Secpol.msc: How Windows Local Security Policy Works, Its Benefits, Settings, and Safe Use

QUICK ANSWER

secpol.msc opens the Windows Local Security Policy console. Administrators use it to manage security settings for one computer, including password and account-lockout rules, sign-in rights, auditing, security options, firewall policies, and application-control policies.

It is most useful for standalone PCs, workgroup computers, testing, troubleshooting, and limited local hardening. On domain-managed or MDM-managed devices, centrally applied policies can override local settings. The console is normally unavailable in Windows Home editions.

 

What Is secpol.msc?

secpol.msc is the Microsoft Management Console snap-in for Local Security Policy. It provides a graphical interface for viewing and configuring security policies that apply to the local Windows computer.

The filename can be understood as:

• sec: Security
• pol: Policy
• .msc: Microsoft Management Console snap-in

Local Security Policy is a focused subset of the broader Local Group Policy Editor. In gpedit.msc, equivalent settings are generally located under:

Computer Configuration > Windows Settings > Security Settings

Microsoft supports security policy settings for controlling account policies, user rights, auditing, registry security, services, access control, and other security-related behavior. Windows 10

System Requirements and Important Limitations

Supported Windows editions

The Local Security Policy console is generally included with:

• Windows 10/11 Pro
• Windows 10/11 Enterprise
• Windows 10/11 Education
• Supported Windows Server editions

It is normally not included with Windows Home. If Windows reports that it cannot find secpol.msc on a Home edition, this is expected rather than evidence of a damaged Windows installation. Microsoft Q&A

Do not install unofficial scripts or copied system files to force the editor onto Windows Home. Such methods are unsupported and may introduce security, servicing, or stability problems. Use supported Windows settings, PowerShell or command-line controls where applicable, or upgrade to an edition that includes the required management features.

Administrator access

You may be able to inspect some settings without elevation, but changing security policy normally requires an administrator account and approval through User Account Control.

Local scope

secpol.msc manages the local computer. It is not a replacement for:

• Active Directory Group Policy
• Microsoft Intune or another MDM platform
• Microsoft security baselines
• Enterprise configuration-management products

For multiple managed computers, central policy management is more consistent and auditable.

Domain and MDM precedence

On an Active Directory domain, policies are processed through a hierarchy that begins with local policy and continues through site, domain, and organizational-unit GPOs. A higher-precedence domain policy can therefore replace a conflicting local setting. learn.microsoft.com

MDM security policies can also control applicable settings. If a local option repeatedly changes back, investigate domain GPOs, MDM profiles, security software, and configuration-management tools.

How secpol.msc Works

The console does not run continuously as a security program. It is an administrative interface used to read and modify local security configuration.

The normal process is:

1. An administrator opens secpol.msc.
2. The administrator changes a supported security setting.
3. Windows saves the configuration in the relevant local policy or security database.
4. Windows applies the setting through the component responsible for that policy.
5. A domain GPO or MDM policy may later replace the local value if it manages the same setting.

The time required for a change to take effect varies:

• Some settings apply immediately.
• Sign-in rights and privileges may require the affected user to sign out and sign in again so Windows can create a new access token.
• Service-related settings may require a service restart.
• Sign-in or startup settings may require a restart.
• Group Policy-controlled settings may change during the next policy refresh.

Changing a user right does not update an existing access token; the user must sign in again before the new right is reflected in a new token. Win32 apps

How to Open Local Security Policy

Method 1: Use the Run dialog

1. Press Windows key + R.
2. Enter:

secpol.msc

3. Press Enter.
4. Approve the User Account Control prompt if Windows displays one.

Method 2: Use Windows Search

1. Open Start or Search.
2. Search for Local Security Policy.
3. Select the result.
4. Choose Run as administrator if you need to make changes.

Method 3: Open it from a terminal

From Command Prompt, PowerShell, or Windows Terminal, run:

secpol.msc

Microsoft documents secpol.msc as the command for opening Local Security Policy and then selecting policies under Security Settings. Windows 10

Main Sections in Local Security Policy

The exact nodes depend on the Windows edition, version, installed features, and device configuration.

Availability of a node does not guarantee that every feature is licensed, active, or appropriate for that Windows edition.

Account Policies

Password Policy

Password Policy can control settings such as:

• Enforcing password history
• Maximum and minimum password age
• Minimum password length
• Password complexity requirements
• Reversible password storage

Avoid enabling reversible password storage unless a documented legacy application specifically requires it. Reversible storage weakens password protection.

