Policy
Run only specified Windows applications
Windows 11 25H2
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows2000, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2003, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista, WindowsXP
Limits the Windows programs that users have permission to run on the computer. If you enable this policy setting, users can only run programs that you add to the list of allowed applications. If you disable this policy setting or do not configure it, users can run all applications. This policy setting only prevents users from running programs that are started by the File Explorer process. It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt (Cmd.exe), this policy setting does not prevent them from starting programs in the command window even though they would be prevented from doing so using File Explorer. Note: Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. Note: To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe).
Registry values
How enabled and disabled states update the registry.
| Registry location | Type | Enabled value | Disabled value |
|---|---|---|---|
| HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun | REG_DWORD | 1 | 0 |
Policy elements
Inputs and configuration options exposed by this policy.
| Element | Type | Registry mapping | Constraints & behavior |
|---|---|---|---|
List of allowed applications ID RestrictApps_RestrictAppsList | list | HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\RestrictRun Type REG_MULTI_SZ | List: additive |
Other policies in this category
Explore related policies at the same level.
- ComputerActivate Shutdown Event Tracker System State Data featureWindows Server 2003 only
- ComputerAllow Distributed Link Tracking clients to use domain resourcesWindows Server 2003, Windows XP, and Windows 2000 only
- UserCentury interpretation for Year 2000At least Windows 2000
- ComputerConfigure the behavior of the sudo commandAt least Windows 11
- UserCustom User InterfaceAt least Windows 2000
- ComputerDisplay highly detailed status messagesAt least Windows 2000
- ComputerDisplay Shutdown Event TrackerAt least Windows Server 2003 operating systems or Windows XP Professional
- ComputerDo not automatically encrypt files moved to encrypted foldersAt least Windows 2000
- ComputerDo not display Manage Your Server page at logonAt least Windows Server 2003
- UserDo not display the Getting Started welcome screen at logonWindows 2000 only
- ComputerDo not turn off system power after a Windows system shutdown has occurred.At least Windows Server 2003 operating systems or Windows XP Professional with SP1
- UserDon't run specified Windows applicationsAt least Windows 2000