Need Help Please to Restrict Users from Running Specific Applications

[richrad_mills]

Hi All,

 

Can someone please help me, I would like to restrict users from running specific EXE (executable) applications (for an example calculator calc.exe or notepad.exe). I tried doing it through Regedit using the following keys on Windows XP:

 

""Open your registry and find the key [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion \Policies\Explorer]

 

Create a new DWORD value and name it "DisallowRun" set the value to "1" to enable application restrictions or "0" to allow all applications to run.

 

Then create a new sub-key called [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun] and define the applications the are to be restricted. Creating a new string value for each application, named as consecutive numbers, and setting the value to the filename to be restricted (e.g. "notepad.exe").""

 

However when I try to create a New Sub Key called "DisallowRun" it sends back an error message telling me it cannot rename the Sub Key (it doesn't give me no more info in the error) but however in the same location I can create another new sub-key and call it anything I like but it just does not let me rename the folder to "DisallowRun". (I can create DWORD value and name it "DisallowRun" key but it does not like me creating a New Subkey and calling it "DisallowRun").

 

1. Is there something that I am doing wrong in the regedit?
   
2. Are there any other free programs that I can use to block certain applications?
   
3. Are there any paid programs that I can try (free trial before I purchase it) excluding LANSchool, AB Tutor and etc?
   
4. Are there any other ways I can block certain Applications?
   

 

Can someone please help me, thanks in advance.

 

Kind Regards,

Richard

Edited February 10, 2011 by richrad_mills

[strawberry]

google software restriction policy.

[richrad_mills]

Thanks for the reply strawberry, I will look into this.

 

Anymore advice is welcome.

[steve]

Software restriction policies via a GPO are the best way to go to permanently block an exe

 

Alternatively do you have anything like AB tutor Control? You could get a single license for that and block stuff on all your clients plus lots of other benefits too.

[bio]

Indeed software restriction policies. I would use the HASH version so users can't start notepad.exe if its renamed to (for example) asdasd.exe.

 

bio..

[Azhibberd]

Another vote for the software restriction policy... GPO > User > windows > Security > Software restriction policies - We by default have it set to disallowed, Then have additional rules added for what we want to run... That way only allowed applications are allowed.. And you can simply choose not to add those to your list... Although just remember if you have multiple dc's the netlogon area will have to be allowed for each dc for logon scripts

[richrad_mills]

Thanks steve, bio and Azhibberd for the advice. I will use GP to block these programs.

 

Kind regards,

Richard