10 ways to tweak Windows 7 using the Local Group Policy Editor

In Windows 7, you can perform some pretty amazing things by using a tool that’s about as hidden as any Windows power tool can be: the Local Group Policy Editor. That Microsoft has buried this program in a mostly untraveled section of the Windows landscape isn’t the least bit surprising, because in the wrong hands, the Local Group Policy Editor can wreak all kinds of havoc on a system. It’s a kind of electronic Pandora’s box that, if opened by careless or inexperienced hands, can loose all kinds of evil upon the Windows world.

Of course, none of this doom-and-gloom applies to you, dear reader, because you’re a cautious and prudent wielder of all the Windows power tools. This means that you’ll use the Local Group Policy Editor in a safe, prudent manner, and that you’ll create a system restore point if you plan to make any major changes. I knew I could count on you.

Put simply, group policies are settings that control how Windows works. You can use them to customize the Windows 7 interface, restrict access to certain areas, specify security settings, and much more. You make changes to group policies using the Local Group Policy Editor, a Microsoft Management Console snap-in. (I’ll note here that the Local Group Policy Editor isn’t available with Windows 7 Home and Windows 7 Home Premium. I’ll show you how to perform the same tweak using the Registry if you’re using those versions.) To start the Local Group Policy Editor, follow these steps:

  1. Click Start.
  2. Type gpedit.msc.
  3. Press Enter.

Figure A shows the Local Group Policy Editor window that appears. (The word Local refers to the fact that you’re editing group policies on your own computer, not on some remote computer.)

Figure A

You use the Local Group Policy Editor to modify group policies on your PC.

Note: This article is available as a PDF download. You can also download the sample chapter “Tweaking the Windows 7 Registry” from the author’s recently published book Windows 7 Unleashed.

1: Locking in delete confirmations

When you delete a file or folder in Windows 7, the system asks you to confirm the deletion. If this extra step bugs you, you can turn it off by right-clicking the desktop’s Recycle Bin icon, clicking Properties, and then deactivating the Display Delete Confirmation Dialog check box.

Now let’s consider this from the opposite point of view. The reason Windows displays the delete confirmation dialog box by default is to prevent you from accidentally deleting a file. You and I are savvy, knowledgeable users, so we know when we want to delete something, but not everyone falls into this boat. If you have young kids or old parents who use Windows, you know that the delete confirmation dialog box is an excellent safeguard for these and other inexperienced users.

In that case, you might be wondering if there’s a way to ensure that a novice user can’t turn off the delete confirmation dialog box. Yes, there is. In fact, are two ways to prevent a user from turning off delete confirmations:

  • Disable the Display Delete Confirmation Dialog check box that appears in the Recycle Bin’s property sheet.
  • Disable the Recycle Bin’s Properties command so that the user can’t display the Recycle Bin’s property sheet.

Follow these steps to implement one of these policies:

  1. In the Local Group Policy Editor, open the User Configuration branch.
  2. Open the Administrative Templates branch.
  3. Display the property sheet of the policy you want to use, as follows:
  • If you want to disable the Display Delete Confirmation Dialog check box, open the Windows Components branch and then click Windows Explorer. Double-click the policy named Display Confirmation Dialog When Deleting Files. If you don’t have access to the Group Policy Editor, open the Registry Editor and create a DWORD setting named ConfirmFileDelete with the value 1 in the following key:
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
  • If you want to disable the Recycle Bin’s Properties command, click Desktop and then double-click the Remove Properties From The Recycle Bin Context Menu policy. If you don’t have access to the Group Policy Editor, open the Registry Editor and create a DWORD setting named NoPropertiesRecycleBin with the value 1 in the following key:
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
  1. Click the Enabled option.
  2. Click OK to put the policy into effect.

2: Disabling the notification area

If you have zero use for the taskbar’s notification area, you can disable it entirely by following these steps:

  1. In the Local Group Policy Editor, open the User Configuration branch.
  2. Open the Administrative Templates branch.
  3. Click the Start Menu And Taskbar branch.
  4. Double-click the Hide The Notification Area policy, click Enabled, and then click OK.
  5. Double-click the Remove Clock From The System Notification Area policy, click Enabled, and then click OK.
  6. Log off and then log back on to put the policy into effect.

If you prefer (or need) to implement this policy via the Registry, first open the Registry Editor (click Start, type regedit, press Enter, and enter your UAC credentials). Then, navigate to the following key:

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer

(If you don’t see the Explorer key, click the Policies key, select Edit | New | Key, type Explorer, and press Enter.)

Now follow these steps:

  1. Select Edit | New | DWORD (32-bit) Value.
  2. Type NoTrayItemsDisplay and press Enter.
  3. Press Enter to open the NoTrayItemsDisplay setting, type 1, and then click OK.
  4. Select Edit | New | DWORD (32-bit) Value.
  5. Type HideClock and press Enter.
  6. Press Enter to open the HideClock setting, type 1, and then click OK.
  7. Log off and then log back on to put the policies into effect.

3: Removing an icon from Control Panel

You can gain a bit more control over the Control Panel by configuring it not to display icons that you don’t ever use or that aren’t applicable to your system.

  1. In the Local Group Policy Editor, select the User Configuration | Administrative Templates | Control Panel branch.
  2. Double-click the Hide Specified Control Panel Items policy.
  3. Click the Enabled option.
  4. Click the Show button to open the Show Contents dialog box.
  5. For each Control Panel icon you want to hide, type the icon name and press Enter.
  6. Click OK to return to the Hide Specified Control Panel Items dialog box.
  7. Click OK. Windows 7 puts the policy into effect.

To perform the same tweak in the Registry, open the following key:

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer

Add a DWORD value named DisallowCpl and set it equal to 1. Also create a new key named DisallowCpl, and within that key create a new String value for each Control Panel icon you want to disable. Give the settings the names 1, 2, 3, and so on, and for each one set the value to the name of the Control Panel icon you want to disable.

4: Showing only specified Control Panel icons

Disabling a few Control Panel icons is useful because it reduces a bit of the clutter in the All Control Panel Items window. However, what if you want to set up a computer for a novice user and you’d like that person to have access to just a few relatively harmless icons, such as Personalization and Getting Started? In that case, it’s way too much work to disable most of the icons one at a time. A much easier approach is to specify just those few Control Panel icons you want the user to see. Here’s how:

  1. In the Local Group Policy Editor, select the User Configuration | Administrative Templates | Control Panel branch.
  2. Double-click the Show Only Specified Control Panel Items policy.
  3. Click the Enabled Option.
  4. Click the Show button to open the Show Contents dialog box.
  5. For each Control Panel icon you want to show, type the icon name and press Enter.
  6. Click OK to return to the Show Only Specified Control Panel Items dialog box.
  7. Click OK. Windows 7 puts the policy into effect.

