Member Avatar for edong

I tried to restrict users from editing the local group policy in my computer just for security but not knowing... that doing that locally (computer not in a domain) will affect all the users who logs in in that certain PC even the Administrator account.
What I did is I open the MMC in the run command line, I add the Group Policy Snap-in and I remove the said snap-in in the policy so that others will not edit it.
I open it again the next day to edit the policies but I found that the said snap-in is missing, I run the gpedit.msc but a message window says that it was restricted by the administrator (having a code: CLSID:8FCOB734-AOE1-11D1-A7D3-0000F87571E3)...I tried

to run it in the Control Panel the same, it did't work..

Actually sir, my friend also accidentally disabled the Registry Editor and the MMC utility in his PC and everytime he run it for editing purposes, he got a error message..
Are there any solution to this!!!!!! Pls help!!
More power to us!!!!]

  • 2 Contributors
  • 1 Reply
  • 265 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by ram11

Dani AI

Generated

A short expert summary and safe recovery plan.

The error you saw (gpedit.msc / MMC / regedit being "restricted" with a CLSID) is usually caused by local Group Policy or per-user registry policy entries that explicitly block the MMC snap-in and registry tools. MMC permissions are stored under the Policies branch (each snap‑in gets a GUID key and a value named Restrict_Run) and a global toggle called RestrictToPermittedSnapins controls whether those GUID entries are enforced. That is why an ordinary change can lock even an Administrator out. (learn.microsoft.com)

What to try first (least risk → more intrusive):

  • Log in with another local Administrator (or the built‑in Administrator) or boot Safe Mode — per‑user HKCU policies often do not affect a different admin account.
  • If you can open an elevated Command Prompt or regedit, clear the MMC restriction and re‑enable regedit. Example commands (run as Administrator):
reg add "HKCU\Software\Policies\Microsoft\MMC" /v RestrictToPermittedSnapins /t REG_DWORD /d 0 /f

reg add "HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}" /v Restrict_Run /t REG_DWORD /d 0 /f

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 0 /f

The GUID above is the Group Policy snap‑in class id referenced in Microsoft documentation; changing those values temporarily restores the snap‑in until a policy is reapplied. (ftp.zx.net.nz)

If registry edits are blocked or changes keep reverting:

  • Reset the local policy store (this clears local GPOs — back up first) and force a refresh:
RD /S /Q "%WinDir%\System32\GroupPolicy"
RD /S /Q "%WinDir%\System32\GroupPolicyUsers"
gpupdate /force

Windows will rebuild defaults after reboot. Use this when direct registry edits fail. (learn.microsoft.com)

Cautions and final notes:

  • Back up the registry and create a System Restore point before editing. If the PC is domain‑joined, domain GPOs will reapply these restrictions; fix them on the domain controller or contact the domain admin. Copying GroupPolicy files from another machine (as mentioned) can work but is risky — prefer editing the specific policy values or resetting the local store. This situation matches what described: a per‑user policy change that became global for that machine until reversed. (learn.microsoft.com)
Member Avatar for ram11

copy group policy from other same configue pc and paste in C:\WINDOWS\system32

Note: paste in safe mode only ,& group policy file is always a hidden file in system32

after u paste restart ur pc and than run>gpedit.msc>>intially 5 - 6 times u will get same error of snap shot than it will open..


Thankz

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.