TechTips - How to Limit What Programs a User Can Open in Windows 7

A lot of people have been asking me how to limit what their kids or employees can open when using Windows 7. There are several ways to limit the programs that a user can open in Windows 7, but for the purpose of this article I will go over a very easy way to limit the users via Group Policy. It's a pretty easy process that allows you to specify what programs can be opened and when a user tries to open a program not on the list they will get an error message telling them they aren't allowed to open the program. In this guide I will explain how to setup the policy and what some of the pitfalls to the policy might be.

So first before you edit your Group Policy you should always make sure that you have a backup of your PC just in case you break your computer editing the group policy. This is highly unlikely but it could happen if you go in there and just start making changes left and right. So if you want to backup your system I suggest using one of these two free programs for a good backup of your PC.

Drive Image XML

Easeus Todo Backup

Once you have a good backup of your PC create and stored safely (external hard drive or CD/DVD) I would also suggest backing up your system32 folder simply copy the C:\windows\System32 to the same location you just stored your backup image of your PC.

Now you should be ready to edit the group policy and block users from opening programs that you don't want them to. Here are the steps:

Click Start

Click the Search Bar

Type GPEDIT.msc

Double Click Administrative Templates (under User Configuration)

Double Click System

Double Click the option "Run only specified Windows applications" (in right hand window pane)

Click Enabled Radio Button

Click Show Button

Click Add Button

Enter each executable name for whatever applications you want to allow (hit enter after each entry)

Once you have added all of the executables you want to be able to run and you have applied the settings you will want to reboot the system. Now when a user goes to open a program that isn't listed in this policy they will get an error saying "The operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator."

Now the users can only open programs that you have designated. Now if a user has administrative access to the PC and are savvy enough to find this Group Policy they can disable it and access all programs again. For most users though they won't have admin access and probably aren't that well versed in PC administration to even begin to know where to look to change this access setting. So you should be able to block your users via this Group Policy method.