Operating Systems‎ > ‎Windows‎ > ‎

Group Policies

Taken from Maximum PC

Microsoft has a penchant for hiding some of the strongest, most versatile tools for managing their operating system in places you’d never find by yourself. Given that the average computer user is pretty dumb, this makes sense —some of the tools can easily screw up your computer pretty badly. But you, Maximum PC reader, are not one of the clueless masses, so we’re going to trust you with this: The Local Group Policy Editor.

In this article, we’ll show you how to use the Local Group Policy Editor to tweak every aspect of your PC. We’ll also show you how to use Multiple Local Group Policy Objects on a Windows Vista or 7 computer to create different policies for different user accounts, allowing you to create an account just for guests, or for the kids.

Group Policy Image

Making a system restore point

The Local Group Policy Editor is a powerful tool, capable of putting a lock on nearly any of your computer’s capabilities. Now, as long as you’re careful and don’t go flipping virtual switches all willy-nilly, you should be able to prevent doing catastrophic damage to your operating system. But just in case, now would be a great time to create a system restore point.

Launching the Local Group Policy Editor

As a high-expertise tool, you won’t find the Local Group Policy Editor anywhere in your system’s control panel. Instead, open the Run dialogue box from the start menu, type gpedit.msc and hit enter. The Local Group Policy Editor will open.

Group Policy Image

At first glance, the Group Policy Window looks like a standard file explorer, with a tree view on the left side and folder view on the right. At the bottom of the right-hand section of the window, there are two tabs. If this is the first time you’ve opened the Group Policy Editor, the Standard tab should be selected. Click on the Extended tab.

Group Policy Image

Now, you should see a third element in the middle of the window. This will give you (semi) detailed information about any policy or folder that you click on. Since there’s thousands of policy options in the editor, these explanations are a must. Also, the information panel tells you for which versions of Windows that policy has an effect.

Group Policy Image

Where to look

With thousands upon thousands of settings in the group policy editor, it can be a little intimidating to try and look around. Some sections of the editor have more meat to them than others, though. For instance, for most of the Windows tweaks you might want to perform, User Configuration has more useful setting than Computer Configuration. Also, In either section, the Administrative Templates subsection is the most useful. This section contains all the registry-based settings, which will allow you to tweak aspects of how Windows looks and operates.

How to Change a Setting

To enable a policy setting, just double-click on it, and then select the radial button labeled “Enabled” and click Ok. With some settings, before you actually see any change, you’ll need to close the group policy editor, then log out and log back in to Windows.

Group Policy Image

Here are a few ideas for how to use Group Policy to tweak your rig:

Customize Your Start Menu

In any version of Windows, one of the most frequently used parts of the GUI is the start menu, where you can launch programs and access all the vital locations in your PC’s file structure. You can customize the start menu, to an extent, by editing the Taskbar and Start Menu Properties in the control panel, but if you really want to get down to the nitty gritty you’ll need to use the Group Policy Editor.

You can find all of the policies associated with the start Menu in User Configuration > Administration Templates > Start Menu and Taskbar. There are tons of options to look at here, and the info panel will help you figure out what they all do, but here’s a few interesting ones, to get started:

Group Policy Image

Add Search Internet link to Start Menu

Enabling this setting will add a link to the start menu search bar which opens your default browser and performs a search for your term. Requires Windows 7 or Server 2008.

Group Policy Image

Turn off user tracking

Don’t like that your PC keeps track of which programs you run and which documents you open? Enable this policy setting to tell Windows not to keep track of this information. Turning off tracking will disable features that use the information, like the frequently used program lists.

Turn off automatic promotion of notification icons to the taskbar

Are  you the type that likes to keep your taskbar host to only the icons that you specify? If so, turn this setting on to keep Windows from letting any icons into the taskbar without your permission. This is only available in Windows 7.

Group Policy Image

Change Your Login Screen Background

Using the Group Policy Editor, you can change the image used as the background of the login screen.To do so, simply go the Computer Configuration > Administrative Templates > System > Logon folder, and enable the Always use custom logon background setting.

Now, if you place and image called backgroundDefault.jpg in C:\Windows\System32\oobe\info\backgrounds Windows will use that image as the background of the logon screen.



Using Multiple Local Group Policy Objects

The group policy editor, as you’ve used it so far, is excellent for making changes to an entire system. But what should you do if you want to have several accounts on a single machine with different policies for each? For instance, what if you want to have an account for your friends to use, but you don’t want them installing stuff on your computer, or you’d like an account for your kids, which can’t change settings or delete files? Windows has made this possible in Windows Vista and later, with Multiple Local Group Policy Objects.

You are able to manage multiple policy objects by creating a custom control console, using the Microsoft Management Console. This console will contain 4 group policy editor "snap-ins," each with a different domain. One will effect the entire system, one will effect all administrator accounts, one will effect all non-administrator accounts, and one will effect a specific user account that you have created. When there are contradictions in group policy, the most narrowly-defined group takes precedence. That is to say, if you define one policy for the entire computer, and a conflicting policy for a single account,the policy specified for the single account will be the one applied.

Here’s how to set up a custom control panel with the ability to assign group policy to individual accounts:

1. If you don’t already have a secondary account on your computer, create a new one. This can be done by right clicking on My Computer and selecting Manage, then navigating to the Local Users and Groups > Users tab, and right-clicking. Make sure that the new account you create is not an administrator.

Group Policy Image

2. From your computer’s administrator account, open the Run dialogue, and type mmc.exe.

Group Policy Image

3. In the window labeled Console1, click on File > Add/Remove Snap-in.

Group Policy Image

4. From the Available Snap-ins list in the dialogue box that opens up, select Group Policy Object Editor, then click Add.

Group Policy Image

5. Another dialogue box, labeled Select Group Policy Object will open up. Under “Group Policy Object,” the Local Computer option should be selected. Click Finish.

Group Policy Image

6. Repeat steps 4-5, but when you get to the Select Group Policy Object dialogue box, click Browse and select the group called Administrators. Repeat this process two more times, once selecting the group called Non-Administrators and once selecting the individual account you want to be able to create policies for.

Group Policy Image

7. Finally, in the Console1 window, click File > Save, and choose a name and a location to save your custom console to. You’ll run this console whenever you want to edit group policy settings.

Group Policy Image

Now, you've got a single control console with policy editors that will allow you to specify exactly which policies apply to which users. Stricly speaking, you don't need the consoles for Administrator and non-Administrator Users if you just want to make one account with different policies, but it doesn't hurt to include them in the console, and including them illustrates how you can apply group policy to user groups, as well as individual users.