secpol.msc: How Windows Local Security Policy Works, Its Settings, Benefits, and Limitations

QUICK ANSWER

secpol.msc opens the Windows Local Security Policy console. Administrators use it to configure security rules for one computer, including password and account-lockout requirements, auditing, user rights, security options, application-control policies, and certain firewall and network settings.

The console is available on supported professional and organizational editions of Windows, including Pro, Enterprise, and Education—not normally Windows Home. Changes require administrator privileges and can affect sign-in, applications, services, networking, and remote access. On a domain-joined computer, Active Directory Group Policy can override locally configured settings.

What Is secpol.msc?

secpol.msc is the Microsoft Management Console file for Local Security Policy. It provides a focused interface for viewing and editing security-policy settings that apply to the local Windows computer.

It is not a separate security product, antivirus program, or malware-removal utility. It is an administrative interface for Windows security configuration.

Local Security Policy can control:

• How local users authenticate
• Password and account-lockout behavior
• Which users or groups receive system privileges
• Which security events Windows audits
• Selected operating-system and network security behavior
• Application execution through Software Restriction Policies or AppLocker, where supported
• Windows Firewall with Advanced Security
• Certificates, IPsec, and other policy-based security components

Most settings under secpol.msc correspond to:

Computer Configuration > Windows Settings > Security Settings

in the Local Group Policy Editor.

Supported Windows Editions

Microsoft lists Windows security-policy settings and auditing support for these client editions:

Windows Server also provides security-policy management, although available categories can vary by server role and installation type. The graphical MMC tools are unavailable on Server Core.

Do not download a third-party copy of secpol.msc or copy system files from another edition. Upgrading to a supported Windows edition or using supported command-line and device-management controls is safer.

How to Open Local Security Policy

You must use an administrator account to change most settings.

Method 1: Run dialog

1. Press Windows key + R.
2. Enter:

secpol.msc

3. Press Enter.
4. Approve the User Account Control prompt if one appears.

Method 2: Windows Search

1. Open Start or Search.
2. Search for Local Security Policy.
3. Select Run as administrator.

Method 3: Command Prompt or PowerShell

Run:

secpol.msc

Opening the console without elevation may allow you to inspect settings, but changing protected policies requires administrative permission.

How secpol.msc Works

The Local Security Policy console is an MMC snap-in and part of the Windows Security Configuration Manager toolset. It provides an interface to the security-policy engine rather than directly implementing security controls itself.

When you configure a setting:

1. The console records the local security configuration.
2. Windows security components process the setting.
3. The setting becomes part of the computer’s effective security policy.
4. The Local Security Authority, Security Accounts Manager, registry, services, firewall, or other relevant components enforce it.
5. Some settings apply immediately, while others require a sign-out, restart, service restart, or Group Policy refresh.

Windows stores security-configuration information in its security-policy database, including the Secedit.sdb database used for policy propagation and analysis.

Local Policy Versus Domain Group Policy

secpol.msc primarily edits the policy of one computer. It is not the correct tool for centrally administering an entire Active Directory environment.

Windows normally processes Group Policy in this order:

1. Local policy
2. Site-linked Group Policy
3. Domain-linked Group Policy
4. Organizational-unit Group Policy, from parent to child

Later policies normally have higher precedence when settings conflict. Therefore, a setting configured through secpol.msc can be overwritten by a domain GPO.

A setting that keeps reverting is often being controlled by:

• Active Directory Group Policy
• Microsoft Intune or another mobile device management platform
• A security baseline
• An endpoint-management product
• A configuration script or security application

For domain computers, configure organizational requirements through the Group Policy Management Console rather than editing every device locally.

Main secpol.msc Categories

The exact categories displayed depend on the Windows edition, version, installed components, and device role.

Account Policies

Account Policies contain password, account-lockout, and Kerberos-related settings.

Password Policy

Password Policy can control:

• Password history
• Maximum password age
• Minimum password age
• Minimum password length
• Password complexity requirements
• Reversible password encryption

Avoid enabling reversible password encryption unless a documented legacy requirement makes it unavoidable. It weakens password protection.

For local accounts on a standalone computer, local password policy applies locally. In an Active Directory domain, domain-account password policy is normally controlled at the domain level. Fine-grained password policies can also apply to particular domain users or groups.

Account Lockout Policy

Account Lockout Policy controls what happens after repeated unsuccessful sign-in attempts, including:

• Account lockout threshold
• Account lockout duration
• Time before the failed-attempt counter resets
• Administrator-account lockout behavior on supported systems

Lockout policies can slow password-guessing attacks, but an overly aggressive threshold can cause denial of service or frequent help-desk calls.

