Local Security Policy Editor - Open

How to Open Local Security Policy Editor in Windows​

   Information

This tutorial will show you how to open the Local Security Policy Editor (secpol.msc) in Windows 7, Windows 8, and Windows 10.

   Note

The Local Security Policy settings are also among the security settings contained in the Local Group Policy Editor GPO.

• You will need to be an administrator to open the Local Security Policy Editor.
• In Windows 7, the Local Security Policy will only be available in the Professional, Ultimate, and Enterpise editions.
• In Windows RT, 8, and 8.1, the Local Security Policy will only be available in the Pro and Enterprise editions.
• In Window 10, the Local Security Policy will only be available in the Pro, Enterprise, and Education editions.

   Warning

Changes to the Local Security Policy cannot be undone unless it is done so manually, or do a system restore to a date prior to the changes is preformed.

To restore general Local Group Policy settings, see Local Group Policy - Reset to Default

EXAMPLE: Local Security Policy
NOTE: The top screenshot is the separate Local Security Policy editor. The bottom screenshot is from within the Local Group Policy Editor.

OPTION ONE

To Open Local Security Policy Editor Directly

1. Press the Windows + R keys to open the Run dialog, type secpol.msc, press Enter, and go to step 3 below.
NOTE: This file is located at C:\Windows\System32\secpol.msc.

OR

2. Open the Control Panel (icons view), and click/tap on the Administrative Tools icon.
A) Close the Control Panel window.

B) Double click/tap on Local Security Policy to open it, and go to step 3 below.
3. If prompted by UAC, click/tap on Yes.
NOTE: If you did step 2, then you can now close the Administrative Tools window if you like.

4. You can now set and manage the Local Security Policies on your computer to how you want them. (See screenshot below)

OPTION TWO

To Open Local Security Policy Editor through Local Group Policy Editor

1. Open the Local Group Policy Editor.

2. Under Computer Configuration and User Configuration, click/tap on and expand Windows Settings to see the Security Settings. (See screenshot below)

3. You can now set and manage the Local Security Policies on your computer to how you want them. (See screenshot above)

That's it,
Shawn

Related Tutorials

---

• How to Reset All Local Security Policy Settings to Default in Windows
• How to Open the Local Group Policy Editor in Windows
• How to Open Local Users and Groups in Windows
• How to Create a Custom MSC in Microsoft Management Console
• How to Add or Remove User Accounts from Groups in Windows 7 and Vista

 

[justondean]

Missing Security Policy Editor in Win7 (not RC or Beta)

I purchased an upgrade to windows 7 (after Beta testing it and using the RC).
I've got Win7 Home Premium (i'm cheap and it was only $30). I have it dual booted on a macbook just for games. I'm trying to connect to my Time Capsule disk but the Airport Base Station agent isn't working. I had this problem in the Beta and the RC but fixed it in the Security Policy Editor. I've been looking all morning for the Security Policy Editor and it isn't there. Microsoft just didn't put it in the OS. I tried going through the Group Policy stuff and I took a screenshot which I'll put on with this.

If anyone finds a way around this or a way to fix my problem without editing Security Policies please let me know.

 

[Brink]

Hello Juston, and welcome to Seven Forums.

Sorry, but as in the Warning at the top of the tutorial.

The Local Security Group Policy Editor will only be available in the Windows 7 Professional, Ultimate, and Enterpise editions. You will not have the Local Security Policy Editor available in the Windows 7 Starter and Home Premium editions.

I'm not sure how to resolve your issue, but you should repost this issue in the Network & Sharing forum to see if you may get a solution hopefully soon.

 

[Kaktussoft]

How can i change the settings in win7 home premium? secpol.msc doesn't work... I know
For example I want to do this:

Hide some accounts using secpol.msc (then "Security Settings | Local Policies | User Rights Assignment | Deny log on locally"), but it is not available for Home Premium.

How to do it on home premium?

 

[Brink]

Hello Ron,

You could use OPTION TWO in the tutorial below as a guide, but using SeDenyInteractiveLogonRight instead of SeShutdownPrivilege in the command to do so.

http://www.sevenforums.com/tutorials/128920-shut-down-computer-allow-prevent-users-groups.html

 

[Kaktussoft]

Hello Ron,

You could use OPTION TWO in the tutorial below as a guide, but using SeDenyInteractiveLogonRight instead of SeShutdownPrivilege in the command to do so.

http://www.sevenforums.com/tutorials/128920-shut-down-computer-allow-prevent-users-groups.html

http://www.sevenforums.com/tutorials/7539-local-users-groups-manager-open.html
See the warning..... not available on Home Premium! How do I do that in Home Premium?

 

[Brink]

Using OPTION TWO with that command instead doesn't involve "Local Users and Groups" or "Local Security Policy", so you can do it in any edition of Windows 7. I did post the wrong link, but it's corrected now.

It's the same principle of changing a Group Policy manually in the registry instead. Just a different way of doing it.

 

[VistaKing]

Don't know if this is normal or not. But when I go to start menu type in secpol.msc and press enter I get this error message "
An attempt was made to reference a token that does not exist. " But if I type in secpol.msc and right click on the program and choose Run as Administrator it opens up. I have Windows 7 Ultimate and my user name is in the Administrators group.

 

[Kaktussoft]

Hello Ron,

You could use OPTION TWO in the tutorial below as a guide, but using SeDenyInteractiveLogonRight instead of SeShutdownPrivilege in the command to do so.

http://www.sevenforums.com/tutorials/128920-shut-down-computer-allow-prevent-users-groups.html

So you mean using the ntrights.exe?

[B]ntrights  -U  "[COLOR=red]User or Group[/COLOR]"  +R  SeDenyInteractiveLogonRight[/B]

What's an Interactive Logon btw? Is it when you logon interactively on machine, or also using telenet and a Terminal Server logon?

 

[Brink]

Correct. You would download and use the ntrights.exe file.

"SeDenyInteractiveLogonRight" is just the command it uses to "Deny log on locally".

http://support.microsoft.com/kb/315276

 

[Kaktussoft]

Correct. You would download and use the ntrights.exe file.

"SeDenyInteractiveLogonRight" is just the command it uses to "Deny log on locally".

How to set logon user rights by using the NTRights utility

Should I do SeDenyRemoteInteractiveLogonRight as well, or is it denied automatically if I activate SeDenyInteractiveLogonRight? Sorry to ask... can't test it now

 

[Brink]

No problem.

It wouldn't hurt to do so to also prevent "Deny log on through Terminal Services".

 

[Kaktussoft]

No problem.

It wouldn't hurt to do so to also prevent "Deny log on through Terminal Services".

Do you mean I also have to "Deny log on through Terminal Services" as well. Or is SeDenyInteractiveLogonRight automatically "Deny log on through Terminal Services"?

Of course I can try later at home. But maybe you know it

 

[Brink]

I know "SeDenyInteractiveLogonRight" is to "Deny log on locally", but I don't know if it will also "Deny log on through Terminal Services". Probably not though.