I'm trying to understand how Windows stores policies. As I understand it, local workstation policies can either be governed via Group Policy if in a domain, or local on the server if it isn't in a domain. But the policy configuration isn't stored in the Registry - so where is it stored?

I spun up a stock Windows Server 2012 R2 image to try and find it, but I don't have any of the common directories such as NTDS and SYSVOL.

  • NTDS and SYSVOL only exist on domain controllers; Group Policy Objects are stored in SYSVOL, but that is a static storage, there is no way to know where they are applied by only looking at it. NTDS is the Active Directory database, but you can't simply read its contents, you have to actually query a domain controller. – Massimo Jun 17 '20 at 12:33

In a database:


Audit policies are located in computer configuration -> Policies -> Windows setting -> Security settings -> Local policies -> Audit policies.

I hope you find this information useful

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy