How to Block Regedit Using Group Policy

This guide explains how to restrict standard users from accessing the Windows Registry Editor (Regedit) using Active Directory Group Policy. By enabling the dedicated administrative template policy, network administrators can prevent users from launching the registry editing tools interactively or running them silently via scripts, protecting system integrity across client machines.

The Group Policy Setting to Block Regedit

The specific policy setting used to restrict access is named Prevent access to registry editing tools.

Policy Location

In the Group Policy Management Console (GPMC) or Local Group Policy Editor (gpedit.msc), navigate to:

User Configuration > Administrative Templates > System

Step-by-Step Deployment Instructions

  1. Open Group Policy Management: Press Win + R, type gpmc.msc, and press Enter.
  2. Create or Edit a GPO: Right-click the target Organizational Unit (OU) containing the standard user accounts and select Create a GPO in this domain, and Link it here… (or right-click an existing GPO and select Edit).
  3. Navigate to the Policy: In the Group Policy Management Editor, go to:
    • User Configuration
    • Administrative Templates
    • System
  4. Configure the Setting: Locate and double-click Prevent access to registry editing tools.
  5. Enable the Policy: Select the Enabled radio button.
  6. Block Silent Execution: In the Options pane, locate the setting Disable regedit from running silently? and set it to Yes.
    • Setting this to Yes prevents users from running regedit.exe using the silent switch (/s) in batch files or scripts.
    • Setting this to No blocks the graphical user interface (GUI) but still allows scripts to import .reg files.
  7. Save and Apply: Click Apply, then click OK.

Applying and Verifying the Policy

To apply the changes immediately on a client machine, open Command Prompt and run:

gpupdate /force

Once the policy takes effect, any attempt by a standard user to open regedit.exe will be blocked, and Windows will display the following message:

“Registry editing has been disabled by your administrator.”