To perform the same tweak in the Registry, open the following key:

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer

Add a DWORD value named RestrictCpl and set it equal to 1. Also create a new key named RestrictCpl, and within that key create a new String value for each Control Panel icon you want to show. Give the settings the names 1, 2, 3, and so on, and for each one set the value to the name of the Control Panel icon you want to show.

5: Preventing other folks from messing with the Registry

Do you share your computer with other people? How brave! In that case, there’s a pretty good chance that you don’t want them to have access to the Registry Editor. In Windows 7, User Account Control automatically blocks Standard users unless they know an administrator’s password. For other administrators, you can prevent any user from using the Registry Editor by setting a group policy:

  1. In the Local Group Policy Editor, open the User Configuration | Administrative Templates | System branch.
  2. Double-click the Prevent Access To Registry Editing Tools policy.
  3. Click Enabled.
  4. In the Disable Regedit From Running Silently? list, click Yes.
  5. Click OK.

Once you set this policy, you won’t be able to use the Registry Editor, either. However, you can overcome that by temporarily disabling the policy prior to running the Registry Editor.

Yes, you could perform this tweak in Windows 7 Home and Home Premium using the Registry Editor, but then you wouldn’t be able to reverse it because the Registry Editor would be disabled! In my book Windows 7 Unleashed, I provide a script that toggles the corresponding Registry setting on and off; see that book for more info.

6: Disabling Internet Explorer’s Security and Privacy tabs

If you want to prevent a novice user from mucking around in Security and Privacy tabs in the Internet Options dialog box, you can hide them:

  1. In the Local Group Policy Editor, select the User Configuration | Administrative Templates | Windows Components | Internet Explorer | Internet Control Panel branch.
  2. Double-click the Disable The Privacy Page policy.
  3. Click Enabled and then click OK.
  4. Double-click the Disable The Security Page policy.
  5. Click Enabled and then click OK.

Note that the Security Page sub-branch also enables you to set policies for the settings in each zone.

To configure these policies via the Registry Editor, first display the following branch:

HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel

Add a DWORD setting named PrivacyTab and set it to 1; add another DWORD setting named SecurityTab and set it to 1.

7: Customizing the Windows Security window

When you press Ctrl+Alt+Delete while logged on to Windows 7, you see the Windows Security window, which contains the following buttons: Lock This Computer, Switch User, Log Off, Change A Password, and Start Task Manager. Of these five commands, all but Switch User are customizable using group policies. So if you find that you never use one or more of those commands, or (more likely) if you want to prevent a user from accessing one or more of the commands, you can use group policies to remove them from the Windows Security window. Here are the steps to follow:

  1. In the Local Group Policy Editor, open the User Configuration | Administrative Templates | System | Ctrl+Alt+Del Options branch.
  2. Double-click one of the following policies:
  • Remove Change Password — You can use this policy to disable the Change A Password button in the Windows Security window.
  • Remove Lock This Computer — You can use this policy to disable the Lock Computer button in the Windows Security window.
  • Remove Task Manager — You can use this policy to disable the Start Task Manager button in the Windows Security window.
  • Remove Logoff — You can use this policy to disable the Log Off button in the Windows Security window.
  1. In the policy dialog box that appears, click Enabled and then click OK.
  2. Repeat steps 2 and 3 to disable all the buttons you don’t need.

Figure B shows the Windows Security window with only the Switch User button displayed.

Figure B

You can use group policies to customize the Windows Security window.

To perform the same tweak using the Registry , open the Registry Editor and open the following key:

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

Change the value of one or more of the following settings to 1:

DisableChangePassword
DisableLockWorkstation
DisableTaskMgr

To remove the Log Off button via the Registry, open the following key:

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer

Change the value of the NoLogoff setting to 1.

8: Customizing the Places bar

The left side of the old-style Save As and Open dialog boxes in Windows 7 include icons for several common locations: Recent Places, Desktop, Libraries, Computer, and Network.

The area that contains these icons is called the Places bar. If you have two or more folders that you use regularly (for example, you might have several folders for various projects that you have on the go), switching between them can be a hassle. To make this chore easier, you can customize the Places bar to include icons for each of these folders. That way, no matter which location you have displayed in the Save As or Open dialog box, you can switch to one of these regular folders with a single click of the mouse.

The easiest way to do this is via the Local Group Policy Editor, as shown in the following steps:

  1. In the Local Group Policy Editor, open the following branch: User Configuration | Administrative Templates | Windows Components | Windows Explorer | Common Open File Dialog.
  2. Double-click the Items Displayed In Places Bar policy.
  3. Click Enabled.
  4. Use the Item 1 through Item 5 text boxes to type the paths for the folders you want to display. These can be local folders or network folders.
  5. Click OK to put the policy into effect.

If you don’t have access to the Local Group Policy Editor, you can use the Registry Editor to perform the same tweak. Open the Registry Editor and navigate to the following key:

HKCUSoftwareMicrosoftWindowsCurrentVersionPolicies

Now follow these steps:

  1. Select Edit | New | Key, type comdlg32, and press Enter.
  2. Select Edit | New | Key, type Placesbar, and press Enter.
  3. Select Edit | New | String Value, type Place0, and press Enter.
  4. Press Enter to open the new setting, type the folder path, and then click OK.
  5. Repeat steps 3 and 4 to add other places (named Place1 through Place4).

9: Increasing the size of the Recent Documents list

To customize the size of the Start menu’s Recent Items list, follow these steps:

  1. In the Local Group Policy Editor, navigate to the User Configuration | Administrative Templates | Windows Components | Windows Explorer branch.
  2. Double-click the Maximum Number Of Recent Documents policy.
  3. Click Enabled.
  4. Use the Maximum Number Of Recent Documents spin box to specify the number of documents you want Windows 7 to display.
  5. Click OK.

For the Registry equivalent, open the Registry Editor and display the following key:

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer

Create a DWORD setting named MaxRecentDocs and set its value to the number of recent documents you want to display.