Kerberos Policy

Kerberos settings control items such as ticket lifetimes and validation behavior for domain authentication. They are relevant to domain accounts and should normally be administered through domain Group Policy, not individual workstations.

Local Policies

Audit Policy

Audit Policy determines which security activities Windows records as successes, failures, or both.

Examples include:

• Account sign-in attempts
• Account-management activity
• Object access
• Policy changes
• Privilege use
• System events

Microsoft recommends using Advanced Audit Policy Configuration on modern Windows systems because it provides more detailed audit subcategories.

Enabling every success and failure category without a monitoring plan can generate excessive events and consume log space.

User Rights Assignment

User Rights Assignment determines which users and groups can perform sensitive operating-system actions.

Examples include:

• Sign in locally
• Sign in through Remote Desktop Services
• Access the computer from the network
• Back up or restore files
• Shut down the system
• Log on as a service
• Log on as a batch job
• Debug programs
• Take ownership of files or objects

These rights are different from file and folder permissions. Removing a required service account or administrator group can stop applications, scheduled tasks, backups, remote access, or Windows services from working.

“Deny” rights generally take precedence over corresponding “Allow” rights. Review group membership carefully before assigning a deny right.

Security Options

Security Options contains many operating-system security behaviors, such as:

• Administrator and Guest account status
• Interactive sign-in messages
• User Account Control behavior
• Network authentication settings
• Digital-signing requirements
• Anonymous-access restrictions
• Credential and session-security behavior
• Device and driver restrictions

Do not enable a setting solely because its name sounds more secure. Some authentication, signing, and cryptography settings can break communication with older devices, applications, network-attached storage, or third-party services.

Windows Firewall with Advanced Security

This section provides access to firewall and connection-security policies, including:

• Inbound and outbound rules
• Domain, private, and public profiles
• IPsec connection-security rules
• Firewall monitoring

Blocking a port or application can interrupt remote administration, file sharing, business applications, or management agents. Confirm that an alternative management path exists before modifying remote computers.

Network List Manager Policies

These policies control how Windows identifies and presents networks. Depending on the setting, an administrator may control network names, icons, locations, or whether users can change network properties.

Network-location decisions matter because Windows Firewall can apply different rules to domain, private, and public networks.

Public Key Policies

Public Key Policies manage certificate-related functions and can include settings associated with:

• Certificate trust
• Certificate-path validation
• Encrypting File System
• Data protection
• BitLocker-related certificate policies
• Automatic certificate enrollment in managed environments

Incorrect certificate-policy changes can disrupt authentication, encryption, signed applications, or secure network communication.

Software Restriction Policies

Software Restriction Policies identify software and control whether it may run. Rules can be based on criteria such as paths, hashes, certificates, or security zones.

Path rules must be designed carefully. A rule that allows execution from a user-writable directory can be bypassed by placing another executable in that directory.

Application Control Policies and AppLocker

AppLocker can control which executable files, scripts, Windows Installer packages, packaged applications, and DLLs users may run, subject to Windows edition and feature support.

Before enforcing AppLocker rules:

1. Inventory required applications.
2. Create rules for Windows and approved applications.
3. Test rules in audit-only mode.
4. Review AppLocker events.
5. Move to enforcement only after validating the results.

An incomplete rule set can block Windows components, management utilities, installers, or business applications.

IP Security Policies

IP Security Policies use IPsec to authenticate or protect IP communication. They can define filters, authentication methods, and security requirements between endpoints.

Incorrect IPsec settings can prevent systems from communicating. Use centrally managed connection-security rules for enterprise deployments whenever possible.

Advanced Audit Policy Configuration

Advanced Audit Policy Configuration provides detailed audit subcategories. It can separately audit activities such as:

• Credential validation
• User and group management
• Process creation
• Logon and logoff
• File and registry access
• Policy changes
• Removable-storage access
• Filtering-platform activity

Do not configure overlapping basic and advanced audit policies without understanding how Windows reconciles them. Microsoft recommends advanced audit settings for Windows 7 and later.

Safe Procedure for Changing a Policy

1. Identify the exact requirement

Document:

• The security problem being addressed
• The setting’s current value
• The proposed value
• Affected users, services, and computers
• Expected operational impact
• A rollback method

2. Check whether the device is centrally managed

On an elevated Command Prompt, run:

gpresult /r

For a more readable Group Policy report, run:

gpresult /h "%USERPROFILE%\Desktop\gpresult.html"

Open the resulting HTML file and inspect the applied computer GPOs. On ARM64 Windows, Microsoft notes that only the gpresult version in SysWOW64 supports /h.

