How to Prevent Users From Running Certain Programs on Windows 11

If you share your computer with others — whether it’s at home, in an office, or in a classroom — you might want to restrict access to specific applications. For instance, maybe you want to block access to games, admin tools, or apps that could change system settings.

Windows 11 provides multiple ways to do this. You can use Group Policy Editor, Registry Editor, or even third-party tools to stop specific users (or all users) from running certain programs.

In this guide, we’ll show you step-by-step how to prevent users from running certain programs on Windows 11.

1. Why Restrict Certain Programs?

Blocking specific apps can help you:

Prevent unauthorized changes to system settings.
Reduce distractions by blocking games or social media apps.
Protect kids or employees from accessing unsafe programs.
Improve performance by limiting unnecessary background apps.

Windows gives administrators fine-grained control over what users can run — without needing additional software.

2. Method 1: Block Programs Using Local Group Policy Editor

If you’re using Windows 11 Pro or Enterprise, the easiest way to restrict programs is via the Local Group Policy Editor.

Press Windows + R, type gpedit.msc, and press Enter.
Navigate to the following path: User Configuration → Administrative Templates → System
On the right pane, double-click Don’t run specified Windows applications.
Select Enabled.
Click the Show button under the Options section.
In the pop-up window, add the names of the executables you want to block. For example: notepad.exe cmd.exe regedit.exe msedge.exe
Click OK → Apply → OK.

How It Works:

Once applied, if a user tries to open one of the blocked programs, they’ll see an error message:

“This operation has been canceled due to restrictions in effect on this computer.”

To undo it, simply go back to the same policy and select Not Configured.

Note: This setting applies per user. If you want to apply it system-wide, configure the same policy for each user or enforce it through Active Directory (for domain-managed systems).

3. Method 2: Prevent Users from Running Apps via Registry Editor

If you’re using Windows 11 Home, you won’t have access to Group Policy Editor — but you can achieve the same result using the Registry Editor.

Important: Back up your registry before making any changes to avoid accidental misconfiguration.

Press Windows + R, type regedit, and press Enter.
Navigate to this path: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies
Right-click Policies → choose New → Key → name it Explorer.
Select Explorer, then right-click on the right side and choose New → DWORD (32-bit) Value.
Name it: DisallowRun
Double-click DisallowRun and set its value to 1.
Next, right-click Explorer again → New → Key → name it DisallowRun.
Select the new DisallowRun key.
In the right pane, right-click → New → String Value.
Name it 1, then double-click it and enter the name of the program you want to block (e.g., chrome.exe).

To block multiple apps, create additional string values (2, 3, etc.) and list each program’s executable name.

Example:

1 → chrome.exe  
2 → notepad.exe  
3 → regedit.exe

Close Registry Editor and restart your PC.

Now, when a user tries to open any of those programs, Windows will block them immediately.

To Revert:

Simply delete the DisallowRun key or set the DisallowRun value back to 0.

4. Method 3: Use AppLocker (Windows 11 Pro & Enterprise)

For more advanced control — especially in business or multi-user environments — AppLocker provides robust application restriction policies.

Press Windows + R, type secpol.msc, and press Enter.
Navigate to: Application Control Policies → AppLocker → Executable Rules
Right-click Executable Rules → choose Create New Rule.
Click Next on the first page.
Under Permissions, choose Deny.
Under User or Group, select the user or group you want to block.
Click Next, then choose Publisher, Path, or File hash to identify the app.
- Use Path for simplicity and specify the program’s executable (e.g., C:\Program Files\Google\Chrome\Application\chrome.exe).
Click Next → Create.

To enforce AppLocker rules, go to Application Identity in the same console, right-click it, and choose Start.

AppLocker provides enterprise-level control, allowing you to define both whitelisting and blacklisting rules for users and groups.

5. Method 4: Use Third-Party App Blockers

If you prefer a more user-friendly interface or you’re on Windows 11 Home, third-party utilities can make blocking apps even easier.

Recommended Tools:

Simple Run Blocker – Free, portable, and lets you drag-and-drop apps to block instantly.
AskAdmin – Allows password-protected app blocking with per-user configuration.
WinGuard Pro – Lets you password-lock or restrict specific apps, folders, and settings.

Tip: These tools are useful for parents or small offices where Group Policy access is unavailable.

6. Method 5: Create a Standard User Account

If you want to prevent non-admin users from running or installing certain apps altogether, the easiest approach is to limit permissions using standard accounts.

Press Windows + I → Accounts → Other users.
Click Add account and create a new user (without admin rights).
Log into the new account.

Now, only administrators can install or modify applications, and you can apply Group Policy or Registry restrictions per user.

7. Bonus: Use Family Safety for Child Accounts

If you want to control app access for children, Microsoft’s Family Safety offers a web-based dashboard.

Go to https://account.microsoft.com/family.
Sign in with your Microsoft account.
Add your child’s account under Family Members.
Under your child’s profile, go to Content Filters → Apps and Games.
Block specific apps or set an age rating limit.

This method syncs across all Windows devices and even Xbox accounts.

8. Troubleshooting Tips

If your restrictions don’t seem to work:

Restart your PC after applying Group Policy or Registry changes.
Verify the executable name (it must match the exact file name, like appname.exe).
If using AppLocker, ensure Application Identity service is running.
For local restrictions, confirm the user account is non-administrative.

Wrapping Up

If you want to prevent users from running certain programs on Windows 11, there are multiple effective ways to do it:

Use Group Policy Editor or Registry Editor for simple blocking.
Use AppLocker for advanced control.
Use third-party tools for convenience, especially on Windows 11 Home.

Whether you’re an IT admin, a parent, or simply securing your PC, these methods let you manage who can run what — giving you more control over your Windows 11 environment.