10: Enabling the Shutdown Event Tracker

When you select Start | Shut Down, Windows 7 proceeds to shut down without any more input from you (unless any running programs have documents with unsaved changes). That’s usually a good thing, but you might want to keep track of why you shut down or restart Windows 7, or why the system itself initiates a shutdown or restart. To do that, you can enable a feature called Shutdown Event Tracker. With this feature, you can document the shutdown event by specifying whether it is planned or unplanned, selecting a reason for the shutdown, and adding a comment that describes the shutdown.

To use a group policy to enable the Shutdown Event Tracker feature, follow these steps:

  1. In the Local Group Policy Editor, navigate to the Computer Configuration | Administrative Templates | System branch.
  2. Double-click the Display Shutdown Event Tracker policy.
  3. Click Enabled.
  4. In the Shutdown Event Tracker Should Be Displayed list, select Always.
  5. Click OK.

Now when you select Start | Shut Down, you see the Shut Down Windows dialog box shown in Figure C.

Figure C

The Shut Down Windows dialog box appears with the Shutdown Event Tracker feature enabled.

To enable the Shutdown Event Tracker on systems without the Local Group Policy Editor, open the Registry Editor and dig down to the following key:

HKLMSoftwarePoliciesMicrosoftWindows NTReliability

Change the value of the following two settings to 1:

ShutdownReasonOn
ShutdownReasonUI

Paul McFedries is a full-time technical writer who has worked with computers in one form or another since 1975 and has used Windows since version 1 was foisted upon an unsuspecting (and underwhelmed) world in the mid-1980s. He is the author of more than 60 computer books, which have sold more than three million copies worldwide. Recent titles include the Sams Publishing books Microsoft Windows Vista Unleashed and Microsoft Windows 7 Unleashed. Please visit Paul’s Web site at http://www.mcfedries.com/.

— Update: 26-02-2023 — us.suanoncolosence.com found an additional article 10 Ways Windows Group Policy Can Make Your PC Better from the website www.makeuseof.com for the keyword tweak windows 7 through local group policy editor.

Readers like you help support MUO. When you make a purchase using links on our site, we may earn an affiliate commission. Read More.

Do you wish you could change some of the ways Windows 10 behaves? Maybe you want more control over certain features, or want to make tweaks that aren’t available in the Settings panel.

A great way to get more control over your computer is using Group Policy. There are tons of useful Group Policy settings that home users can employ to tweak how Windows 10 works. Let’s look at some of the best Group Policy settings for making your system better.

What Is Windows Group Policy?

Group Policy provides a centralized way to configure and enforce all kinds of settings across computers on an Active Directory network. These settings are maintained by a domain controller and individual computers can’t override them.

Thus, Group Policy is most common on Windows domains in business settings. However, computers that aren’t on an Active Directory network (meaning most home machines) can still have their settings tweaked locally using the Local Group Policy Editor.

Think of this like the Control Panel, except much more powerful. With Group Policy, you can restrict access to parts of the system, force a certain home page for all users, and even run certain scripts whenever a computer starts up or shuts down.

Behind the scenes, most of the options in the Group Policy Editor simply make tweaks to the Windows Registry. The Group Policy Editor provides a much friendlier interface for managing these options without having to manually scour the Registry, though.

The one downside is that by default, Group Policy is only available to computers running Professional or higher editions of Windows. If you’re on Windows Home, this omission may convince you to upgrade to Windows 10 Pro—though there is a workaround that we mention below.

Accessing the Group Policy Editor

Accessing the Group Policy Editor is easier than you think, especially on Windows 10. As with most utilities in Windows, there are multiple ways to access it.

Here’s one reliable method:

  1. Open the Start Menu.
  2. Search for group policy.
  3. Launch the Edit group policy entry that comes up.

For another way, press Win + R to open the Run dialog box. There, enter gpedit.msc to launch the Group Policy Editor.

While we mentioned that Group Policy is not normally available on Home editions of Windows, there is a workaround you can try. It involves some basic system tweaks and the installation of a third-party Group Policy Editor.

If you’re interested, check out our step-by-step guide to installing the Group Policy Editor on Windows Home.

Applying Group Policy Updates

For some Group Policy settings, you’ll have to reboot your computer before they take effect. Otherwise, once you’re done making changes, launch an elevated Command Prompt and run the following command:

  gpupdate /force

This forces any updates you made to Group Policy to take effect immediately.

Cool Things to Do With Group Policy

The Group Policy Editor allows you to change hundreds of different options, preferences, and settings, so it’s impossible to cover everything here.

You can feel free to look around, but if you’re not confident, it’s probably to avoid experimenting with random policies. One bad tweak could cause problems or unwanted behavior. Check out our introduction to Group Policy to become more familiar first.

Now, we’ll look at some recommended Group Policy settings to get you started.

1. Restrict Access to Control Panel and Settings

Control Panel restrictions are vital for business networks and school environments. However, they can also be useful at home for computers shared between multiple users. If you want to prevent children from changing settings, this is a good step to take.

To completely block the Control Panel altogether, enable this object:

  User Configuration > Administrative Templates > Control Panel > Prohibit access to Control Panel and PC Settings

If you want to instead provide access to only certain parts of the Control Panel, you can set that up using one of the two following items:

  User Configuration > Administrative Templates > Control Panel > Hide specified Control Panel items 
  User Configuration > Administrative Templates > Control Panel > Show only specified Control Panel Item

Enable them and you’ll be able to indicate which Control Panel Applets you want to show or hide. Use Microsoft’s Canonical Names of Control Panel Items to list them.

2. Block the Command Prompt

Despite how useful the Command Prompt can be, it can become a nuisance in the wrong hands. Allowing users to run undesirable commands and circumventing other restrictions you might have in place isn’t a good idea. As such, you can disable it.

To disable the Command Prompt, browse to this value:

  User Configuration > Administrative Templates > System > Prevent access to the command prompt

Note that enabling this restriction means that cmd.exe can’t run at all. Thus, it also prevents the execution of batch files in CMD or BAT formats.

3. Prevent Software Installations

You have many ways to block users from installing new software. Doing so can help reduce the amount of maintenance you need to do when people carelessly install junk. It also reduces the chances of malware getting on your system.

To prevent software installations using Group Policy, visit:

  Computer Configuration > Administrative Templates > Windows Components > Windows Installer > Turn off Windows Installer

Note that this only blocks the Windows installer, so people can still install apps using the Windows Store.

4. Disable Forced Restarts

While you can enable some options to postpone it, Windows 10 will eventually restart your computer on its own if you have updates pending. You can take back control by enabling a Group Policy item. Once you do, Windows will only apply pending updates when you restart on your own.

