Allow or Prevent Users or Groups to Create Pagefile in Windows 10

The pagefile is where virtual memory that the operating system is using is stored when the physical memory (RAM) is not enough to fit all the running apps and system demands. Windows 10 creates a special file pagefile.sys in the root of your system drive like all previous releases of the OS.

By default, only Administrators are allowed to create a pagefile. You may allow or prevent certain users or a group from being able to create it on a Windows 10 device. Here is how it can be done.

Windows designates a section of the hard drive as virtual memory known as the pagefile, or more specifically, as pagefile.sys. It is used to supplement the computer’s Random Access Memory (RAM) to improve performance for programs and data that are used frequently.

Paging is a memory management scheme by which a computer stores and retrieves data from secondary storage for use in main memory. In this scheme, the operating system retrieves data from secondary storage in same-size blocks called pages. Paging is an important part of virtual memory implementations in modern operating systems, using secondary storage to let programs exceed the size of available physical memory.

There is a special security policy that can be used to allow or prevent certain user accounts or group from managing pagefiles on a Windows 10 device.

If you are running Windows 10 Pro, Enterprise, or Education edition, you can use the Local Security Policy app to change the policy. All editions of Windows 10, including Windows 10 Home, can use an alternative solution mentioned below.

To Allow Users or Groups to Create a Pagefile Windows 10,

1. Press Win + R keys together on your keyboard and type:

   secpol.msc

   Press Enter.

2. Local Security Policy will open. Go to User Local Policies -> User Rights Assignment.
3. On the right, double-click the option Create a pagefile.
4. In the next dialog, click Add User or Group.
5. Click on the Advanced button.
6. Now, click on the Object Types button.
7. Ensure that you have the Users and Groups items checked and click on the OK button.
8. Click on the Find now button.
9. From the list, select the user account or group to deny log on locally for it. You can select more than one entry at once by holding the Shift or Ctrl keys and clicking on the items the list.
10. Click on the OK button to add the selected items to the Object names box.
11. Click on the OK button to add the selected items to the policy list.

You are done.

To Prevent Users or Groups from Creating a Pagefile Windows 10,

1. Press Win + R keys together on your keyboard and type:

   secpol.msc

   Press Enter.

2. Local Security Policy will open. Go to User Local Policies -> User Rights Assignment.
3. On the right, double-click the option Create a page file.
4. Select an entry, use the Remove button in the policy dialog.

If your Windows edition doesn't include the secpol.msc tool, here is an alternative solution.

If your Windows edition doesn't include the secpol.msc tool, you can use the ntrights.exe tool from Windows 2003 Resource Kit. Many resource kit tools released for previous Windows versions will run successfully on Windows 10. ntrights.exe is one of them.

The ntrights tool

The ntrights tool allows you to edit user account privileges from the command prompt. It is a console tool with the following syntax.

• Grant a right: ntrights +r Right -u UserOrGroup [-m \\Computer] [-e Entry]
• Revoke a right: ntrights -r Right -u UserOrGroup [-m \\Computer] [-e Entry]

The tool supports plenty of privileges which can be assigned to or revoked from a user account or group. Privileges are case sensitive. To learn more about the supported privileges, type ntrights /?.

To add ntrights.exe to Windows 10, read this post: What is ntrights app and how you can use it. You can place the ntrights.exe file to the C:\Windows\System32 folder to quickly call it.

Revoke Create Pagefile Right with ntrights

1. Open an elevated command prompt.
2. Type the following command to deny 'Create a page file' right:

   ntrights -u SomeUserName +r SeCreatePagefilePrivilege

   Substitute the SomeUserName portion with the actual user name or group name. The specified user will be prevented from locally signing to Windows 10.

3. To undo the change and allow the user to create a page file, execute

   ntrights -u SomeUserName -r SeCreatePagefilePrivilege

That's it.

Related articles.

• How to Clear Pagefile at Shutdown in Windows 10