3. Export the current security policy

Create a protected backup folder and export the current configuration:

mkdir C:\SecurityBackup
secedit /export /cfg C:\SecurityBackup\LocalSecurityPolicy.inf

Run these commands from an elevated Command Prompt. Protect the exported file because it can reveal security configuration and account or group identifiers.

An export is useful for documentation and comparison, but it is not a complete system backup. Some security changes, including certain access-control changes, might not be fully reversible through a rollback template.

4. Record the original value

Before editing, note the setting’s original state, including whether it was:

• Enabled
• Disabled
• Not Defined
• Assigned to particular users or groups

A screenshot alone may not capture every assigned principal or related setting.

5. Change one logical group of settings

In secpol.msc:

1. Navigate to the required category.
2. Open the policy.
3. Review its Explain or description text where available.
4. Configure the approved value.
5. Select Apply, and then OK.

Avoid changing unrelated settings at the same time. Smaller changes make troubleshooting and rollback easier.

6. Apply or refresh policy

Many local security settings apply immediately. To request a Group Policy refresh, run:

gpupdate /force

This reapplies Group Policy settings. It does not eliminate requirements for a sign-out, restart, or service restart.

7. Test the result

Test from a separate administrative session where possible. Verify:

• Local and remote sign-in
• Required applications
• Services and scheduled tasks
• File and network access
• Firewall connectivity
• Security-event logging
• Recovery and rollback access

For remote systems, keep a console, out-of-band management, or other recovery method available.

How to Verify Effective Settings

Check Local Security Policy

Reopen secpol.msc and inspect the configured policy. This shows the local policy interface but might not fully explain which domain policy produced the effective result.

Review Resultant Set of Policy

Run:

gpresult /scope computer /r

This displays computer-side Resultant Set of Policy information and helps identify applied GPOs.

For graphical analysis, administrators can also use Resultant Set of Policy or Group Policy Management tools where available.

Check advanced audit policy

Run:

auditpol /get /category:*

This displays the effective system audit policy by category and subcategory.

Check Event Viewer

Open Event Viewer and examine:

Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational

Also check:

Windows Logs > Security

The Security log contains audited security events, while the Group Policy operational log can help diagnose policy processing.

Compare against a security template

The secedit command can analyze the computer against a defined security template. This is more suitable for experienced administrators because it requires a correctly prepared template and security database.

Benefits of secpol.msc

Centralized local security configuration

The console groups important security settings in one location instead of requiring manual registry edits or multiple administrative tools.

Better protection against account attacks

Password and lockout policies can reduce exposure to weak passwords and repeated local-account guessing when configured appropriately.

Least-privilege enforcement

User Rights Assignment helps restrict powerful capabilities to approved administrators, services, and operators.

Improved security visibility

Advanced audit policies can produce records needed for incident investigation, compliance monitoring, and detection systems.

Stronger system hardening

Security Options can disable unsafe legacy behavior, strengthen authentication, and reduce anonymous or unnecessary access.

Application control

Software Restriction Policies and AppLocker can reduce unauthorized application execution when carefully designed and tested.

Repeatable configuration

Security templates and secedit allow administrators to export, analyze, and apply selected security configurations across compatible systems.

No unsupported registry editing

Using a supported policy interface reduces the risk of typographical errors and undocumented registry changes.

Limitations

secpol.msc has important boundaries:

• It is not normally available on Windows Home.
• It manages one computer’s local security policy.
• It does not replace antivirus, endpoint detection, patching, backups, encryption, or firewall design.
• Domain or device-management policy can override local settings.
• Not every Windows security control is exposed in this console.
• Available settings vary by Windows edition and version.
• Some settings affect only local accounts; domain accounts require domain-level administration.
• Policies can remain effective even after the original GPO stops defining them in certain circumstances.
• Incorrect settings can block administrators, users, applications, services, or network access.
• A restart, sign-out, or service restart may be required.
• Local changes do not provide centralized compliance reporting.

For multiple managed computers, use Active Directory Group Policy, Microsoft Intune, or another supported enterprise-management platform.

Security Baselines and Recommended Values

There is no single secpol.msc configuration suitable for every computer. A secure configuration depends on:

• Windows version and edition
• Device role
• Domain membership
• Applications and services
• Regulatory requirements
• Authentication infrastructure
• Network design
• Support for legacy systems

For organizational deployments, start with Microsoft’s current security baselines from the Security Compliance Toolkit. Test the baseline in a representative pilot group before production deployment.

Avoid blindly applying policies copied from blogs, old hardening guides, or another organization. Security recommendations can change, and a technically stronger setting may be incompatible with an existing environment.

Common Problems and Troubleshooting

Windows cannot find secpol.msc

Likely causes include:

• Windows Home is installed.
• The command was typed incorrectly.
• Windows system components are damaged.
• The environment uses Server Core, which lacks the graphical MMC tools.