You’ll find it here:

  Computer Configuration > Administrator Templates > Windows Components > Windows Update > No auto-restart with logged on users for scheduled automatic update installations

5. Disable Automatic Driver Updates

Did you know that Windows 10 also updates device drivers without your explicit permission? In many cases, this is useful, as it aims to keep your system as up-to-date as possible.

But what if you’re running a custom driver? Or perhaps the latest driver for a certain hardware component has a bug that causes your system to crash. These are times when automatic driver updates are more harmful than helpful.

Enable this to disable automatic driver updates:

  Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions > Prevent installation of devices that match any of these device IDs

Once enabled, you’ll have to provide hardware IDs for the devices that you don’t want automatic driver updates for. You’ll need to get these through the Device Manager, which takes a few steps. Follow our guide to controlling driver updates in Windows 10 for full instructions.

6. Disable Removable Media Drives

Removable media, like USB flash drives, can come in handy. But unknown USB devices can also pose a risk. Someone with access to your computer could load malware onto a flash drive and try to execute it.

While not necessary in most cases, you can prevent Windows from reading removable drives altogether to protect your system. This is especially important in business settings.

To disable removable media drives, enable this value:

  User Configuration > Administrative Templates > System > Removable Storage Access > Removable Disks: Deny read access

In this folder, you’ll also see options for other kinds of media like CDs and DVDs. Feel free to disable all of these as well, but USB drives are the main concern.

7. Hide Balloon and Toast Notifications

Desktop notifications can be handy, but only when they have something useful to say. Most of the notifications you see aren’t worth reading, which often leads to them distracting you and breaking your concentration.

Enable this value to disable balloon notifications in Windows:

  User Configuration > Administrative Templates > Start Menu and Taskbar > Turn off all balloon notifications

Starting with Windows 8, most system notifications switched over to toast notifications. You should thus disable them too:

  User Configuration > Administrative Templates > Start Menu and Taskbar > Notifications > Turn off toast notifications

This is an easy way to block a lot of popup distractions.

8. Remove OneDrive

OneDrive is baked into Windows 10. While you can uninstall it like any other app, it’s also possible to prevent it from running using a Group Policy item.

Disable OneDrive by enabling this:

  Computer Configuration > Administrative Templates > Windows Components > OneDrive > Prevent the usage of OneDrive for file storage

This will remove the ability to access OneDrive from anywhere on the system. It also erases the OneDrive shortcut in the sidebar of File Explorer.

9. Turn Off Windows Defender

Windows Defender manages itself, so it will stop running if you install a third-party antivirus app. If this doesn’t work properly for some reason or you want to fully disable it, you can enable this Group Policy item:

  Computer Configuration > Administrative Templates > Windows Components > Windows Defender > Turn off Windows Defender

While it’s easy to disable, Windows Defender is a good enough security solution for most people. Make sure to replace it with another trusted Windows antivirus program if you remove it.

10. Run Scripts at Logon/Startup/Shutdown

Our last tip is a bit more advanced, so it probably won’t be useful to you unless you’re comfortable with batch files and/or writing PowerShell scripts. But if you are, then you can actually run said scripts automatically with Group Policy.

To set up a startup/shutdown script, visit:

  Computer Configuration > Windows Settings > Scripts (Startup/Shutdown)

To set up a logon or logoff script, head here:

  User Configuration > Windows Settings > Scripts (Logon/Logoff)

Doing this lets you select the actual script files and provide parameters for those scripts, so it’s pretty flexible. You can also assign multiple scripts to each trigger event.

Note that this isn’t the same as launching a specific program on startup. To do that, see how to use the Windows startup folder.

The Most Useful Group Policy Settings for You

Group Policy provides you with a lot of control of how Windows 10 works. We’ve only looked at a few instances here; there’s a lot more functionality to find if you know where to look. As you can see, though, most of the options revolve around removing or blocking functionality, not adding new tools.

Article post on: us.suanoncolosence.com

Don’t have access to Group Policy or want to keep tweaking Windows? Have a look at our introduction to the Windows Registry.

— Update: 26-02-2023 — us.suanoncolosence.com found an additional article How to use Local Group Policy Editor to tweak your computer from the website tipsmake.com for the keyword tweak windows 7 through local group policy editor.

This article will show you how to use Local Group Policy Editor to make computer changes.

Note: Group Policy Editor is only available on the Pro version of Windows 10. Home or Home Premium users do not have access to it.

  1. How to install Group Policy Editor (GPEdit.Msc) on Windows 10 Home Edition

Group Policy is a powerful tool used to set up corporate networks, lock computers so that users cannot make changes, prevent them from running unapproved software and many other uses.

For home computers, uses such as password length limit, computer lock to run only approved executable files are not available. However, this tool has many other things you can configure such as disabling Windows features that you don’t like, blocking certain applications or scripting that run when logging out or logging in.

  1. 8 “tweak” Windows Group Policy any Admin should know
  2. 4 tips to open Local Group Policy Editor on Windows 8 / 8.1
  3. 10 important Windows Group Policy settings need to be done immediately

Interface Local Group Policy Editor

The interface of Local Group Policy Editor is similar to other administration tools. Treeview on the left allows users to search for a hierarchical directory structure. It has an installation list, a preview pane to provide more information about specific settings.

You need to consider two top-level directories:

  1. Computer Configuration : Contains computer settings for all logged-in users.
  2. User Configuration : Contains settings that apply to user accounts.

In each of these directories there are several other directories that provide some of the available settings:

  1. Software Settings : Contains software-related and default default configuration on Windows clients.
  2. Windows Settings: Contains security settings and scripts for login / logout, start / shutdown.
  3. Administrative Templates : This folder contains registry-based configurations to quickly tweak your computer or user account.

Customize security rules

If you double click on Prevent access to the command prompt , a window like the one below will appear. In fact, most installations in Administrative Templates look like that.

This specific installation will allow you to block users from accessing the Command Prompt. You can also configure the settings inside the dialog box to block batch files.

When you enable the Run only specified Windows applications option in the same directory as the above option, you can allow specific Windows applications to be run on the system.

In this case, if you run an application that is not on the list, you will receive an error message like the one below.

You should be careful to tweak the rules here, otherwise your computer will be locked to be unusable.

Refine UAC settings for security

We will look at the first option in this folder as User Account Control: Behavior of the elevation prompt for Administrators . In the dialog box that appears, if you select Prompt for credentials on the secure desktop , you or another user must enter the password whenever you run something in admin mode.

