LGPO.exe: Batch-Apply Local Group Policy on a Standalone Server (Reflects in gpedit)

On a domain you push Group Policy from Active Directory. On a standalone / workgroup server (no AD) there’s no such luxury — you’re stuck clicking through gpedit.msc by hand, and there’s no clean way to copy that config to the next box. LGPO.exe fixes exactly this: it backs up, transfers, and batch-applies local group policy from the command line, and the result shows up in gpedit.msc just like a manual change.

It’s a free, single-file Microsoft tool (part of the Security Compliance Toolkit) that installs nothing.

Get LGPO.exe

1. Download the Microsoft Security Compliance Toolkit from Microsoft’s official Download Center (search “Security Compliance Toolkit 1.0”).
2. Inside, grab LGPO.zip and extract LGPO.exe to a working folder, e.g. C:\LGPO\.
3. It’s a standalone command-line EXE — no install, no dependencies. Run an elevated Command Prompt for the commands below and change to the extracted folder with cd /d C:\LGPO. The REM comments and bare LGPO.exe examples here use CMD syntax; PowerShell has different comment and executable-path syntax.

The core idea: back up → apply

LGPO works with GPO backups (the same folder format the Group Policy Management Console produces) and with raw policy components — registry.pol, security templates (.inf), and audit CSVs.

Step 1: Configure one server by hand, then back it up

Set your baseline once on a “golden” machine using gpedit.msc, then capture it:

LGPO.exe /b C:\LGPO\Backups

/b writes a GUID-named GPO backup of the current local policy into that folder. That backup is now your portable, version-controllable baseline — commit it to source control if you like.

Step 2: Batch-apply that backup to any standalone server

Copy the backup folder to the target server and import it:

LGPO.exe /g C:\LGPO\Backups\{GUID-folder}

/g imports one or more GPO backups into local policy. Open gpedit.msc afterward and you’ll see the settings populated — LGPO writes the real local-policy store, not a temporary overlay.

⚠️ Apply baselines to a test server first. A bad local policy (e.g. an over-tight user-rights assignment) can lock you out of your own box. Take a /b backup before importing so you can roll back.

Applying individual components

You don’t always have a full GPO backup. LGPO imports pieces directly:

• Registry policy (the bulk of Administrative Templates):

  LGPO.exe /m C:\LGPO\registry.pol

  /m = machine registry.pol; use /u for the per-user registry.pol.
• Security template (account/lockout/user-rights, .inf):

  LGPO.exe /s C:\LGPO\secpol.inf

• Advanced audit policy (CSV):

  LGPO.exe /ac C:\LGPO\audit.csv

After any import, run gpupdate /force to make sure the local policy engine has re-evaluated.

Editing a baseline as text (the power move)

LGPO can convert a registry.pol into a readable text file, let you edit it, then rebuild it:

REM Export to text
LGPO.exe /parse /m C:\LGPO\registry.pol > policy.txt
REM Rebuild .pol from text
LGPO.exe /r policy.txt /w C:\LGPO\registry.pol

That’s how you keep local-policy baselines in Git as plain text and diff changes between server builds.

Applying Microsoft’s security baselines

The same toolkit ships Microsoft Security Baselines (for Windows Server 2019/2022) as GPO backups. On a standalone server you apply them locally with the included Baseline-LocalInstall script, which calls LGPO under the hood — giving a non-domain server the same hardened config a domain would push.

FAQ

Will these settings really show in gpedit.msc? Yes. LGPO writes the actual Local Group Policy store, so gpedit.msc reflects them and gpresult reports them.

Does LGPO work without AD? That’s its main purpose — managing local policy on non-domain-joined systems. No AD required.

How do I undo an import? Keep the pre-change backup and a tested console recovery route. Restoring a backup may not reverse every security setting introduced by an import; compare the changed settings with the baseline and reverse them deliberately. Do not delete all local-policy folders as a generic rollback, especially on a managed machine.

Sources: Microsoft Learn — Security Compliance Toolkit Guide, Microsoft — LGPO.exe Local Group Policy Object Utility