On a standalone or workgroup computer, these settings apply to local accounts. On a domain-joined member computer, the password policy for domain accounts is normally supplied by the domain. Editing the member computer’s local password policy does not redefine the domain password policy.

Modern authentication security should also include multifactor authentication, phishing-resistant credentials where available, and protection against compromised passwords. Password policy alone cannot provide those protections.

Account Lockout Policy

Account Lockout Policy controls what happens after repeated failed sign-in attempts. Common settings include:

• Account lockout threshold
• Account lockout duration
• Time before the failed-attempt counter is reset

Lockout policies can reduce basic password-guessing attempts, but overly aggressive values may let an attacker deliberately lock users out. Test the policy and ensure that administrators have a recovery procedure.

Kerberos Policy

Kerberos Policy controls Kerberos ticket behavior in an Active Directory environment. It is primarily relevant to domain policy and domain controllers, not to ordinary local accounts on a standalone PC.

Do not change Kerberos lifetimes merely to “increase security.” Incorrect values can cause authentication failures, especially when clocks are not synchronized or applications use long-running sessions.

Local Policies

Audit Policy

Audit Policy controls which activities Windows records in the Security event log. Examples include:

• Account sign-in activity
• Account management
• Object access
• Policy changes
• Privilege use
• System events

Auditing improves investigation, accountability, and compliance, but excessive auditing can generate large numbers of events and make useful activity harder to identify.

For modern systems, Advanced Audit Policy provides more detailed subcategories. Microsoft notes that basic and advanced auditing are recorded and applied differently, so administrators should avoid configuring overlapping audit policy models without a clear design. learn.microsoft.com

User Rights Assignment

User Rights Assignment determines which users and groups may perform sensitive operating-system actions. Examples include:

• Access this computer from the network
• Allow log on locally
• Log on as a service
• Log on as a batch job
• Back up files and directories
• Shut down the system
• Debug programs
• Deny log on locally
• Deny access from the network

User rights differ from file and folder permissions. A user right authorizes an operating-system-level action or sign-in method, while a permission controls access to a particular object.

Microsoft confirms that user rights control how users can sign in and what system-level tasks they may perform. Windows 10

Warning: Deny rights normally take precedence over corresponding allow rights. Adding the wrong user or group to a deny policy can block administrators, services, scheduled tasks, or remote-management tools.

Before changing a sign-in right:

1. Identify every account and service that depends on it.
2. Preserve an emergency administrative path.
3. Test the change on a non-production computer.
4. Sign out and sign in again when testing user-right changes.

Security Options

Security Options contains many system-wide security behaviors, including policies related to:

• Administrator and Guest accounts
• Interactive sign-in
• User Account Control
• Network security and authentication
• SMB signing
• Anonymous access
• Removable media
• Shutdown behavior
• Device and driver installation

The security value of each setting depends on the environment. Enabling a restrictive setting without reviewing application, network, and recovery requirements can break legacy authentication or remote access.

Advanced Audit Policy Configuration

Advanced Audit Policy divides broad audit categories into detailed subcategories. It can record activities such as:

• User and computer account changes
• Credential validation
• Process creation
• File and registry access
• Security policy changes
• Logon and logoff events
• Privilege use
• System integrity events

Its benefits include:

• More precise event collection
• Reduced unnecessary log volume
• Better incident investigation
• Improved compliance reporting
• Clearer monitoring of high-value systems

To view the effective advanced audit policy, open an elevated Command Prompt and run:

auditpol /get /category:*

The auditpol tool is designed to display and manage system and per-user audit policy. learn.microsoft.com

Do not use both basic and advanced audit settings casually. Configure the policy that forces advanced subcategory settings to override basic audit categories when your organization has intentionally adopted advanced auditing.

Benefits of Using secpol.msc

Improved local security

Administrators can reduce unnecessary privileges, strengthen local account controls, restrict sign-in methods, and enable meaningful auditing.

Built into Windows

No separate third-party editor is required on supported editions.

Central view of local security settings

The console organizes many important controls into one interface, making configuration and inspection easier than editing individual registry values.

Better auditing and troubleshooting

Audit policies can provide evidence about sign-ins, account changes, process activity, access attempts, and policy changes.