This option makes Windows work like Linux or Mac, asking for a password whenever you make changes.

Some other useful options:

  1. User Account Control: Only elevate the executables that are signed and validated: This option prevents applications that are not digitally signed to run as admin.
  2. Recovery console, allow automatic administrative logon : When you need to use the recovery panel to perform system tasks, you need to provide an administrator password. If you forget your password, this option allows you to access your password more easily. However, because you can easily delete Windows passwords, this option is really less secure.

See also: Instructions on how to login to your computer when you forget your password

It is worth noting that many policies in the list do not really apply to all versions of Windows. For example, installing Remove My Documents Icon is only available on Windows XP and 2000. Other policies like At least Windows XP or similar will not work on all versions.

There are many settings in Group Policy Editor, you can take the time to learn them. Most of the settings here allow you to disable Windows features that you don’t like, very few settings that offer no functionality by default.

Set up scripts to run when logging in, logging out, starting or shutdown

If you want to set up the script for logout, log in to run each time you boot your computer, you can only do this on Group Policy Editor.

This is really useful when cleaning your system or making quick backups of certain files every time you turn off your computer. You can use batch files or even PowerShell scripts. One thing to note is that these scripts must be run ‘quietly’ otherwise it will block the logout process.

There are two types of scripts you can use:

  1. Startup / Shutdown Scripts : You can find these scripts inside Computer Configuration> Windows Settings> Scripts and run in Local System accounts, so they can manipulate system files but not run as user accounts .
  2. Logon / Logoff Scripts : This script is found in Configuration> Windows Settings> Scripts and is run in the user account.

Note, the logout and login scripts will not allow you to run utilities that require administrative access unless you disable UAC completely.

The Logoff properties window allows you to add logout scripts to run.

In addition, you can also configure PowerShell scripts.

Note, you need to leave these scripts in a specific directory so they can work correctly.

Let the script log out and log in in the directory below:

  1. C: WindowsSystem32GroupPolicyUserScriptsLogoff
  2. C: WindowsSystem32GroupPolicyUserScriptsLogon

And let the script start and shut down the computer in the directory:

  1. C: WindowsSystem32GroupPolicyMachineScriptsShutdown
  2. C: WindowsSystem32GroupPolicyMachineScriptsStartup

After configuring the logout script, you can test it.

Note, if the script requires user data to be imported, Windows will be suspended during shutdown or logout for 10 minutes before turning off the script and Windows can restart. Therefore you need to note this point while creating the script.

In the enterprise, it is one of the most powerful and important tools. However, this article only aims to introduce Group Policy’s basic usage to amateur users, so it won’t go into details.

— Update: 06-03-2023 — us.suanoncolosence.com found an additional article Using Group Policy Editor to Tweak Your PC from the website www.howtogeek.com for the keyword tweak windows 7 through local group policy editor.

In today’s Geek School lesson, we’re going to explain how to use the Local Group Policy editor to make changes to your PC that aren’t available any other way.

We should note right up-front that the Group Policy editor is only available in the Pro versions of Windows – Home or Home Premium users won’t have access to it. It’s still worth learning about though.

Group Policies are a really powerful way to setup a corporate network with each of the computers locked down so users can’t mess them up with unwanted changes, and stop them from running unapproved software, among many other uses.

In the home environment, however, you probably won’t want to set password length restrictions or force yourself to change your password. And you probably won’t need to lock down your machines to only run specific approved executables.

Source: us.suanoncolosence.com

There are many other things that you can configure though, like disabling Windows features that you don’t like, blocking certain applications from running, or creating scripts that run during Logon or Logoff.

Understanding the Interface

The interface is very similar to every other administration tool – the treeview on the left allows you to look for settings in a hierarchical folder structure, there is a list of settings, and a preview panel that gives you more information about the particular setting.

There are two top-level folders to be aware of:

  • Computer Configuration – holds settings that are applied to computers regardless of which user is logging in.
  • User Configuration – holds settings that are applied to user accounts.

Under each of these folders there are a couple of folders that allow you to drill down further into the available settings:

  • Software Settings – this folder is meant for software-related configurations and is blank by default on client Windows.
  • Windows Settings – this folder holds security settings and scripts for logon/logoff and startup/shutdown.
  • Administrative Templates – this folder holds registry-based configurations, which are essentially a quick way to tweak settings on your computer or for your user account. There are a lot of available settings.

Tweaking Security Rules

If you were to double-click on the “Prevent access to the command prompt” item from the screenshot above, you would be presented with a window that looks like this one – in fact, most of the settings under Administrative Templates are going to look similar.

This particular setting would allow you to block access to the command prompt for users on the PC. You can also configure the setting inside the dialog to block batch files as well.

Another option in the same folder allows you to create a setting for “Run only specified Windows applications” – you would configure the setting to Enabled and then provide a list of allowed applications. Everything else would be blocked from running.

In this case, if you were to run an application that isn’t on the list, you would get an error message like this one.

It’s worth noting that messing with rules like this could lock you out of your PC if you do something wrong, so be careful.

Tweaking UAC Settings for Security

The first option can be found in that folder as the item “User Account Control: Behavior of the elevation prompt for Administrators”, and if you choose “Prompt for credentials on the secure desktop”, it will force you (or another user) to enter your password anytime you try to run something in administrator mode.

This option makes Windows work more like Linux or Mac, where you are asked to provide your password any time you need to make a change, and since the Secure Desktop doesn’t allow any other applications to mess with the dialog, it’s a lot more secure.

Other useful options:

  • User Account Control: Only elevate executables that are signed and validated – this option prohibits applications that aren’t digitally signed from running as administrator.
  • Recovery console, allow automatic administrative logon – when you need to use the recovery console to perform system tasks, you generally have to provide the administrator password. If you happened to forget that password, this would allow you to get in to reset it more easily. (And since you can easily wipe a Windows password, it isn’t really less secure).

One thing that’s worth noting is that many of the policies in the list don’t actually apply to every Windows version. For example, in the screenshot below, the “Remove My Documents Icon” setting is only available for Windows XP and 2000. Certain other policies will say “At least Windows XP” or something like that, which would mean they will continue to work on all versions.

There are an enormous number of settings in the Group Policy editor, so it is definitely worth spending some time looking through them if you’re curious. Most of the settings allow you to disable Windows features that you don’t particularly like – very few give you functionality that you didn’t have by default.

Setting Up Scripts to Run at Logon, Logoff, Startup, or Shutdown

Yet another example of something you can only do using the Group Policy editor is setting up a logoff or shutdown script to run every time you reboot your PC.

This can be really useful for cleaning up your system or making a quick backup of certain files every time you shut down, and you can use batch files or even PowerShell scripts for either. The only caveat is that these scripts must run silently or they will lock up the logoff process.

There are two different types of scripts that you can run.

  • Startup / Shutdown Scripts – these scripts are found under Computer Configuration -> Windows Settings -> Scripts and will be run under the Local System account, so they can manipulate system files, but won’t be running as your user account.
  • Logon / Logoff Scripts – these scripts are found under User Configuration -> Windows Settings -> Scripts and will be run under your user account.

It’s worth noting that the logon and logoff scripts won’t let you run utilities that require administrator access unless you’ve got UAC completely disabled.

The Logoff properties window allows you to add multiple logoff scripts to run.

You can also configure PowerShell scripts instead.

The really important thing to note here is that your scripts need to be in a particular folder for them to work properly.

Logon and Logoff Scripts will need to be in the following folders:

  • C:WindowsSystem32GroupPolicyUserScriptsLogoff
  • C:WindowsSystem32GroupPolicyUserScriptsLogon

While Startup and Shutdown Scripts will need to be in these folders:

  • C:WindowsSystem32GroupPolicyMachineScriptsShutdown
  • C:WindowsSystem32GroupPolicyMachineScriptsStartup

Once you’ve configured your logoff script, you can test it out – we setup a simple script that created a text file on the desktop, and then logged off and back on. But you could make it do anything you wanted.

And of course, if you were doing a logon script instead, it could actually launch applications.

One important thing to note is that if your script prompts for user input, Windows will hang during shutdown or logoff for 10 minutes before the script is killed and Windows can reboot. This is something you should definitely keep in mind when designing your script.

Group Policy Doesn’t End Here

We just scratched the surface for what Group Policy can really do, and in a corporate domain environment it is one of the most powerful and important tools at your disposal. Since this series isn’t about IT users, we won’t go into all of the rest, but it’s worthwhile to do some research on your own.

— Update: 09-03-2023 — us.suanoncolosence.com found an additional article 8 Windows Group Policy Tweaks Every Admin Should Know from the website www.hongkiat.com for the keyword tweak windows 7 through local group policy editor.

Windows Group Policy is a powerful tool to configure many aspects of Windows. Most of the tweaks it has to offer are targeted towards PC administrators to monitor and control standard accounts. If you are administrating PCs in a company environment or administrate multiple accounts at home, then you should definitely take advantage of Windows Group Policy to control PC usage of employees and family.

Below we have listed 8 Windows Group Policy tweaks that will surely make administrative tasks easier.

Note: Group Policy editor is not available in the standard and home edition of Windows. You must have professional or enterprise version of Windows to use Group Policy.

How to access Windows Group Policy Editor

You must access Group Policy Editor before following any of the tweaks below. Although there are many ways to access Windows Group Policy editor, but using “Run” dialog is the fastest and works in all versions of Windows.

Press Windows +R keys to open “Run” dialog. Here type “gpedit.msc” and hit Enter to open Group Policy Editor.

Furthermore, make sure you are logged in to the administrator account before accessing the Group Policy.

Standard accounts are not allowed to access the Group Policy.

1. Track account logins

From Group Policy you can force Windows to record all successful and failed logins to the PC from any user account. You can use such information to track who is logging in to the PC and whether an unauthorized person tried to login or not.

In Group Policy editor, move to the below mentioned location and double-click on “Audit logon events“.

Here check the checkbox next to “Success” and “Failure” options. When you will click on “OK”, Windows will start keeping a record of logins made to the PC.

To view these logs, you will have to access another useful Windows tool – Windows Event Viewer. Open “Run” dialog again and enter “eventvwr” in it to open Windows Event Viewer.

Here expand “Windows Logs” and then select “Security” option from it. In the middle panel, you should see all the recent events. Don’t get confused by all these events, you just need to find successful and failed login events from this list.

Successful login events have “Event ID: 4624“, and failed ones have “Event ID: 4625“. Just look for these event IDs to find the logins and see exact date and time of logins.

Double-clicking on these events will show more details along with the exact name of the user account that logged in.

2. Prohibit access to Control Panel

Control Panel is the hub of all the Windows settings, both security and usability. However, these settings can be really bad in the wrong hands. If a novice user will be using the PC or you doubt that someone may mess around with these sensitive settings, then you should definitely prohibit access to Control Panel.

To do so, move to the below mentioned location in Group Policy editor and double-click on “Prohibit access to the Control Panel“.

Here select the “Enable” option to prohibit access to Control Panel. Now Control Panel option will be removed from the start menu and no one will be able to access it from anywhere, including “Run” dialog.

All the options in the Control Panel are also prohibited and accessing them using any other method will show an error.

3. Stop users from installing new software

It can take quite some time to clean a PC infected with malware. To ensure users don’t install any infected software from any mean, you should disable Windows installer in the Group Policy.

Navigate to the below mentioned location and double-click on “Disable Windows Installer“.

Select “Enable” option here and select “Always” from the drop down menu in the “Options” panel below. Now users will not be able to install new programs in the PC. Although they will still be able to download or move them in PC storage.

4. Disable removable storage devices

USBs and other forms of removable storage devices can be very dangerous for the PC. If someone accidentally (or on purpose) connects a virus infected storage device with the PC, it could infect your whole PC and may even make it inoperable.

To stop users from using removable storage devices, go to the below mentioned location and double-click on “Removable Disks: Deny read access“.

Enable this option and the PC will not read any type of data inside an external storage device. Additionally, there is an option below it saying “Removable Disks: Deny write access“. You can enable it if you don’t want anyone to write (paste) data to a removable storage device.

5. Prevent specific apps from running

Group Policy also allows you to create a list of apps to prevent them from running. It is perfect to ensure users don’t waste time on known time-wasting apps. Move to the below mentioned location and open the “Don’t run specified Windows applications” option.

Enable this option and click on the “Show” button below to start creating the list of apps you would like to block.

To create the list, you must enter the executable name of the app to be able to block it; the one with .exe at the end, I.e., CCleaner.exe, CleanMem.exe or lol.launcher.exe. The best way to find exact executable name of an app is to look for the app’s folder in the Windows File Explorer and copy the exact executable name (along with its extension “.exe“).

Enter this executable name in the list and click on “OK” to start blocking it.

