This guide demonstrates how to use Active Directory Group Policy Objects (GPO) to block Windows users from accessing the Registry Editor (regedit.exe). This configuration strengthens system security and prevents accidental system damage caused by user errors.

1. Registry Editor (regedit) Access Restriction Methods

1.1 GPO Creation and Configuration

1. Launch Group Policy Management Console
   • Run gpmc.msc or Server Manager → Tools → Group Policy Management
2. Create New GPO
   • Right-click target domain or OU → “Create a GPO in this domain, and Link it here”
   • Enter GPO name (e.g., “Disable Registry Editor”)

1.2 Policy Configuration Paths

1.3 Policy Configuration Steps

1. Edit GPO
   • Right-click created GPO → “Edit”
2. Navigate to Policy Path

   User Configuration → Policies → Administrative Templates → System
   

3. Configure “Prevent access to registry editing tools” Policy
   • Double-click the policy
   • Select “Enabled”
   • “Apply” → “OK”

1.4 Advanced Configuration Options

2. Exception Handling for Selected Users

2.1 Administrator Account Exceptions

1. Modify Security Filtering
   • Select GPO → “Security Filtering” section
   • Remove “Authenticated Users”
   • Add specific security groups
2. Configure Delegation Permissions
   • Click “Advanced” button
   • Do not assign “Deny” permissions to administrator groups

2.2 OU-Based Exception Handling

3. Policy Application and Verification

3.1 GPO Linking

• Right-click target OU → “Link an Existing GPO” → Select created GPO

3.2 Force Policy Application

# Execute on client
gpupdate /force

# Or apply remotely
Invoke-GPUpdate -Computer "ComputerName" -Force

3.3 Verify Application Status

3.4 Expected Error Message

When the policy is correctly applied, users attempting to run regedit will see:

"Registry editing has been disabled by your administrator."

4. Common Issues and Solutions

4.1 Policy Not Applied

4.2 Partial Application

• Only one of User or Computer policies is configured
• Conflicting policies exist in parent OUs

5. Related Registry Keys

The following registry key is created when the policy is applied:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

6. References

• Registry Editor Access Restriction Policy