Remove users ability to invoke machine policy refresh

This setting allows you to control a user's ability to invoke a computer policy refresh.

If you enable this setting, users may not invoke a refresh of computer policy. Computer policy will still be applied at startup or when an official policy refresh occurs.

If you disable or do not configure this setting, the default behavior applies. By default, computer policy is applied when the computer starts up. It also applies at a specified refresh interval or when manually invoked by the user.

Note: This setting only applies to non-administrators. Administrators can still invoke a refresh of computer policy at any time, no matter how this policy is configured.

Also, see the "Group Policy refresh interval for computers" setting to change the policy refresh interval.

Note: If you make changes to this setting, you must restart your computer for it to take effect.


Supported on: At least Windows Server 2003 operating systems or Windows XP Professional
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSoftware\Policies\Microsoft\Windows\System
Value NameDenyUsersFromMachGP
Value TypeREG_DWORD
Enabled Value1
Disabled Value0

grouppolicy.admx

Administrative Templates (Computers)

Administrative Templates (Users)