How to Completely Disable ‘Registry Editor’ (regedit.exe) via Group Policy in Windows 11

The Registry Editor (regedit.exe) is the most powerful and dangerous configuration tool built into the Windows operating system. It provides direct, unfiltered access to the hierarchical database that stores low-level settings for the Windows kernel, device drivers, user profiles, and installed applications. In a managed environment—such as a school, a retail kiosk, or a strictly controlled corporate workstation—allowing standard users access to the Registry Editor is an unacceptable security risk. A single incorrect deletion or modification can instantly render the operating system unbootable or completely bypass critical security policies.

This guide explains how to completely disable access to the Registry Editor in Windows 11 using the Group Policy Editor, ensuring users cannot launch the tool.

Disable Registry Editor via Group Policy

The Local Group Policy Editor provides a specific, built-in policy designed exactly for this purpose. Note that the Group Policy Editor is only available on Windows 11 Pro, Enterprise, and Education editions. If you are configuring a Windows 11 Home machine, you will be unable to use this method.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, drill down to the following path:

   User Configuration > Administrative Templates > System

5. With the “System” folder selected, look at the main pane on the right. Locate the policy named Prevent access to registry editing tools.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. Under the “Options” section, you will see a dropdown menu asking: Disable regedit from running silently?
   • Leave this set to Yes to ensure that background scripts (like .reg files) also cannot execute and merge data silently.
9. Click Apply, then click OK.

Verify the Lockdown

Group Policy restrictions usually apply instantly. To verify the lockdown is active, press the Windows Key + R, type regedit, and press Enter.

Instead of the familiar UAC prompt and the Registry Editor launching, the system will immediately display a stern error message stating: “Registry editing has been disabled by your administrator.” The user’s only option is to click OK and the window will terminate. Furthermore, if the user attempts to double-click a .reg file on their desktop, they will receive the exact same error, preventing them from merging any unauthorized configuration data into the system.