A common question is how can I restrict which programs can be run on Windows? With Group Policy (or Local Group Policy on a standalone machine) you can do this, though it takes a bit of work. Here's how it works:
In a domain, open the GPO linked to the container holding the user accounts you want to restrict (or on a standalone computer use Start --> Run --> type gpedit.msc to open the Local GPO).
Expand User Configuration \ Administrative Templates \ System Open the policy named Run Only Allowed Windows Applications Enable the policy and click Show
Click Add and type the executable name for each program you want to *allow* the user to run
Once the policy is applied, the user will only be able to run the programs you specified and no others. Unless you have allowed them access to the command prompt cmd however, in which case they can run pretty much anything if they can find it.
Cheers, Mitch Tulloch, MVP