Useful for standalone systems and laboratories

Local Security Policy is practical for workgroup PCs, isolated systems, virtual machines, test environments, kiosks, and troubleshooting.

Supports security hardening

It can help implement an approved security baseline. Microsoft recommends established security baselines because they have been tested and include supporting documentation, rather than constructing an untested baseline one setting at a time. learn.microsoft.com

Risks and Safe-Use Practices

Incorrect security-policy changes can cause:

• Loss of local or remote sign-in access
• Services that fail to start
• Scheduled tasks that stop working
• Application or network authentication failures
• Excessive Security log growth
• Conflicts with domain or MDM policy
• Reduced security if auditing or protections are disabled

Use these precautions:

1. Change only settings whose effects you understand.
2. Record the original value and the reason for the change.
3. Test changes on a non-production device first.
4. Back up applicable security settings.
5. Keep a separate recovery-capable administrator account where appropriate.
6. Do not remove required service accounts from user-right assignments.
7. Use Microsoft’s supported baseline guidance for organizational hardening.
8. Verify the effective policy instead of assuming the displayed local value is controlling the computer.
9. Avoid applying downloaded security templates from unknown sources.
10. Plan for physical or console recovery before changing remote-logon policies.

Back Up Local Security Settings

Open Command Prompt as administrator, create a protected backup folder, and run:

secedit /export /cfg "C:\SecurityBackup\LocalSecurityPolicy.inf"

The secedit /export command exports security settings from a configured security database and can be used as part of a security-policy backup process. learn.microsoft.com

Important limitations:

• A secedit export is not a complete system backup.
• It may not capture every setting visible through all secpol.msc extensions, including every firewall, AppLocker, or advanced audit configuration.
• Protect the exported file because it reveals security configuration.
• Do not assume that importing the file will safely reverse every later change.

For template-based recovery, Microsoft recommends validating the template and generating rollback information before importing it. learn.microsoft.com

Apply and Verify Policy Changes

Refresh Group Policy

When a setting is managed through Group Policy, an administrator can request a refresh with:

gpupdate /force

A sign-out or restart may still be required.

Generate an effective-policy report

Open an elevated Command Prompt and run:

gpresult /h "%USERPROFILE%\Desktop\GPReport.html"

Open GPReport.html from the desktop. gpresult reports Resultant Set of Policy information and can generate an HTML report showing policies applied to the computer and user. learn.microsoft.com

Verify advanced auditing

auditpol /get /category:*

Check relevant event logs

Review:

• Event Viewer > Windows Logs > Security
• Event Viewer > Windows Logs > System
• Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational

When Group Policy processing fails, Microsoft recommends examining Group Policy-related events and their activity identifiers. learn.microsoft.com

Common Practical Uses

Configure local account lockout

Navigate to:

Account Policies > Account Lockout Policy

Choose values that balance resistance to password guessing with the risk of deliberate or accidental denial of service.

Grant a service sign-in permission

Navigate to:

Local Policies > User Rights Assignment > Log on as a service

Add only the dedicated service identity that requires the right. Avoid assigning it broadly to normal users.

If domain Group Policy manages this setting, adding an account locally may be temporary or ineffective.

Display a legal sign-in notice

Navigate to:

Local Policies > Security Options

Configure the interactive logon message title and text only after obtaining approval from the organization’s legal or compliance team.

Restrict local interactive sign-in

Use Allow log on locally and Deny log on locally carefully. Confirm that administrators retain access before applying the change.

Enable security auditing

Prefer specific Advanced Audit Policy subcategories that support a documented monitoring objective. Confirm that Security log size and event-collection capacity are sufficient.

Local Security Policy Versus Other Windows Tools

Troubleshooting secpol.msc

“Windows cannot find secpol.msc”

Check the Windows edition:

1. Press Windows key + R.
2. Run:

winver

3. Confirm whether the computer uses Windows Home, Pro, Enterprise, or Education.

On Windows Home, the missing console is normally an edition limitation. On a supported edition, verify that C:\Windows\System32\secpol.msc exists and repair Windows components if it is unexpectedly missing.

Run these commands from an elevated terminal:

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Restart Windows after the checks complete. Do not download secpol.msc from third-party websites.

A setting is greyed out or cannot be changed

Possible causes include:

• The console was not opened with administrative rights.
• Domain Group Policy controls the setting.
• MDM controls the setting.
• The Windows edition does not support the feature.
• Security software or configuration management enforces another value.

