How to Completely Disable ‘PowerShell’ (powershell.exe) via Group Policy in Windows 11

PowerShell is an incredibly powerful, object-oriented command-line shell and scripting language built deeply into Windows 11. It allows system administrators to automate almost every aspect of the operating system, from managing Active Directory users to configuring network adapters. However, this immense power makes it a prime target for malware, ransomware, and “living off the land” attacks, where hackers use built-in tools to execute malicious payloads without downloading external executables. In environments where standard users have absolutely no legitimate need to run administrative scripts—such as school computers, retail kiosks, or general clerical workstations—leaving PowerShell accessible is an unnecessary and severe security risk.

This guide explains how to completely disable the execution of PowerShell (powershell.exe) for users via the Group Policy Editor in Windows 11.

Disable powershell.exe via Group Policy

While you can restrict script execution policies, a determined user can often bypass those limits. The most absolute method to prevent PowerShell from launching is to use Group Policy to explicitly block the executable file itself. Note that the Group Policy Editor is only available on Windows 11 Pro, Enterprise, and Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, drill down to the following path:

   User Configuration > Administrative Templates > System

5. In the right-hand pane, locate the policy named Don’t run specified Windows applications.
6. Double-click the policy to open its properties.
7. Select the radio button next to Enabled.
8. Under the “Options” section, click the Show… button next to “List of disallowed applications”.
9. In the “Show Contents” dialogue box, double-click the empty space under the “Value” column and type exactly:

   powershell.exe

10. If you also wish to block the modern PowerShell Core (if installed) or the PowerShell Integrated Scripting Environment (ISE), add new lines for pwsh.exe and powershell_ise.exe.
11. Click OK to close the list, then click Apply and OK on the main policy window.

Verify the Application Block

The policy usually applies immediately. To verify the lockdown, press the Windows key, type powershell, and attempt to launch the application.

Instead of the blue command-line interface appearing, Windows will immediately block the execution and display an error dialogue box stating: “This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.” This ensures that standard users cannot run interactive sessions or trigger PowerShell scripts manually.