How to Prevent Users From Running Certain Programs on Windows 11

Preventing users from running certain programs on your Windows 11 computer can be useful for various reasons. It helps administrators maintain a secure work environment, assists parents in monitoring their children’s app access, and allows users to protect their systems.

Restricting user access to specific apps and programs is easy using the Local Group Policy Editor or the Registry Editor. Let us show you how.

How to Prevent Users From Running Certain Programs via the Group Policy Editor

The Local Group Policy Editor on Windows allows easy system-wide changes on a computer. One option is a policy preventing users from running specific programs or EXE files on Windows.

Note that the Local Group Policy Editor is only available on Windows 11 Professional, Enterprise, and Education editions. If your PC runs Windows Home, use the Registry Editor method mentioned below.

Step 1: Press Windows + R to open the Run dialog box. Type gpedit.msc and hit OK.

Step 2: When the User Account Control (UAC) prompt appears, select Yes.

Step 3: Go to the folder: User Configuration\ Administrative Templates\ System\.

Step 4: Double-click the ‘Don’t run specified Windows applications’ policy in the right pane.

Step 5: Activate the Enabled option and click Show under Options.

Step 6: Add the programs you want to block in the ‘List of disallowed applications’ section. Enter the file name you double-click to launch the app, such as itunes.exe, bittorent.exe, notepad.exe, and so on. Then, click OK.

Step 7: Click Apply, then OK to save changes.

Once you complete the above steps, the specified programs will be blocked on your Windows 11 PC. If you want to restore access to them at any time, repeat the above steps and set the ‘Don’t run specified Windows applications’ policy to Not Configured or Disabled.

How to Prevent Users From Running Certain Programs Using the Registry Editor

If you can’t access the Local Group Policy Editor or want to use a different method, you can edit registry files to prevent users from running certain apps and programs on your Windows 11 PC.

Registry files store critical settings for Windows and its apps. Making incorrect changes to these files can render your PC inoperable. Hence, consider backing up registry files or creating a restore point before making any changes.

Step 1: Click the search icon on the taskbar, type “registry editor”, and select Run as administrator.

Step 2: Select Yes when the User Account Control (UAC) prompt appears.

Step 3: Paste the following path in the address bar at the top and press Enter to quickly navigate to the Explorer key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

Step 4: Right-click on the Explorer key, select DWORD (32-bit) Value, and name it DisallowRun.

Step 5: Double-click the newly created DWORD, enter 1 in the Value data field, and click OK.

Step 6: Right-click the Explorer key and select New > Key. Name it DisallowRun.

Step 7: Right-click the DisallowRun key and create a new String Value named 1.

Step 8: Double-click the newly added string value named 1. In the Value data field, type the name of the program you want to block and click OK. For example, to block iTunes, enter “itunes.exe”.

Step 9: Repeat the previous step to add more string values named 2, 3, 4, etc. Enter the executable names of the programs you want to block in their respective value data fields.

Restart your PC after this, and apps and programs will be blocked for the user account. To unblock an app later, go to the DisallowRun key in the Registry Editor and delete the associated string value.

Stay in Charge

Preventing access to certain programs can be helpful when setting up a Windows 11 PC for someone else or sharing it with others. You can also restrict users from installing apps or software on Windows to protect the system from malware and viruses.