Use gpresult and check the device’s work or school management status.

A changed setting returns to its previous value

This usually indicates that a domain GPO, MDM profile, security baseline, script, or management agent is reapplying the configured value.

Generate a gpresult report and consult the organization’s administrator before attempting to bypass centrally managed policy.

The displayed audit settings do not match auditpol

Basic and advanced audit settings can overlap but are stored and applied differently. Query the effective audit configuration with:

auditpol /get /category:*

Then review whether Advanced Audit Policy and its override option are consistently configured.

A user or service can no longer sign in

Check:

• Allow and deny sign-in rights
• Group memberships
• Service account configuration
• Domain GPOs
• Event Viewer failure events

Deny rights should be investigated first because they can override an allow right. Use console or recovery access if the policy has also disabled remote administration.

FAQ

Frequently Asked Questions

Is secpol.msc an antivirus or security scanner?

No. It is a policy-management console. It configures security behavior but does not scan files, remove malware, or replace Microsoft Defender Antivirus.

Is secpol.msc available in Windows 11 Home?

Normally, no. Windows Home does not include the Local Security Policy console. Avoid unofficial enablement scripts; use supported settings or upgrade to an appropriate Windows edition.

What is the difference between secpol.msc and gpedit.msc?

secpol.msc focuses on local security settings. gpedit.msc exposes the broader Local Group Policy configuration, including administrative templates and user settings.

Do secpol.msc changes affect every user?

Many settings are computer-wide, but their practical effect depends on the accounts, groups, services, and sign-in methods referenced by the policy.

Does local password policy affect domain accounts?

On a domain-joined member computer, local password policy generally governs local accounts. Domain account password requirements are managed through Active Directory domain policy.

Can domain Group Policy override secpol.msc?

Yes. A higher-precedence domain GPO can replace a conflicting local security setting. MDM policies may also manage applicable settings.

Do changes take effect immediately?

Some do. Others require a policy refresh, service restart, user sign-out, or computer restart. User-right changes normally require a new sign-in session.

Can secpol.msc configure another computer remotely?

It is primarily intended for local policy management. Use domain Group Policy, MDM, PowerShell remoting with approved controls, or another supported management platform for remote and large-scale administration.

Can I restore every secpol.msc setting with one command?

No single backup method should be assumed to capture and safely restore every policy category. secedit can export and configure supported security areas, but firewall, application-control, advanced auditing, and centrally managed policies may require separate tools and backups.

What should I use for organization-wide security hardening?

Use centrally managed Group Policy or MDM with a tested security baseline, staged deployment, documented exceptions, monitoring, and a rollback plan. Microsoft’s Security Compliance Toolkit provides supported baseline resources and management tools.

FINAL RECOMMENDATION / CONCLUSION

Use secpol.msc for inspecting and carefully configuring the security policy of an individual supported Windows computer. Before changing a setting, document the current value, understand its scope, back up applicable configuration, and test the change outside production.

For businesses, use centrally managed Group Policy or MDM with Microsoft security baselines instead of manually configuring every computer. Always verify the effective result with gpresult, auditpol, and Event Viewer, particularly when the computer is joined to a domain or managed by an organization.

 

#secpol #secpolmsc #LocalSecurityPolicy #WindowsSecurity #Windows11 #Windows10 #WindowsServer #GroupPolicy #SecurityPolicy #PasswordPolicy #AccountLockout #UserRights #AuditPolicy #AdvancedAuditPolicy #WindowsHardening #Secedit #Auditpol #Gpresult #ITAdministration #Cybersecurity

SOURCES

• Microsoft Learn — Configure security policy settings. Windows 10
• Microsoft Learn — Administer security policy settings. Windows 10
• Microsoft Learn — Security policy settings. Windows 10
• Microsoft Learn — User Rights Assignment. Windows 10
• Microsoft Learn — Group Policy processing for Windows. learn.microsoft.com
• Microsoft Learn — Advanced Audit Policy Configuration settings. learn.microsoft.com
• Microsoft Learn — Windows security baselines. learn.microsoft.com
• Microsoft Learn — Secedit commands and export. learn.microsoft.com
• Microsoft Learn — Gpresult command and Group Policy Results. learn.microsoft.com
• Microsoft Learn — Applying Group Policy troubleshooting guidance. learn.microsoft.com