Member Avatar for edong

I tried to restrict users from editing the local group policy in my computer just for security but not knowing... that doing that locally (computer not in a domain) will affect all the users who logs in in that certain PC even the Administrator account. HERE IS THE CAUSE:!!!
What I did is I open the MMC in the run command line, I add the Group Policy Snap-in and I remove the said snap-in in the policy so that others will not edit it.
I open it again the next day to edit the policies but I found that the said snap-in is missing, I run the gpedit.msc but a message window says that it was restricted by the administrator (having a code: CLSID:8FCOB734-AOE1-11D1-A7D3-0000F87571E3)...I tried

to run it in the Control Panel the same, it did't work..NO MATTERS!!

Actually firends, my friend of mine also accidentally disabled the Registry Editor and the MMC utility in his PC and everytime he run it for editing purposes, he got a error message..
Are there any solution to this!!!!!! Pls help!!

  • 3 Contributors
  • 2 Replies
  • 133 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by Duki

Dani AI

Generated

reported the classic local-GPO trap: the error string with CLSID {8FC0B734-A0E1-11D1-A7D3-0000F87571E3} is the Group Policy Editor snap‑in GUID, so a local policy change has been blocking the MMC/GPEdit/Regedit snap‑ins for every account. sees the same symptom. ’s advice (have a domain admin change a domain GPO) only applies when the PC is joined to an Active Directory domain; for a standalone PC the fix must be applied locally.

Recover options (in roughly increasing power/complexity):

  • Try Safe Mode / the built‑in Administrator account or run System Restore (rstrui.exe) to roll back to a point before the change.

  • Remove the local Group Policy files so the local GPO no longer enforces the restriction. From an elevated command prompt:

    rename %windir%\System32\GroupPolicy GroupPolicy.off
gpupdate /force

    Renaming is safer than deleting; Windows will recreate the folder on next policy processing.

  • If registry tools are blocked and the above is not possible, edit hives offline from WinRE/installation media: open Command Prompt, run regedit, load the affected user hive (C:\Users\<name>\NTUSER.DAT) or the machine hives from C:\Windows\System32\Config, remove the policy entries, then unload the hive and reboot. The specific things to remove are the DisableRegistryTools value under the Policies\System key and any MMC policy keys that reference the GP snap‑in GUID under Software\Policies\Microsoft\MMC (both HKCU and HKLM).

A command‑line alternative if an elevated cmd works is to delete those keys directly with reg delete (targeting DisableRegistryTools and the MMC{8FC0B734‑…} key). Always export or back up any hive before changing it, and prefer renaming policy files rather than destructive deletion. If the machine is domain‑joined, the domain GPO will reapply the restriction until the domain policy is changed.

Recommended Answers

All 2 Replies

Member Avatar for lintahbulan

I'm also have the same problem, plz anyone give a responese.....

Member Avatar for Duki

Have your domain admin configure a GP and apply it to you...

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.