There is also an option of “Run only specified Windows applications” below it. If you want to disable all types of applications except for few important ones, then use this option and create a list of apps that you would like to allow.

This is a great option if you want to create a really strict working environment.

6. Disable Command Prompt and Windows Registry Editor

Control Panel is bad in wrong hands, but the Command Prompt and Registry Editor are the worse. Both of these tools can easily make Windows inoperable, especially the Registry Editor that could damage Windows beyond repair.

You should disable both Command Prompt and Windows Registry Editor if you are concerned about the PC’s security (and health).

Move to the location given below:

Here disable both “Prevent access to the command prompt” and “Prevent access to registry editing tools” options to stop users from accessing Command Prompt and Registry Editor.

7. Hide Partition Drives from My Computer

If there is a specific drive with sensitive data inside, then you can hide it from My Computer so users are unable to find it. It’s a good measure to keep users fooled, but it should not be used as a method to protect data against prying eyes.

Go to the below mentioned location and enable the option “Hide these specified drives in My Computer“.

Once enabled, click on the drop down menu in the “Options” panel and select which drives you would like to hide. The drives will be hidden when you will click on “OK“.

8. Tweaks for Start Menu and Taskbar

Group Policy offers dozens of tweaks for Start Menu and the Taskbar to customize them as you like. The tweaks are perfect for both administrators and regular users looking to customize Windows Start Menu and Taskbar. Go to the below mentioned location in Group Policy Editor and you will find all the tweaks with an explanation of what they do.

The tweaks are really easy to understand, so I don’t think I’ll have to explain each one of them. Besides, Windows already offers a detailed description for each tweak. Some of the things you can do include, change start menu power button function, prevent users from pinning programs to taskbar, restrict search option’s reach, hide notifications area, hide battery icon, prevent changes in taskbar and start menu settings, prevent users from using any power options (shutdown, hibernate, etc.), remove “Run” option from start menu and a whole lot of other tweaks.

Time to show who’s the boss

The above Group Policy tweaks should help you take control over a PC and ensure nothing goes wrong when other users use it. Group Policy has hundreds of options to control different Windows functions, above are just few of the most handy ones. So you should explore Group Policy editor and see if you find any hidden gems. Although make sure you create a system restore point before making any changes.

Which one of these Windows Group Policy tweaks you like? Do share with us in the comments.

— Update: 19-03-2023 — us.suanoncolosence.com found an additional article 7 Ways to Fix the Windows Local Group Policy Editor When It’s Unresponsive from the website www.makeuseof.com for the keyword tweak windows 7 through local group policy editor.

The Windows Local Group Policy Editor (LGPE) is a critical tool that helps you configure various settings. However, this tool often runs into issues and suddenly won’t respond.

When the tool has a problem, it usually pops up an error message that reads, “gpedit.msc (gpedit) not found.” In some instances, the error message might read, “group policy editor is missing from your version of Windows” or “gpedit has stopped working.”

Now, let’s explore the various solutions for fixing an unresponsive LGPE.

1. Open the Local Group Policy Editor the Right Way

There are various ways to access the LGPE (Local Group Policy Editor.) However, the tool might be unresponsive if you’re not opening it the right way.

So, here’s how you can properly access the LGPE:

  1. Press Win + R to open the Run command dialog box.
  2. Type gpedit.msc and press Enter to open the Local Group Policy Editor.

Alternatively, type Edit Group Policy in the Start Menu search bar and select the Best match.

2. Ensure You’re Using the Right Windows Edition

If the LGPE still gives you issues, then maybe you’re using the Windows Home edition on your device.

The LGPE tool only works on the Windows Pro, Enterprise, and Education editions. Now, if you’re unsure of the Windows Edition installed on your device, here's how you can check it:

  1. Type Control Panel in the Start Menu search bar and select the Best match.
  2. Click the View by drop-down menu and select Small icons.
  3. Click System from the menu items. Next, locate the Windows specifications section and then check the Windows edition installed.

If the Windows Edition section reads “Windows Home”, then that’s where the issue lies. But luckily, there are methods you can apply to open the LGPE on your device.

3. Access the LGPE on Windows Home With a Few Tricks

It's currently not possible to run the LGPE on Windows Home. However, you'd be glad to know that there are tricks you can use to access the LGPE on Windows Home.

But if you still can’t access the LGPE with these tricks, you could try using other similar third-party tools. For example, you could download the Policy Plus tool and use it to access all the features of the LGPE.

4. Troubleshoot Windows System Issues

Is the LGPE unresponsive on the Windows Pro, Enterprise, or Education edition? If so, then there might be some system issues that are interfering with this tool. So, you could use a few Windows troubleshooters to resolve the problem.

For example, this error might be caused by system maintenance issues. In this case, let’s see how the System Maintenance troubleshooter can help:

  1. Press Win + S to open the Start Menu search bar.
  2. Type Perform recommended maintenance tasks automatically and select the Best match.
  3. Click the Advanced option, check the Apply repairs automatically box, and click Next. Follow the on-screen steps to complete the process.

If the issue persists, then you’re probably dealing with hardware-related issues. In this case, you can resolve the problem with the Hardware and Devices troubleshooter.

  1. To get started, press Win + I to open the System Settings
  2. Select Update & Security from the options.
  3. Click the Troubleshoot option on the left-hand side pane.
  4. Next, click View additional troubleshooters on the right-hand side.
  5. Select the Hardware and Devices troubleshooter and then press the Run the troubleshooter button.

5. Perform a “Check Disk” Scan

If the LGPE problems are caused by hard drive issues, then the Check Disk (CHKDSK) tool could help. When you run the Check Disk scan, the tool scans the hard drive and tries to repair the issues on it.

Now, here’s how you can run a Check Disk scan via the Command Prompt:

  1. Type Command Prompt in the Start Menu search bar.
  2. Right-click on the Command Prompt option and select Run as administrator.
  3. Type the following command and press Enter: 
 chkdsk C: /f

The “C:” part represents the letter of the hard drive. So, if you’ve installed Windows on a different drive, replace C: with the letter of that particular drive. Finally, restart your device once this scan is complete.

6. Repair or Replace Corrupted System Files

At times, it might be difficult to repair corrupted system files using Windows troubleshooters or the Check Disk scan. In this case, you’ll need to use advanced tools like the SFC and DISM.

The SFC and DISM tools are quite helpful when it comes to repairing or replacing corrupted Windows system files. So, if the LGPE issue is caused by system-specific problems, then these tools could help.

