Restrict which programs can be run

by Mitch Tulloch [Published on 28 June 2006 / Last Updated on 28 June 2006]

How to restrict which programs are allowed to run on a computer

A common question is how can I restrict which programs can be run on Windows? With Group Policy (or Local Group Policy on a standalone machine) you can do this, though it takes a bit of work. Here's how it works:

In a domain, open the GPO linked to the container holding the user accounts you want to restrict (or on a standalone computer use Start --> Run --> type gpedit.msc to open the Local GPO).

Expand User Configuration \ Administrative Templates \ System Open the policy named Run Only Allowed Windows Applications Enable the policy and click Show

Click Add and type the executable name for each program you want to *allow* the user to run

Once the policy is applied, the user will only be able to run the programs you specified and no others. Unless you have allowed them access to the command prompt cmd however, in which case they can run pretty much anything if they can find it.

Cheers, Mitch Tulloch, MVP

See Also

The Author — Mitch Tulloch

Mitch Tulloch is a well-known expert on Windows Server administration and cloud computing technologies. He has published over a thousand articles on information technology topics and has written, contributed to or been series editor for over 50 books.

Featured Links