>

Export the local security policy on Windows (secedit /export)

Dump every local security setting into an INF text file — password rules, user rights, audit policy — that you can diff, review or re-apply.

WindowspolicyhardeningauditLow risk
Run secedit /export /cfg C:\temp\secpol.inf as administrator to write the local security policy to an INF file.

01Command

Command
$ secedit /export /cfg C:\temp\secpol.inf

02What it does

gpresult shows domain-applied policy, but the effective local security settings (Local Security Policy snap-in content) are buried in the registry — secedit /export is the only built-in way to read them all in one text file. It is a fantastic forgotten command for baselining: export before a change, export after, and diff. The same INF can be pushed back with secedit /configure, which makes it both a backup and a restore mechanism.

03Risk

RiskLow risk
RequirementsRun Command Prompt as Administrator
!Warning: Only the /export direction is read-only; applying an edited INF with /configure replaces security settings and can lock you out of user rights you rely on.

04Undo

Undo
$ secedit /configure /db C:\Windows\security\local.sdb /cfg C:\temp\secpol.inf

05Sources

  • SECEDIT - Windows CMD
    SS64 · technical · 2026-09-17
    Evidence: SS64 lists secedit /export /cfg to dump security policy to a file and /configure to apply a template, including the /db parameter.
  • secedit | Microsoft Learn
    Microsoft · vendor-doc · 2026-09-17
    Evidence: Microsoft documents secedit /export as exporting the security settings stored in the database to an INF file, and /configure as applying an INF back to the system.

Last verified: 2026-09-17 · Category: Security & Privacy