpresult /r verifies them.
- Admin accounts can be secured by restricting scripts, apps, and system changes via admin-only policies.
This guide demonstrates how to apply Local Group Policy to administrators in Windows 11 and Windows 10. This setup enables IT teams to enforce security settings and restrict actions specifically for admin accounts, preventing misuse of elevated privileges, reducing security risks, and ensuring compliance with organizational policies.
If you’re looking to apply Local Group Policy to a different user group or specific user, check out:
- How to Apply Local Group Policies to Specific Users
- How to Apply Local Group Policy to Non-Administrators
Otherwise, you may proceed to the step-by-step tutorial below.
If you’re looking to apply Local Group Policy to non-administrators instead, check out our video guide: How to Apply Local Group Policy to Non-Administrators in Windows 11 & 10.
Local Group Policy in Windows explained
Group Policy is a Windows feature that is available in Pro, Enterprise, and Server variants of the operating system. It allows for the administration and configuration of Windows devices, including system and user settings, as well as configuring third-party applications. It is the way to manage Windows’ security policies, user permissions, network configuration, and user profiles.
Group Policies are made up of Group Policy Objects (GPOs). Each individual GPO contains a number of configuration options that change how the associated Windows feature or application functions. GPOs are applied as either a Computer Configuration which applies to a specific Windows device and any user who is logged in to it, or User Configuration, which applies to a single user account while they are logged in, regardless of which device they are logged in to.
Some configurations that are commonly implemented using Windows Group Policies and Group Policy Objects include:
- Automatically configuring network shares and shared printers.
- Setting login and logoff scripts.
- Automatically configuring web browser settings like proxies and whether scripts are allowed or not.
- Configuring anti-malware and firewall rules.
- Blocking access to certain applications or Windows features.
Types of Windows Group Policy
- Local Group Policy: Local group policies apply only to the specific device they are configured on. Importantly, Local Group Policy Objects are overridden by domain Group Policy Objects from Group Policy in Active Directory.
- Group Policy in Active Directory: Group Policy Objects can be created in a Windows Active Directory domain. These policies are scoped based on the user or device Organizational Unit within Active Directory. Active Directory is usually deployed to manage Windows devices and users in an enterprise environment.
💡Keep in mind that local GPOs can be overridden by domain-level GPOs.
Prerequisites for applying Group Policy to user groups
Home editions of Windows do not let you manage Local Group Policy. To use Local Group Policy or Group Policy in Active Directory, you will need to be running one of the following versions of Windows:
- An administrator user account.
- Windows 7/8 Pro, Enterprise, or Ultimate (EOL versions).
- Windows 10 (EOL) & 11 Pro, Enterprise, or Education.
Note that risks apply when using end-of-life (EOL) or unsupported versions of the Windows OS.
Steps for applying Local Group Policy to administrator
To manage Group Policy for administrators, you can create a custom Microsoft Management Console (MMC) window that edits group policies only for users in the Administrators group:
1. Right-click on the Start button, then select Run.
2. Click OK, and click Yes on the User Account Control Prompt to open the MMC.
3. Select File in the navigation menu, and then select Add/Remove Snap-In.
4. Choose Group Policy Object Editor, and click the Add → button.
5. Click on the Browse button in the Select Group Policy Object window.
6. Select the Users tab.
Note: If you don’t see the tab, your system may be domain-joined or restricted by policy.
7. Select the Administrators group and click Ok.
8. Click Finish in the Select Group Policy window and then press OK in the Add or Remove Snap-ins window.
9. The MMC window will now show your Local Group Policy Editor for administrative users in the navigation pane.
10. Select File then Save As, and save this custom MMC view to the desktop as Group Policy Editor for administrative users.
Make sure to test your policy on a non-critical admin account first to avoid unintentional lockouts or system restrictions.
Now, you can skip all of the above steps whenever you want to manage user policies and use the MMC file saved to your desktop to go directly to the Group Policy Editor for administrators.
Policy example: Hide the Internet Explorer desktop icon for admins
Any changes you make to group policy in this MMC window will apply only to administrative users on the local system. For example, you could configure a group policy that hides the desktop Internet Explorer icon for Administrators:
- Open the MMC using the file you created above.
- Navigate to Local Computer/Administrators Policy/User Configuration/Administrative Templates/Desktop.
- Double-click on the Hide Internet Explorer icon on desktop settings.
- Select Enabled in the setting window and then click OK.
- To apply the changes, reboot or run gpupdate /force in PowerShell or the Command Prompt.
To revert any changes, repeat the same process, but instead of selecting Enabled in the Hide Internet Explorer icon on desktop setting, select Disabled or Not Configured.
To avoid deployment issues, thoroughly test any GPOs after configuring them to ensure that they have the intended effect.
For a visual rundown of these steps, here’s a video guide: How to Apply Local Group Policy to Administrators in Windows 11 & 10.
Local Group Policy in Windows explained
Group Policy is available in Pro, Enterprise, and Server variants of Windows. Primarily, the feature enables IT teams to manage the security policies, user permissions, network configuration, and user profiles of a Windows device.
Group Policies are made up of Group Policy Objects (GPOs), each with its own configuration options that change how the associated Windows feature or application operates. Policies can be enforced locally or via Active Directory:
- Local Group Policy: Local group policies apply only to the specific device on which they are configured. Notably, Local Group Policy Objects are overridden by domain Group Policy Objects in Active Directory.
- Group Policy in Active Directory: Group Policy Objects can be created in a Windows Active Directory domain. These policies are scoped to the user or device Organizational Unit within Active Directory. Active Directory is usually deployed to manage Windows devices and users in an enterprise environment.
These GPOs are applied as either a Computer Configuration, which applies to a specific Windows device and any user who is logged in to it, or a User Configuration, which applies to a single user account while they are logged in, regardless of which device they are logged in to.
Some configurations that are commonly implemented using Windows Group Policies and Group Policy Objects include:
- Automatically configuring network shares and shared printers.
- Setting login and logoff scripts.
- Automatically configuring web browser settings like proxies and whether scripts are allowed or not.
- Configuring anti-malware and firewall rules.
Blocking access to certain applications or Windows features.
These common configurations help IT teams maintain security, consistency, and control across their Windows infrastructure.
Troubleshooting common Local Group Policy issues
If the settings configured in Local Group Policy do not have any effect, you can troubleshoot by:
- Checking the policies are assigned to the Administrators user group.
- Making sure that the users you want the settings to apply to are Administrators on the local machine.
If the settings are being applied to non-administrative users instead of (or in addition to) administrative users, check that:
- You’re not assigning the group policy to the machine (which covers all users on it) instead of a user group.
- Your group policy targets the intended user group.
To list all group policies that are in effect, run gpresult /r from the command line. If there are conflicting group policies the most restrictive policy is always applied.
Reset Group policies (advanced)
If you make an error when configuring group policies (and can’t figure out which specific policy to undo to put things right), you can revert all group policies by running the following commands as an administrator:
gpupdate /force
secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose
You’ll need to restart your device to complete the process. The command above resets both the computer configuration and user configuration policies.
If you’re unable to open the Local Group Policy Editor, check out the video “How to Open the Local Group Policy Editor in Windows 10 and Windows 11” for alternative methods.
Why apply Local Group Policy to administrators only?
Usually, Group Policy is deployed in an Active Directory domain to provide centralized control of multiple Windows devices. However, smaller deployments can benefit from creating and managing group policies locally to:
- Prevent administrator accounts from being used for non-administrative purposes by blocking apps.
- Prevent non-administrative users from executing scripts.
- Prevent standard users from accessing mail clients or other potential malware vectors while logged in as an administrator.
Additionally, this setup can also prevent end users from changing system settings and breaking system compatibility or dependencies, as well as disabling critical features such as firewalls or antivirus software.
How to effectively manage Windows Group Policy at scale?
Administering a fleet of Windows devices over a trusted network and tool can speed up deployment at scale. For instance, Windows Group Policy in Active Directory allows you to manage thousands of endpoints and apply group policies depending on the device’s location, type, or the user’s role.
With that said, a dedicated endpoint management solution for enterprises takes this further with centralized control, automation, and enhanced security. This proactive approach is also increasingly critical in the modern cybersecurity landscape, where gaps in your network or device configuration can lead to more costly and disruptive incidents.
Related topics:
