0

I'm trying to set up a PC with apps restriction using local GPO. The method I chose is to use "Run only specified Windows applications." My question is: What is the executable used for Batch Files in Windows? This is because I want to allow a bat-file to the to run when this gpo is enabled. It'll be even better to specify which batch files are allowed to run.

TABLE EXPLANATION

  • Group Policy Object (gpedit.msc)
    • User configuration -> Administrative Templates -> System -> Run only specified Windows applications
    • how to include file.bat along with other executable to be allowed to run? In other words what is the file.exe related to running a bat file?
3
  • I think you mean cmd.exe...
    – aschipfl
    Aug 9, 2019 at 8:39
  • It can't be, because that's in the "Specified" list in the local gpo and batch files are still not allowed to be executed.
    – fohrums
    Aug 9, 2019 at 11:10
  • @fohrums - The documentation I am reading indicates it is indeed cmd.exe. Which begs the question, what is the exact error, you have received.
    – Ramhound
    Aug 10, 2019 at 2:33

1 Answer 1

0

What is the executable used for Batch Files in Windows?

It's actually COMMAND.COM or cmd.exe.

When a batch file is run, the shell program (usually COMMAND.COM or cmd.exe) reads the file and executes its commands, normally line-by-line.

It might be helpful to know that specifically not allowing either command.com or cmd.exe wouldn't be a good idea. Windows being unable to launch either COMMAND.COM or cmd.exe would result in undefined behavior.

Batch file

This is because I want to allow a bat-file to the to run when this GPO is enabled. It'll be even better to specify which batch files are allowed to run. It can't be (cmd.exe), because that's in the "Specified" list in the local GPO and batch files are still not allowed to be executed. How do I include file.bat along with other executable to be allowed to run?

If you have allowed cmd.exe to be executed, and the .bat file is still blocked, then you have likely prevented a user's access to the command prompt.

Also, if users have access to the command prompt, Cmd.exe, this setting does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer.

The solution to your problem is using something other than a batch script. If you were to use PowerShell, there is an executable you can allow for that,

Source: Configure and allow Windows to Run Specified Programs only

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .