Tech Tips Home
The Best Tech Tips And Daily Deals
Newsletter On The Internet!

WorldStart Tech Tip And Store Search
Email: Password: Login Remember Me

Like what you see here? Subscribe to the Tech Tips newsletter!   Email: Subscribe

Controlling User Access to Programs in Windows 7

Thursday, December 30th, 2010 by | Filed Under: File & Disk Management, Uncategorized

Imagine this – you have multiple users in your family sharing the same computer and operating system. You don’t want other users of the shared computer to run each and every program that’s installed in Windows 7. Some of the programs which you have installed require knowledge, and you don’t want your kids and other shared members to tinker with the application settings or change the configurations.

The ability to run selected programs for selected users can be achieved in two ways:

1. Choose The User account during Installation of the Application.

2. Tweak the Group Policy Editor and manually Add the Programs which shared users can run

We will discuss both of the above methods in full detail.

Important Note: First make sure that only you have the administrator account and the shared users have a limited user account in Windows7. If one or more of the other user accounts have administrator privileges, he/she might override the settings and configurations which you will create below.

Choose The User account during Installation of the Application

Windows 7 comes with a very useful User Account Control feature which allows you to define which user accounts should have the permission to run a program, when the program is being installed. When you are installing a new application, you will see the following two options:

Install this application for anyone who uses this computer (all users).

Install this application only for me.

If you don’t want other users of your shared computer to use the program you are installing, simply select the radio button Only For me.
That’s it, now only you will be able to use, customize or remove that specific program in Windows7; other shared users will see the following prompt, when they try to run the program from their user accounts:

You don’t have the required permissions to run or remove this Application. Please contact the system administrator

Tweak the Group Policy Editor and manually add the programs which shared users can run.

Note: This section of this tip only applies to Professional editions of Windows. That includes Windows XP Pro, Windows Vista Pro, and Windows 7 Pro. This will not work on Home editions.

If you have already installed all the applications in your computer and don’t want to reinstall them with necessary permissions, you can manually add the programs from the Windows7 Group Policy Editor.

Carefully follow the steps outlined below:

1. Click Windows 7 start menu and type gpedit.msc in the search box. When the search results appear, click the gpedit icon.

2. Clicking the gpedit icon will open Windows Group Policy Editor window.

3. In the left pane, navigate to User Configuration > Administrative Templates folder. You have to first click the small arrow placed next to the User configuration folder and then repeat the same thing for the Administrative Templates subfolder

4. When you have reached the Administrative Templates subfolder, click the System subfolder on the left pane.

5. Now switch to the right pane and find the setting which says Run Only Specified Windows Applications.

The current setting for this key should be Not Configured, as shown below:

6. Right click that key and choose Edit

7. This will open a new window where you can define the programs and applications which will have the necessary user permissions.

When the window opens; first select the Enabled button at the top, as shown below:

8. Scroll down and hit the Show button next to List of allowed applications, this will open a small pop up window as shown below:

9. Now you have to type the name of the program which you want other users of the shared computer to be able to use. Type the name of all the common applications e.g. Word.exe, Excel.exe, Firefox.exe one by one in each of the following rows.

When you are done adding all the programs, hit the OK button. Next, hit the Apply button and close the Group Policy Editor window

That’s it, you have just defined the list of all the programs which other users of the same computer may use. Any program that’s not listed in the list of allowed applications will not have the necessary permissions and thus other users won’t be able to run it or entirely remove it from your computer.

Should you want to grant all users the ability to use all the programs installed on your computer, simply navigate to the above mentioned Group policy setting and disable the entire feature.

Have you customized your Windows7 program settings yet?

~Amit Banerjee

Tags: , , ,

6 Responses to “Controlling User Access to Programs in Windows 7”

  1. Junaid says:


    i used above method to restrict the computer programs but i think i did mistake, i cannot change the said settings again as it shows the restriction from administrator since i only add only few programs, i am in trouble now, i want my computer to work as normal, i tried finding on internet,
    help me out pls. i dont want to reinstall OS on my computer .
    thank you

  2. Shaik says:

    Just restore your windows to earlier stage.
    Restart windows
    press f8
    repair your computer
    and than follow the steps to restore your windows to earlier stage


  3. Marvill says:

    I followed your instructions but now I can’t access no programs on my computer it has completely shut me out .HELP!!!

  4. dwsmith says:

    Rename a copy of ‘cmd.exe’ to something permitted e.g. ‘chrome.exe’
    Also rename a copy of ‘mmc.exe’
    Use the now-functioning command-line to launch the management console
    From the management console, add the Group Policy snap-in
    Fix your careless mistake

  5. hastepha says:


    I, like others, have followed the instructions above and have locked myself out of all programs *except* the ones added.

    Here’s how to solve the problem:

    1) Make a copy of cmd.exe and save it as one of the allowed programs (chrome.exe) make sure this is saved in the same folder as cmd.exe itself

    2) Run the copy-version of cmd and type mmc, this will launch the Management Console. (Note, you *might* need to run cmd in as administrator, if so, right click on the copy-version of cmd and select “Run as Administrator”)

    3) In the Management Console, go to File, Add/Remove Snap-in, then select Group Policy Object and click “Add”. A new window will open, just click “Finish”, and then click “OK” on the original window.

    NOTE: IF you don’t see Group Policy Object, close the Management Console and copy and paste the following into the command prompt, you WILL need to be running the command prompt in Admin mode to do this.

    REG add “HKCU\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}” /v Restrict_Run /t REG_DWORD /d 0 /f

    Now you should see the group policy object in the list of snap-ins

    4) You can then access the Group Policy Editor just as you did before, simply go back and follow the instructions above, but change the “Run only specified Windows Applications” back to “Not Configured”

  6. Bart says:

    Click start button, type run into the search field at the bottom of the popup press enter. In the new window enter %systemroot%\system32\GroupPolicy\User delete registry.pol

    Do the same in %systemroot%\system32\GroupPolicy\Machine delete registry.pol if you see it, my PC didn’t have it.

    Reboot your system.

    Log in under admin account, create a new user with admin privileges, reboot and log back in using the new admin account.

    Click start button, type run into the search field at the bottom of the popup press enter. Type gpedit.msc, press enter.

    Go to Local Computer Policy -> User Configuration -> Administrative Templates -> (double click) system -> (look in panel on the right and double click) run only specified windows applications. Click the radio button next to Disabled.

Leave a Reply

Like these tips? Get them for FREE in your email!

WorldStart's Tech Tips Newsletter

  • Tech Tips Daily - Become a tech pro! Get the very best tech and computer help sent directly to your email every weekday!

  • Tech Tips Weekly - If you don't want our Tech Tips newsletter every day, then sign up for this weekly newsletter to get the best information of the week. Sent on Fridays.

Other Newsletters

  • WorldStart's Daily Deals - Every week, we send out great deals in our Daily Deals newsletter. Many of these deals are exclusively for our Daily Deals newsletter subscribers and can't be found with our regular specials.

  • Just For Grins - Each issue includes a couple clean jokes, some funny quotes, and a hilarious reader's story. Newsletter is sent five days a week.

Enter Email Address:


Your e-mail address is safe with us!
We only use it to send you the newsletters you request. It is NEVER disclosed to a third party for any reason, ever! Plus, if you decided you don't like our newsletters (don't worry, you'll love them), unsubscribing is fast and easy.

Free Newsletter Signup

Tech Tips Daily

Become a tech pro! Get the very best tech and computer help sent directly to your email every weekday!

Tech Tips Weekly

The week's best in tech and computer help. Get your issue sent to your email every Friday!

WorldStart's Daily Deals

The very best deals on the Internet! Get a new set of incredible sales every day of the week!

Just For Grins

Clean jokes, funny quotes, and hilarious comics. Sent 5 times a week straight to your email.


Love Worldstart? Refer A Friend!

WorldStart's Premium Membership

Tip Archive