How to Restrict a User to Only Run Specific Allowed Applications in Windows 11

If you share a Windows 11 PC with children, employees, or guests, giving them full access to all installed software can be a security and productivity nightmare. You might want to lock down an account so that the user can only open a web browser and a word processor, effectively blocking them from launching games, system tools, or unwanted applications.

While third-party parental control software exists, Windows 11 Professional and Enterprise editions have a built-in, highly secure method for creating a strict software whitelist. This is done using the Local Group Policy Editor.

Step 1: Access the Local Group Policy Editor

Note: This feature is not available on Windows 11 Home edition without a registry workaround. You must be using Pro, Enterprise, or Education.

1. Log in to Windows 11 using an account with Administrator privileges.
2. Press the Windows Key + R to open the Run dialog box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.

Step 2: Navigate to the Restriction Policy

Inside the editor, you need to find the specific policy that controls application execution.

1. In the left-hand navigation pane, look under the User Configuration section.
2. Expand the folders in this exact order: Administrative Templates > System.
3. Click on the System folder so its contents display in the right-hand window.
4. In the right-hand window, scroll down until you find a policy named Run only specified Windows applications.
5. Double-click on Run only specified Windows applications to open its configuration window.

Step 3: Create Your Application Whitelist

Now you will define exactly which programs are allowed to run.

1. Change the radio button at the top left of the window from “Not Configured” to Enabled.
2. Under the “Options” section, click the Show… button next to “List of allowed applications”.
3. A new “Show Contents” dialog box will appear. Here, you must type the exact filename of the executable (including the .exe extension) for every program you want to permit.
   • For example, to allow Google Chrome, type: chrome.exe
   • To allow Microsoft Word, click the next line and type: winword.exe
   • To allow the standard Windows Calculator, type: calc.exe
4. CRUCIAL STEP: You must always add explorer.exe to this list. If you forget to allow explorer.exe, the user will be unable to see the taskbar, desktop, or File Explorer, rendering the computer nearly unusable.
5. Once your list is complete, click OK to close the list, and then click OK again to apply the policy.

Testing the Restrictions

The changes apply immediately. If the restricted user attempts to open an application that is not on your explicit whitelist—such as launching the Command Prompt (cmd.exe) or a video game—Windows will immediately block the launch and display an error message stating: “This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.”

To undo this restriction later, simply return to the Group Policy Editor, double-click the Run only specified Windows applications policy, and change the setting back to Not Configured.