Editing: Windows: Windows Server 2003 R2 Disallow Run

Title

<div class="title">This&nbsp;article describes a registry subkey setting in Windows Server 2003 R2 and Windows XP and was originally published as <a href="http://technet.microsoft.com/en-us/library/cc759206(WS.10).aspx">DisallowRun</a>.&nbsp; The article has been updated to correct known issues&nbsp;and has been reproduced here&nbsp;to allow the community to correct any other inaccuracies&nbsp;and provide other enhancements prior to including updates in the official version of this topic.<br />
<br />
</div>
<div class="title"></div>
<h2 class="title"><a name="DisallowRun"></a>DisallowRun </h2>

<div id="mainSection" sizcache="4" sizset="0">
<div id="mainBody" sizcache="4" sizset="0">
<div sizcache="4" sizset="0">
<p>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer </p>
<h3 id="EAAA"><a name="Description"></a>Description</h3>
<p>The DisallowRun subkey contains a list of Windows programs that users cannot run. This list is used only when the value of the <span style="color: #0033cc;"><a href="http://technet.microsoft.com/en-us/library/cc759206(WS.10).aspx">DisallowRun</a></span> entry is&nbsp;1.</p>
<p>This subkey stores the contents of the <strong>Show Contents</strong> box in the <strong>Don't run specified Windows applications</strong> Group Policy. Group Policy adds this subkey and its entries to the registry when you enable the policy. If you disable the policy or set it to <strong>Not configured,</strong> Group Policy deletes this subkey and its entries from the registry.</p>
<p>Each entry in this subkey represents a Windows program, such as Notepad, and contains the name of the executable file for the program, such as Notepad.exe. The numbers that name these entries only represent the order in which the programs are entered. They do not affect the feature.</p>
<p>These entries have the following format. All entries must include the file name extension of the file:</p>
<table>
    <tbody>
        <tr>
            <th>
            <p>Entry name</p>
            </th>
            <th>
            <p>Data type</p>
            </th>
            <th>
            <p>Value</p>
            </th>
        </tr>
        <tr>
            <td>
            <p><em>Item-number</em> </p>
            </td>
            <td>
            <p>REG_SZ</p>
            </td>
            <td>
            <p><em>Name of executable file</em> </p>
            </td>
        </tr>
    </tbody>
</table>
<p>For example, the following entry permits restricted users to use Microsoft Word (Winword.exe):</p>
<table>
    <tbody>
        <tr>
            <th>
            <p>Entry name</p>
            </th>
            <th>
            <p>Data type</p>
            </th>
            <th>
            <p>Value</p>
            </th>
        </tr>
        <tr>
            <td>
            <p>1</p>
            </td>
            <td>
            <p>REG_SZ</p>
            </td>
            <td>
            <p>Winword.exe</p>
            </td>
        </tr>
    </tbody>
</table>
<p><strong>Change method</strong> </p>
<p>To change the value of this entry, use Group Policy. This entry corresponds to the <strong>Don't run specified Windows applications</strong> Group Policy (User Configuration\Administrative Templates\System).</p>
<p><strong>NOTE:</strong> The <span style="color: #0033cc;"><a href="http://technet.microsoft.com/en-us/library/cc759206(WS.10).aspx">DisallowRun</a></span> entry enables the <strong>Don't run specified Windows applications</strong> policy. If the <strong>DisallowRun</strong> entry is not in the registry, or if its value is&nbsp;0, the policy is not enabled, and the system ignores the DisallowRun subkey and its entries.</p>
<p>This entry only prevents users from running programs that are started by the Windows Explorer process. It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt, Cmd.exe, this policy does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer.</p>
<p>The <strong>Run only allowed Windows applications</strong> policy takes precedence over the <strong>Don't run specified Windows applications</strong> policy. If both policies are applied to the same user, the <strong>Run only allowed Windows applications</strong> policy is implemented and the <strong>Don't run specified Windows applications</strong> policy is ignored.</p>
<p></p>
</div>
</div>
</div>

Comment

Products

Resources

Solutions

Updates

Trials

Related Sites

Training

Certifications

Other resources

Support options

More support

Not an IT pro?