0
win10_professional_6.1.7601
gpedit.msc accessible by default

Are "program.msc" similar to "file.exe" and can GPO recognize msc-program launches? No. You have to find the executable that's associated with the program.msc

Backup whole drives before changing permissions, because you don't want to find out you've hindered your PC without a fallback.

I want to setup certain applications to run using gpedit.msc. The idea that only the applications listed will run and that leaves Administrators having no way to re-open GPO to make any further changes. Is there any way to fallback a PC with GPO setting "Run only specified Windows applications" being enabled or undo what I did?

PROBLEM

  • How would I be able to run the Local Group Policy Editor (gpedit.msc) if "Run only specified Windows applications" is enabled?

SOLUTION

  • Include mmc.exe as one of the application(s) to be allowed to run
    • mmc.exe is associated with gpedit.msc
Community
  • 1
fohrums
  • 540

1 Answers1

1

.msc files are just text files containing XML. The extension .msc is associated with the application mmc.exe (aka the Microsoft Management Console).

When you double-click, or shell-execute an msc file, windows will execute mmc.exe, passing in the .msc file as an argument. for instance, to run secpol.msc, windows will execute the command:

"C:\WINDOWS\SYSTEM32\MMC.EXE" "C:\WINDOWS\SYSTEM32\SECPOL.MSC" /S

So, to your specific query about , Run only specified Windows applications, if you can run mmc.exe, that setting will not hinder you. Other settings may, like not having read access to the .msc file.

Frank Thomas
  • 37,476