Check the installed edition under:

Settings > System > About > Windows specifications

Do not download an MMC file from an unofficial website.

Access is denied or settings cannot be changed

Use an administrator account and start the console with Run as administrator. Organizational security controls may also prevent local changes.

A setting returns to its previous value

A domain GPO, Intune policy, security baseline, script, or management product is probably reapplying it. Use gpresult and the relevant management console to identify the controlling source.

A policy is displayed as Not Defined

“Not Defined” means that the current local policy object is not explicitly configuring that setting. It does not necessarily mean that the feature is disabled or that no domain policy applies.

A user can no longer sign in

Check both allow and deny sign-in rights under:

Local Policies > User Rights Assignment

Review local and domain group membership. Deny rights normally override allow rights. Use an unaffected administrator account or approved recovery procedure to correct the assignment.

A service stopped after a policy change

Check whether its service account still has Log on as a service and any other required rights. Also review authentication, firewall, and application-control policies.

Remote Desktop stopped working

Review:

• Allow log on through Remote Desktop Services
• Deny log on through Remote Desktop Services
• Group membership
• Remote Desktop configuration
• Windows Firewall rules
• Network Level Authentication requirements
• Applied domain policies

Use console or out-of-band access rather than repeatedly changing policies remotely.

Security audit events are missing

Verify the effective configuration with:

auditpol /get /category:*

Check the Security log size and retention settings. Confirm that advanced audit policy is not conflicting with legacy audit configuration.

FAQ

Frequently Asked Questions

Is secpol.msc safe to use?

The Microsoft console itself is safe, but its settings are powerful. An incorrect configuration can block sign-in, disable applications, interrupt services, or break network access. Record the original settings and test changes before broad deployment.

Does secpol.msc work on Windows 11?

Yes, on supported editions such as Windows 11 Pro, Enterprise, and Education. It is not normally included with Windows 11 Home.

Is secpol.msc the same as gpedit.msc?

No. secpol.msc is focused on security settings. gpedit.msc opens the broader Local Group Policy Editor, which includes Administrative Templates, scripts, software settings, and the Security Settings section.

Do secpol.msc changes apply to every user?

Many settings are computer-wide, but their effect can depend on the users and groups named in the policy. User Rights Assignment, for example, applies rights to specified security principals.

Does local password policy affect Microsoft accounts?

Local password policies primarily govern locally managed Windows accounts. Microsoft-account authentication and Active Directory or Microsoft Entra account requirements are controlled by their respective identity systems and organizational policies.

Can domain Group Policy override secpol.msc?

Yes. Domain GPOs are processed after local policy and normally take precedence when the same setting conflicts. Management platforms such as Intune may also control security configuration.

Do I need to restart after changing Local Security Policy?

Not always. Some settings apply immediately, while others require gpupdate, a sign-out, restart, service restart, or the creation of a new sign-in session. Follow the documentation for the specific policy.

Can secpol.msc protect a computer from all attacks?

No. It is one security-management component. Effective protection also requires supported software, updates, endpoint protection, firewall management, encryption, backups, least privilege, secure authentication, and user awareness.

Can I copy one computer’s security policy to another?

Selected security settings can be exported and managed through security templates and secedit. Test before applying them elsewhere because account identifiers, applications, services, and device roles may differ. For domain environments, use Group Policy or another centralized management platform.

FINAL RECOMMENDATION / CONCLUSION

Use secpol.msc for controlled, documented security changes on standalone computers or for local testing. Start by identifying the exact risk, export the current configuration, change only the necessary settings, and verify sign-in, services, applications, auditing, and network connectivity afterward.

For multiple or domain-joined computers, manage security centrally through Active Directory Group Policy, Microsoft Intune, or another supported platform. Use Microsoft security baselines as a tested starting point, but pilot every configuration before production enforcement. Never apply unfamiliar policies simply because they appear more restrictive.

#secpolmsc #LocalSecurityPolicy #WindowsSecurity #Windows11 #Windows10 #GroupPolicy #SecurityPolicy #AccountLockout #PasswordPolicy #AuditPolicy #UserRights #WindowsHardening #AppLocker #WindowsFirewall #Secedit #GPUpdate #GPResult #ITAdministration #Cybersecurity #WindowsServer

SOURCES

• Microsoft Learn — Security policy settings
• Microsoft Learn — Administer security policy settings
• Microsoft Learn — Secedit commands
• Microsoft Learn — GPUpdate
• Microsoft Learn — GPResult
• Microsoft Learn — Auditpol
• Microsoft Learn — Group Policy processing for Windows
• Microsoft Learn — Microsoft Security Compliance Toolkit Guide