|Home │ Group Policy Pt 1 │ GP Pt 2 │ GP Pt 3|
Install the Group Policy Editor in Windows XP Home Edition (for testing purposes)
Topics on this page:
The Group Policy Editor comes with Windows XP Professional edition but not Home edition (which cannot be joined to a domain). However, many registry policy settings set by the Local Computer Policy are operational in the home edition. That is one of the reasons why Internet Explorer is vulnerable to hijacking and regedit can be locked.
There are tools available which mimic some but not all aspects of the Group Policy editor and would work in Windows XP Home edition: Camtech2000's Internet Explorer Restrictions and more recently, a tool from Doug Knox. You'll also find a lot of registry hacks on the internet and the Microsoft Windows XP Registry Guide (Jerry Honeycutt, Microsoft Press, 2003).
For an introduction to the Group Policy Editor in Windows XP Professional edition, refer to my articles on it. This article documents my attempt to install it in Windows XP Home edition. The result is not totally successful but something can be achieved. This is for testing purpose only and you are not encouraged to hack the operating system or violate the EULA.
Before you do anything, make a complete back up of the system first. Make a system restore point and use NTBackup to back up the System State if you wish but I would not count on them. Also you should understand that this is for experienced users only. This was done in Windows XP SP1 Home Edition English version.
Basically you need to copy some files from Windows XP Professional to home edition, register some DLL files and check the registry.
1. Copy gpedit.msc to %SYSTEMROOT%\system32 folder.
2. Copy gpedit.dll, gptext.dll and fde.dll to the same folder. Copy %SYSTEMROOT%\system32\GroupPolicy\User and Machine folders with their contents to the same destination location.
3. Copy the six default administrative templates:
to %SYSTEMROOT%\inf folder (normally hidden) and the four adm files marked with * to %SYSTEMROOT%\system32\GroupPolicy\Adm folder.
4. Register the gpedit.dll file by typing the command:
in the Run box. You'll see a confirmation box. If you omit this step when you try to run gpedit.msc you'll get an error message that a CLSID entry is missing.
5. Register the fde.dll file. If you omit this you'll get another error message (file missing) when starting gpedit.msc. This file is for folder redirection which is unsupported in computers not in a domain. Registering the file will get rid of the error message.
6. Register the gptext.dll file.
After you've done the above when you run gpedit.msc it should open with the four administrative templates in place with some exceptions. You can expand the console tree, double-click on a policy setting and appear to be able to enable it (fig. 1).
Fig. 1. The Group Policy Editor in Windows XP Home Edition.
Unfortunately it writes to the incorrect registry key. For example, the correct key for the Group Policy editor, User Configuration\Administrative Templates\System, Prevent access to registry editing tools should be:
Instead it writes temporarily to (the extra entry in red):
and the key would vanish when you close gpedit.msc and regedit. The Group Policy Object entry indicates that it "behaves" as if in a domain.
Another example is in the Group Policy editor's Tools menu: Disable Internet Options menu option in: User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser menus.
The correct registry key is:
Instead it writes to (Fig. 2):
Fig. 2. The NoBrowserOptions phantom key. The entire Group Policy Objects key is phantom.
Although it seems disappointing that it behaves this way, while gpedit.msc is running, you can open regedit and examine what keys and values are being written. This would give you some idea what the correct key should be.
I've also tried replacing some more files in the home edition with those from the Pro edition but with no further advance in getting it to work completely. The files include: WinSXS folder, system32\version.dll (this cannot be unregistered first), REGISTRATION, mmc.exe (identical in both versions), mmcbase.dll (cannot be unregistered), mmcndmgr.dll (identical in both versions), mmcshext.dll.
I've not replaced other files which are accessed when starting gpedit.msc and which are found to have identical versions in both Windows XP editions. They include: admfiles.ini, explorer.exe, msimtf.dll, msxml3.dll, oleacc.dll, rpcss.dll, shdocvw.dll and winmm.dll.
I've checked many registry entries (comparing those in XP Pro with XP Home) after registering the new dll files. These keys are missing in XP Home and was added (the entire key with subkeys were added and the user SID was changed before importing):
The three critical system files which are accessed early on when gpedit.msc starts are: ntdll.dll, shell.dll and kernel32.dll. I've not attempted to replace them as they probably will do major damage but these three files seems to be crucial in determining whether gpedit.msc will run successfully or not. When I check the version of mmc in the Help menu, the Windows XP Professional version always comes up with XP Professional version and the XP Home version always as XP Home version, despite the fact that I've replace the mmc.exe file with the Pro version.
Over 18,000 files and over 110 registry keys are processed - queried, opened, closed, written or delete - from the moment I click OK in the Run box to the moment the Group Policy editor loads in Windows XP Home edition and more in the professional edition. There are so many steps involved when the Group Policy editor is opened (and before I do anything with it) that it would be virtually impossible to pinpoint exactly where the difference in behaviour between the home and professional versions lie.
If after all this I've "whetted" your appetite about the Group Policy Editor, consider upgrading to Windows XP Professional edition.
Go to TOP of the page.
Copyright © 2003-2005 by Kilian. All my articles including graphics are provided "as is" without warranties of any kind. I hereby disclaim all warranties with regard to the information provided. In no event shall I be liable for any damage of any kind whatsoever resulting from the information. The articles are provided in good faith and after some degree of verification but they may contain technical or typographical errors. Links to other web resources may be changed at any time and are beyond the control of the author. Articles may be added, removed, edited or improved at any time. No support is provided by the author.
This is not an official support page for any products mentioned. All the products mentioned are trademarks of their companies. Edit the registry at your own risk and back up first.
Last updated 20 Jun 2005 (minor typos and format correction)