RestrictRun

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Data type	Range	Default value
REG_DWORD	0 | 1	0

Description

Limits the Windows programs that users can run on the computer. When the value of this entry is 1, users can run only those programs that entries in the RestrictRun subkey represent.

This entry stores the setting of the Run only allowed Windows applications Group Policy. Group Policy adds this entry to the registry with a value of 1 when you enable the policy. If you disable the policy or set it to Not configured, Group Policy deletes this entry from the registry, and the system behaves as though the value is 0.

Value	Meaning
0 (or not in the registry)	Users can run all installed Windows programs.
1	Users can run only those programs that entries in the RestrictRun subkey represent.

Change method

To change the value of this entry, use Group Policy. This entry corresponds to the Run only allowed Windows applications Group Policy (User Configuration\Administrative Templates\System).

Note

There is also a RestrictRun subkey, which stores the names of Windows programs that restricted users can still run. If the subkey does not appear in the registry or does not contain any entries, then users cannot run any programs started by Windows Explorer.

This entry prevents users from running only programs that Windows Explorer starts. It does not prevent users from running programs, such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt, Cmd.exe, this policy does not prevent them from starting programs in the command window that they cannot start using Windows Explorer.

The Run only allowed Windows applications policy takes precedence over the Don't run specified Windows applications policy. If both policies are applied to the same user, the Run only allowed Windows applications policy is implemented and the Don't run specified Windows applications policy is ignored.

Tip

To determine which processes started a program, see Tlist.exe on the Windows 2000 Resource Kit companion CD.

For detailed information about particular Group Policy settings, see the Windows 2000 Resource Kit Group Policy Reference.

For general information about Group Policy, see Windows 2000 Server Help or Windows 2000 Professional Help.

To see a table associating policies with their corresponding registry entries, see the Group Policy Registry Table .

Caution

If you are the person who applies Group Policy, do not apply this policy to yourself. If this policy is applied too broadly, it can prevent administrators from running Group Policy or the registry editors. As a result, once applied, you can change this policy only by reinstalling Windows 2000.

Related Entries

DisallowRun

RestrictRun subkey