Local Group Policy Editor basics for a standalone server

The Local Group Policy Editor (gpedit.msc) controls hundreds of Windows settings from one place. On a standalone server, one that is not part of an Active Directory domain, it is the main way to set rules such as Remote Desktop session limits or update behaviour. This guide explains how the editor is laid out, how to apply and check a change, and a few policies that are useful on a remote server.

Before you start

• Administrator access over Remote Desktop to 203.0.113.10:3389.
• The browser console in your VPS provider's control panel as a fallback, in case a policy affects your own sign-in.
• Windows Server, or Windows 10/11 Pro or higher. Home editions do not include gpedit.msc.

Open the editor

Press Win + R, type gpedit.msc and press Enter.

The left pane has two top-level sections:

• Computer Configuration: settings that apply to the whole machine, whoever signs in. Most server settings live here.
• User Configuration: settings that apply to users when they sign in. In the local editor they apply to all users on the machine.

Each section has three folders:

• Software Settings: rarely used on a standalone server.
• Windows Settings: includes Security Settings, which is the same content you see in secpol.msc, and logon or startup Scripts.
• Administrative Templates: the large tree of settings for Windows components, such as Remote Desktop Services and Windows Update.

Read and change a setting

1. Browse to a setting in the tree and double-click it.
2. Choose Not Configured, Enabled or Disabled.
3. If enabled, fill in any options in the lower-left box.
4. Read the Help box on the right. It explains exactly what each state does.
5. Click OK.

Not Configured means "let Windows use its default". Setting a policy back to Not Configured is the clean way to undo a change.

Apply changes with gpupdate

Windows refreshes policy in the background every so often, but you can apply changes immediately. Open PowerShell or Command Prompt as Administrator:

gpupdate /force

Expected output:

Updating policy...

Computer Policy update has completed successfully.
User Policy update has completed successfully.

Some settings only take effect after a sign-out or a restart. If so, gpupdate tells you.

Check what is applied with gpresult

gpresult shows which policies are in effect:

gpresult /r /scope computer

On a standalone server the list mostly says Local Group Policy. That is expected. For a detailed, readable report of every applied setting, create an HTML file and open it in a browser:

gpresult /h C:\PolicyBackup\gp-report.html

Create the C:\PolicyBackup folder first if it does not exist. Run gpresult from an elevated prompt to include computer settings.

Useful policies for remote servers

These all live under Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host:

• Session Time Limits → Set time limit for disconnected sessions: signs out sessions left disconnected for too long. Leave this off if you run apps, such as trading terminals, in a disconnected session. See RDP session time limits.
• Connections → Restrict Remote Desktop Services users to a single Remote Desktop Services session: each user gets one session, and reconnecting resumes it.
• Security → Require user authentication for remote connections by using Network Level Authentication: makes users authenticate before a session starts, which reduces load from attackers.
• Device and Resource Redirection → Do not allow Clipboard redirection or Do not allow drive redirection: stops copy-paste or drive sharing for tighter security.

Under Computer Configuration → Administrative Templates → Windows Components → Windows Update, you can control when updates install and whether the server may restart automatically. Sub-folder names differ between Windows versions, so use the keyword filter to find Configure Automatic Updates and the restart-related settings.

Back up and reset local policy

Local policy for Administrative Templates is stored in C:\Windows\System32\GroupPolicy. To back it up, copy that folder (it is hidden) while signed in as an administrator:

Copy-Item -Path "$env:windir\System32\GroupPolicy" -Destination "C:\PolicyBackup\GroupPolicy" -Recurse

If policies cause a problem and you cannot find the bad setting, set it back to Not Configured. As a last resort, renaming the GroupPolicy folder and running gpupdate /force resets Administrative Template settings to defaults. Security settings are separate and are not reset this way.

Check it works

After changing an RDP policy, run gpupdate /force, then open a second Remote Desktop session to 203.0.113.10:3389 while the first stays open. Confirm the new behaviour and that you can still sign in.

Troubleshooting

• "Windows cannot find gpedit.msc": you are on a Home edition, which does not include the editor.
• A policy seems to have no effect: run gpresult /h and check the setting is listed. Some need a restart or a new sign-in.
• Locked out after a policy change: sign in through the browser console in your VPS provider's control panel, set the policy back to Not Configured and run gpupdate /force.
• The tree looks empty: a filter is on. Use Action → Filter Options and clear it.

Next steps

• Security-specific settings: Local Security Policy basics on Windows Server.
• Keep sessions alive for always-on apps: Keep apps running 24/7 on RDP.