Prevent Users From Running Certain Programs

By Mitch Bartlett 16 Comments

If you’re a system administrator, you may have problems with your users running programs like iTunes or BitTorrent in your Microsoft Windows environment? If you want to stop such programs from running, here’s how to use Group Policy or the Registry to prevent users from running certain programs.

Option 1 – Apply Group Policy

1. Hold down the Windows Key and press “R” to bring up the Run dialog box.
2. Type “gpedit.msc“, then press “Enter“. The Group Policy Editor appears.
3. Expand “User Configuration” > “Administrative Templates“, then select “System“.
4. Open the policy “Don’t run specified Windows applications“.
   
5. Set the policy to “Enabled“, then select “Show…”
   
6. Add the programs you would like to prevent the user from running to the List of disallowed applications. Use the name of the application launching file such as “itunes.exe“, “bittorent.exe“, etc.
   

Option 2 – Apply Via Registry

1. Hold down the Windows Key and press “R” to bring up the Run dialog box.
2. Type “regedit“, then press “Enter“. The Registry Editor appears.
3. Expand the following:
   • HKEY_CURRENT_USER
   • SOFTWARE
   • Microsoft
   • Windows
   • CurrentVersion
   • Policies
   • Explorer
4. Right-click a blank area on the right side and add a new “DWORD (32-bit) Value” named “DisallowRun“.
5. Open “DisallowRun” and give it a Value of “1“.
6. Right-click and add a new “Key“, also named “DisallowRun“. The folder is then created.
   
7. Select the “DisallowRun” folder on the left pane.
8. Right-click a blank area on the right side and add a new “DWORD (32-bit) Value” named “1“.
9. Open “1” and give it a Value with the application you would like to block, like “itunes.exe“.
10. Repeat steps 8 and 9 with any additional applications you wish to block, only increase the number used in the “DWORD (32-bit) Value” each time (2, 3, 4 ,5, etc)

So if I wanted to block two applications, “itunes.exe” and “bittorrent.exe“, my Registry Editor would look like this…

From now on the user will get a message “This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.” when he tries to run the programs you added.

I should mention that if the user is smart enough to rename the program file, they will be able to run the program again.

If this tutorial does not meet your needs, you might be able to use Applocker for your needs. Using Applocker allows you to deny access to applications based on publisher, path, or file hash. See more info about Applocker at Microsoft Technet.

You Might Also Like

Filed Under: Windows Tagged With: Windows 10

How to block a specific .exe from running

Replies (4) 

App Restriction allows users to control which installed programs children can access on the computer. If the application you want to block in Windows Live Family Safety is not in the list, you can just type it in the search box in the right part of the page. Here are the detailed steps:

1. On any computer, sign in the parent account to http://fss.live.com

2. Click Edit settings under the name of the child whose settings you want to change, and then click App restrictions .

3. Tick the circle beside Turn on app restrictions.

4. Type the application or program in the Search apps box.

5. Check the box beside the application or program once it appears in the list.

6. Click Save.

Please inform us if you have further questions/concerns, we will gladly help you with it.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

May I ask for the version of Windows Live Family Safety installed in your machine and the specific application you’re trying to block? To verify your current version, login your account in Windows Live Family Safety, click the blue circular button with question mark in the upper right part of the window then click About Family Safety .

Please make sure that you have the latest version ( 15.4.3555.308 ) of Windows Live Family Safety, you can download the newer version from this link .

For now, please include the website of YoYo Games in your child’s allow list. Here are the steps:

1. Login the parent account in http://fss.live.com
2. Under child’s name, click Edit Settings
3. Select Web filtering.
4. Adjust the slider for web filters to Allow list only or to your preferred setting.
5. Click Save.
6. Switch to Web filtering list.
7. Enter website in the box provided then click Allow.
8. Click Save.

Let us know if the child is still unable to run the program.

Administrator has blocked you from running this app. SISetup.exe

I am trying to install an HP LaserJet P1102w printer to my computer. When I try to run the setup I get a message that the administrator has blocked it, but I am the administrator. I don’t understand what is going on or how I can change it. I need to get the printer working ASAP. any help is appreciated.

Full message I get is: This app has been blocked for your protection. An administrator has blocked you from running this app. For more information, contact the administrator. SISetup.exe Publisher: Unknown. File Orgin: CD/DVD drive Program Location: «D:\SISetup.exe»

Replies (12) 

* Please try a lower page number.

* Please enter only numbers.

* Please try a lower page number.

* Please enter only numbers.

Try these steps below:

Right click on Windows logo and open Command Prompt (Admin).

Step 2:
Now type “net user administrator /active:yes” and press enter. You will see the successful message.

Step 3:
Now Sign Out. Then find the “Administrator” account on the bottom left.

Step 4:
Now click and sign in on Administrator account. It’s takes time to setting up apps.

Step 5:
Now find your Software or .exe that you want to install.

Step 6:
Voila! The error is gone. The software or .exe also available on your own Administrator account too, so don’t worry about it.

Step 7:
After installing your software, now sign out from Administrator account and sign-in again to your Original Account.

Step 8:
That’s it, now check out the software or app that was installed on “hidden Administrator” account.

Step 9:
Now it’s time to Disable Hidden Administrator Account. Open Command prompt (Admin) and type below command,

net user administrator /active:no

net user administrator active no

Please let me know if that helps

109 people found this reply helpful

Was this reply helpful?

