Configures one or more registry-based policy settings under either Computer Configuration or User Configuration in a GPO.
Active Directory · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft GroupPolicy reference: Configures one or more registry-based policy settings under either Computer Configuration or User Configuration in a GPO. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Set-GPRegistryValue. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / GroupPolicy · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-Additive
Indicates that registry values should be appended to existing values under the key when the GPO is applied on a client. By default, when Group Policy is processed on a client, existing values under a registry key are deleted before any new values are written to the registry. By using the Additive parameter for a registry-based policy setting, you can specify that the new value should be added to the registry key without deleting the existing values. You cannot specify the Disable parameter with this parameter.
-Confirm
Prompts you for confirmation before running the cmdlet.
-Disable
Indicates that the cmdlet disables the registry-based policy setting. You can disable a policy setting for a registry key or value: - For a registry key, specify the Key parameter without the ValueName parameter. When the GPO is applied on the client, all of the values directly under the key are removed from the registry. The key itself is not removed from the registry, nor are any of its subkeys, or their values, removed. - For a registry value, specify the Key parameter together with the ValueName parameter. When the GPO is applied on the client, only the specified value is removed from the registry. To remove a policy setting from a GPO without affecting existing registry keys or values on a client when Group Policy is processed, use the Remove-GPRegistryValue cmdlet. You cannot specify the Additive, Type, Value, or ValuePrefix parameters with the Disable parameter.
-Domain
Specifies the domain for this cmdlet. You must specify the fully qualified domain name (FQDN) of the domain. For the Set-GPRegistryValue cmdlet, the GPO in which to configure the registry-based policy setting must exist in this domain. If you do not specify the Domain parameter, the domain of the user that is running the current session is used. If the cmdlet is being run from a computer startup or shutdown script, the domain of the computer is used. For more information, see the Notes section in the full Help. If you specify a domain that is different from the domain of the user that is running the current session (or, for a startup or shutdown script, the computer), a trust must exist between that domain and the domain of the user or the computer. You can also refer to the Domain parameter by its built-in alias, DomainName. For more information, see about_Aliases.
-Guid (required)
Specifies the GPO in which to configure the registry-based policy setting by its globally unique identifier (GUID). The GUID uniquely identifies the GPO. You can also refer to the Guid parameter by its built-in alias, Id.
-Key (required)
Specifies the registry key for the registry-based policy setting; for instance, HKLM\Software\Policies\Microsoft\Windows NT\DNSClient. The key must be in one of the two following registry hives: - HKEY_LOCAL_MACHINE (HKLM) for a registry-based policy setting in Computer Configuration. - HKEY_CURRENT_USER (HKCU) for a registry-based policy setting in User Configuration. You can also refer to the Key parameter by its built-in alias, FullKeyPath.
-Name (required)
Specifies the GPO in which to configure the registry-based policy setting by its display name. The display name is not guaranteed to be unique in the domain. If another GPO with the same display name exists in the domain, an error occurs. You can use the Guid parameter to uniquely identify a GPO. You can also refer to the Name parameter by its built-in alias, DisplayName.
-Server
Specifies the name of the domain controller that this cmdlet contacts to complete the operation. You can specify either the fully qualified domain name (FQDN) or the host name. If you do not specify the name by using the Server parameter, the primary domain controller (PDC) emulator is contacted. You can also refer to the Server parameter by its built-in alias, DC.
-Type
Specifies the data type for the registry-based policy setting. The acceptable values for this parameter are: - String - ExpandString - Binary - DWord - MultiString - QWord For more information about these data types, see Microsoft.Win32.RegistryValueKind Enumeration in the MSDN library. Only the following data types are supported for list values: String and ExpandString. You must specify this parameter when you configure a policy setting to set a registry value. You cannot specify this parameter with the Disable parameter. The following values are permitted for this object type.
-Value
Specifies the value data for the registry-based policy setting. You can specify a single value or an array of values. Use a comma-separated list to specify more than one value. Only the String and ExpandString data types are supported for an array of values. At a minimum, you must specify this parameter together with the *Type* and Key parameters to configure a policy setting to set a registry value. You cannot specify this parameter with the Disable parameter.
-ValueName
Specifies a value name or an array of value names for the registry-based policy setting. For instance, the registry key HKLM\Software\Policies\Microsoft\Windows NT\DNSClient can have a registry value with the following value name: UseDomainNameDevolution. Use a comma-separated list to specify more than one value name. Only the String and ExpandString data types are supported for an array of values. You cannot specify this parameter with the ValuePrefix parameter.
-ValuePrefix
Specifies a value name prefix for a registry-based policy setting for a list of registry values. Configures a policy setting that creates the following registry values when Group Policy is applied on the client: HKLM\SOFTWARE\Policies\ExampleKey ExValue1 100 HKLM\SOFTWARE\Policies\ExampleKey ExValue2 200 HKLM\SOFTWARE\Policies\ExampleKey ExValue3 300 Only the String and ExpandString data types are supported with the ValuePrefix parameter. You cannot specify this parameter with the ValueName parameter or the Disable parameter.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Prerequisites
Windows with the GroupPolicy module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
Examples
Example 1: Configure a registry-based policy setting for a registry value
Set-GPRegistryValue @params
This command configures a registry-based policy setting for the registry value HKCU\Software\Policies\Microsoft\Windows\Control ScreenSaverTimeOut with a value of 900 and a data type of DWord. This policy setting sets the Screen Saver timeout to 900 seconds (15 minutes) when Group Policy is applied on the client. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.