Now, let’s get started and check how you can run the DISM scan:

  1. Type Command Prompt in the Start Menu search bar.
  2. Right-click on the Command Prompt and select Run as administrator.
  3. From there, type the following command and then press Enter: 
 DISM /Online /Cleanup-Image /ScanHealth

The scan might take a few minutes. When it’s done running, type the following command and press Enter:

 DISM /Online /Cleanup-Image /RestoreHealth

Wait a few more minutes for the DISM scan to complete and then restart your device. Finally, run the SFC scan through these steps:

  1. Open the Command Prompt by following the previous steps.
  2. Type the following command and then press Enter: 
 sfc /scannow

Once the scan is complete, close the Command Prompt and then restart your device.

7. Restore the Default Windows Settings

As a last resort, you could now consider restoring your device to its default settings. This method could help get rid of the bugs that might be interfering with the LGPE's functionality.

The best part is that this method will restore the device to its factory settings while keeping your data safe. However, you could consider backing up your data first just to be safe.

Now, let's check out how you can restore Windows to its default settings:

  1. Press Win + I to open the System Settings and then select Update & Security.
  2. Select the Recovery option on the left-hand side pane.
  3. Finally, click the Get started button on the right and finalize the process by following the on-screen steps.

LGPE: A Reliable Tool For Repairing Windows System Issues

Need a reliable tool that can help you tweak Windows system settings? Try the Local Group Policy Editor—an easy-to-use tool that you can open with a few clicks.

Should you bump into issues while using this tool, try any of the fixes we’ve recommended.

— Update: 25-03-2023 — us.suanoncolosence.com found an additional article Best Group Policy Settings You Need To Tweak To Control Windows from the website techwiser.com for the keyword tweak windows 7 through local group policy editor.

If you want to change how Windows behaves by taking more control over the security or disabling few things which Microsoft throws at you, you can do that by tweaking the Group Policy settings. Yes, you can also do the same from the Registry Editor, but Group Policy has few more advantages like Group Policy will not change after a Windows update, unlike Registry. Most importantly, you can either configure Group Policy locally on your system or make the active directory to apply to multiple systems in your domain. So this is especially useful for the offices and schools running Windows computers.

Best Group Policy Settings

Before we begin, let’s understand that Group Policy is a graphical tool that lets you edit native OS settings, Kernel settings, etc. However, tweaking the Group Policy in a wrong way can even cause your OS to malfunction. So, if you are going to make any changes make sure to export the list before making any changes.

How to Access Group Policy

One of the biggest caveats of Group Policy is it is available only on those computers running Windows Professional, Education, or Enterprise Versions. Even though you are running Windows Home, you can access Group Policy but with few workarounds, which I will explain below.

Though Group Policy is not a part of Windows Home editions, there is still a way to access it. All you have to do is install a third-party Group Policy Editor by downloading this Batch file. Open it as an administrator, it will start installing in the command prompt. It will take around 2- 3 minutes to install. Once the process is done, open the command prompt again and type gpedit.msc to access it.

1. Disable any Software Installation

By not allowing users to install various software, you can decrease the amount of maintenance and cleaning required when something bad is installed as it is also one of the potential reasons for the malware. This is even more useful especially in schools, where you want students to access only what required.

Blocking to run Specific Applications 

Blocking all apps to install is overkill in many situations. If all you wanted is blocking out just a few apps then you can make these changes to the Group Policy.

2. Block the access to Control Panel

It is important to set limits for the control panel mostly in business environments as it gives you control over the entire system. You can either block entire access or limit its access.

Show only Specific control panel items 

This means you’ll need to carefully pick and type out each Control Panel item you’d like to include. You can find the names of all Control Panel items on Microsoft’s website.

3. Disable Command Prompt

Command Prompt is undoubtedly so useful and also a nightmare at the same time as it gives the opportunity to the users to run the commands and programs which you are not intended to.  It can also be a dangerous tool in the hands of the inexperienced. There are a lot of reasons to disable the command prompt, Maybe you’ve got kids who share a family computer or you let guests use your computer when they stay with you. Or perhaps you’re running a business computer you need to lock it down.

4. Disable Windows Registry Editor

5. Block Removable Media Drivers

USBs or other forms of removable media devices can be dangerous for the PC. If someone accidentally or purposefully connects a Virus infected storage device, it may affect the PC or even the domain. When running a lot of computers, allowing media drivers makes it hard to manage the storage. Blocking removable media drivers is commonly used in many schools and colleges.

Blocking write option 

The above option will only make PC to not read the files in the external Device. But you can still copy the files into the external device. If you want to safeguard the files, you need to block the write option too. This is commonly implemented in business environments.

Alternatively, you can use All Removable Storage classes: Deny all access to block both read and write options at the same time.

6. Hide Partition Drive from Computer

If there is any sensitive information in the systems, you might want to hide it from the specific users to access it. You can do that from Group Policy settings. But do remember that this setting will only hide it from file explorer and few other apps, but people can still access it from the command prompt.

7. Increase the Minimum Password Length

The default Windows Password length is 8 and you need to be using at least one uppercase, lowercase, and number or special character. It is actually well secured. But you can improve security by increasing the password length. You can set it up to 14 along with using uppercase, lowercase, and number or special character.

8. Track Account Logins

Here check the checkbox next to “Success” and “Failure” options. When you will click on ok, Windows will start keeping a record of logins made to the PC.

To view those logins, Open Run and enter eventvwr to open Windows Event Viewer. Now expand the Windows Logs and then select the Security option. In the middle panel, you can look at all the login attempts. You can look at the account tried to log-in, date, and also the time. But success and failed attempts are mentions with code.

9. Disable OneDrive

10. Keep Group Policy Changes in Control

Anyhow, these changes can be reverted back to normal by using the Group Policy with the same method but setting them back to disable. You can remain in charge of Group Policy by using Group Policy Object Auditing. To keep a continuous track of changes made in Group Policy Objects, try Lepide Change Reporter.

Wrapping up

Once done adjusting the Group Policy settings, You need to move settings to the computer group in Active Directory where you can set the directory for every PC in the domain. You can also set specific Group Policies for only individual users or computers. Now all you need to do is download the Group Policy from Active directory to apply. Any changes to the active directory will automatically apply to the individual systems.

Source: https://www.techrepublic.com/article/10-ways-to-tweak-windows-7-using-the-local-group-policy-editor/

Article post on: us.suanoncolosence.com

Related Posts

Leave a Comment

Your email address will not be published. Required fields are marked *