Sorry this didn’t help.

Great! Thanks for your feedback.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this reply?

Thanks for your feedback.

Hi Jenna. I’m Greg, an installation specialist and 8 year Windows MVP, here to help you.

Right click Start button to open Run box, copy and paste in netplwiz, press Enter.

Highlight your account, then click Properties, then Group Membership tab. click on Administrator, then Apply, OK, restart PC.

What is the antivirus? I’d uninstall it and use built-in Defender to troubleshoot this.

If you type Defender Security Center in Start Search, open it, then choose Virus and Threat Protection Settings, is Controlled Folder Access turned On?

Also in Security Center under App and Browser Control, is Check Apps and Files set to Block? Change to Warn.

This may have been caused by Windows Updates. Check which Updates were installed right before the problem began, and if necessary uninstall them from Settings > Update & Security > Windows Update > Installed Update History.

You can also try to roll back using System Restore to a point before this began: http://home.bt.com/tech-gadgets/computing/how-t.

Then if the Update installs and causes the same problem again uninstall or roll it back again, then immediately hide it using the Hide Updates tool from Method Two here: https://www.askvg.com/fixing-windows-10-automat.

If necessary try taking ownership of any folders that won’t allow access: https://www.askvg.com/add-take-ownership-option.

If nothing helps try creating a new Local Admin Account to sign into to see if it works: http://www.howtogeek.com/226540/how-to-create-a.

If you can’t get the rights to do this then use whichever method works here to enable the hidden Built-in Administrator to be used only in emergencies: https://www.tenforums.com/tutorials/2969-enable.

Sign into Hidden Admin account, set up new Local Admin Account, sign into it, move your files over, set it up, hide the Hidden Admin Account, when ready delete the old account in Settings > Accounts > Family and Other Users.

I hope this helps. Feel free to ask back any questions and let us know how it goes. I will keep working with you until it’s resolved.

________________________________________________________
Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.

Windows MVP 2010-20

Over 100,000 helped in forums in 10 years
I do not quit for those who are polite and cooperative.
I will walk you through any steps and will not let you fail.

How to block users from installing or running programs in Windows 10

You can if you wish, restrict users from installing or running programs in Windows 10/8/7 as well as Windows Vista/XP/2000 & Windows Server family. You can do so by using certain Group Policy settings to control the behavior of the Windows Installer, prevent certain programs from running or restrict via the Registry Editor.

You may see an error message:

The installation is forbidden by system policy, Contact your system administrator

The Windows Installer, msiexec.exe, previously known as Microsoft Installer, is an engine for the installation, maintenance, and removal of software on modern Microsoft Windows systems.

In this post, we will see how to block installation of software in Windows 10/8/7.

Disable or restrict the use of Windows Installer

Type gpedit.msc in start search and hit Enter to open the Group Policy Editor. Navigate to Computer Configurations > Administrative Templates > Windows Components > Windows Installer. In the RHS pane double-click on Disable Windows Installer. Configure the option as required.

This setting can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. If you enable this setting, you can use the options in the Disable Windows Installer box to establish an installation setting.

The “Never” option indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional, and Windows Vista when the policy is not configured.

The “For non-managed apps only” option permits users to install only those programs that a system administrator assigns (offers on the desktop) or publishes (adds them to Add or Remove Programs). This is the default behavior of Windows Installer on Windows Server family when the policy is not configured.

The “Always” option indicates that Windows Installer is disabled.

This setting affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs.

Always install with elevated privileges

In the Group Policy Editor, navigate to User Configuration > Administrative Templates > Windows Components. Scroll down and click Windows Installer and configure it to Always install with elevated privileges.

This setting directs Windows Installer to use system permissions when it installs any program on the system.

This setting extends elevated privileges to all programs. These privileges are usually reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or made available in Add or Remove Programs in Control Panel. This setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.

If you disable this setting or do not configure it, the system applies the current user’s permissions when it installs programs that a system administrator does not distribute or offer.

This setting appears both in the Computer Configuration and User Configuration folders. To make this setting effective, you must enable the setting in both folders.

Skilled users can take advantage of the permissions this setting grants to change their privileges and gain permanent access to restricted files and folders. Note that the User Configuration version of this setting is not guaranteed to be secure.

TIP: Use AppLocker in Windows 10 to prevent users from installing or running applications.

Don’t run specified Windows applications

In the Group Policy Editor, navigate to User Configuration > Administrative Templates > System

Here in RHS pane, double click Don’t run specified Windows applications and in the new window which opens select Enabled. Now Under Options click Show. In the new windows which opens enter the path of the application you wish to disallow; in this case: msiexec.exe.

This will disallow Windows Installer which is located in C:\Windows\System32\ folder from running.

This setting prevents Windows from running the programs you specify in this setting. If you enable this setting, users cannot run programs that you add to the list of disallowed applications.

This setting only prevents users from running programs that are started by the Windows Explorer process. It does not prevent users from running programs, such as Task Manager, that are started by the system process or by other processes. Also, if you permit users to gain access to the command prompt, cmd .exe, this setting does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer. Note: To create a list of disallowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., msiexec.exe).

Restrict Programs from being installed via Registry Editor

Open Registry Editor and navigate to the following key:

Create String value with any name, like 1, and set its value to the program’s EXE file.