How-To Geek

How to See Which Registry Settings a Group Policy Object Modifies


Today we are going to show you how to use one of our favorite tools, Proc Mon, to see which registry keys are edited when you change a Group Policy setting on your PC.

Using Proc Mon to See Which Registry Settings a Group Policy Object Modifies

The first thing you will want to do is go and get yourself a copy of Proc Mon from the Sys Internals website.


Then you will need to extract the folder and run  the Procmon.exe file.

When Proc Mon opens, you will need to add a condition as follows:

Process Name is mmc.exe then Include

Then click the add button.

To get only the registry keys that are changed, we need add another one:

Operation is RegSetValue then Include

Then again click the add button.

Once the two rules have been added, you can go ahead and click ok.

Now go and open the Group Policy setting that you wish to edit.

Before you actually change the setting, switch back over to Proc Mon and clear the log.

Then go and change the GPO and click apply.

If you switch over to Proc Mon you will see that you have a registry key(s) there. Right-click on it and select the Jump To… option from the context menu.

That will fire up Regedit and take you to the exact key which was modified

That’s all there is to it guys.

Taylor Gibb is a Microsoft MVP and all round geek, he loves everything from Windows 8 to Windows Server 2012 and even C# and PowerShell. You can also follow him on Google+

  • Published 06/7/12

Comments (16)

  1. Jim

    Very cool tip. Thanks!

  2. Doug

    Does this work to show what a current GPO is modifying?

  3. M88

    Not sure if i did something wrong, but when i add the filter for mmc.exe, all the processes disappear….

    just to confirm:

    add process monitor filter > Process name : is : mmc.exe > add

    when i do that, everything disappears.

  4. M88

    I forgot to mention, i have used “include” as well.

  5. M88

    Never mind i just figured it out, you need group policy editor open….


  6. Josh Smith

    I always forget how helpful the Proc Mon filters are. Cool and useful tip, thanks!

  7. informer

    Or, you can just download the .xls files from microsoft site:

    They have all the registry paths per setting listed.

    btw. i love sysinternals tools, use them daily @work.

  8. charliann

    I got as far as adding the two new filters. When I hit ok, the screen is blank, and there is a process going on at the bottom that starts counting all the items that are excluded. Where do I go to find the Group Policy Editor???

  9. Taylor Gibb

    press the windows key + r and type gpedit.msc and hit enter :)

  10. charliann

    I didn’t mention this… the reason I need to change a group policy, and I have no idea what the policy is called, is because my brother can’t change the desktop background on his computer. It is always “blocked by group policy”. He can’t use “set as desktop wallpaper” at all. Since he is a total newbie,
    I go onto his desktop remotely,using “Log Me In, to perform setup tasks. I have never seen this problem before and I have no idea how to fix it.

    Thanks so much.

  11. charliann

    gredit.msc will not work on my computer. Windows can’t fine it.

  12. informer

    also, if you are interested in seeing what group policy settings are applied to your computer/user account, use rsop.msc. Or if u need a command line interface run gpresult from your command prompt.

    i know this goes beyond the scope of this article, but just thought maybe some ppl are wondering about it so there u go.

  13. informer

    @charliann – do you have a “home” version of windows ? in that case u have no access to those tools (because those os editions are not able to join a domain).

    in that case you need to add them to registry directly. fire up regedit and do the required modifications for the setting you wish to apply.

    ^for reference

  14. spike

    @charliann: If you typed it just as you did here – “gredit.msc”, then that is why it couldn’t find it. Type “gpedit.msc”, and see what happens then :). Also, as informer said, the tools aren’t there on home or starter editions of windows, if that is what you are running.

  15. spike

    @Doug: No. But if I am guessing right on what you are trying to do- if you are in a windows domain environment, on a DC, you can run gpmc.msc, and use Group Policy Results to find what settings are applying to a specific user.

  16. Wilson

    My computer reboots when I use the proc mon, need help

More Articles You Might Like

Enter Your Email Here to Get Access for Free:

Go check your email!