0

I'm trying to set up a PC with apps restriction using local GPO. The method I chose is to use "Run only specified Windows applications." My question is: What is the executable used for Batch Files in Windows? This is because I want to allow a bat-file to the to run when this gpo is enabled. It'll be even better to specify which batch files are allowed to run.

TABLE EXPLANATION

  • Group Policy Object (gpedit.msc)
    • User configuration -> Administrative Templates -> System -> Run only specified Windows applications
    • how to include file.bat along with other executable to be allowed to run? In other words what is the file.exe related to running a bat file?
  • I think you mean cmd.exe... – aschipfl Aug 9 '19 at 8:39
  • It can't be, because that's in the "Specified" list in the local gpo and batch files are still not allowed to be executed. – fohrums Aug 9 '19 at 11:10
  • @fohrums - The documentation I am reading indicates it is indeed cmd.exe. Which begs the question, what is the exact error, you have received. – Ramhound Aug 10 '19 at 2:33
0

What is the executable used for Batch Files in Windows?

It's actually COMMAND.COM or cmd.exe.

When a batch file is run, the shell program (usually COMMAND.COM or cmd.exe) reads the file and executes its commands, normally line-by-line.

It might be helpful to know that specifically not allowing either command.com or cmd.exe wouldn't be a good idea. Windows being unable to launch either COMMAND.COM or cmd.exe would result in undefined behavior.

Batch file

This is because I want to allow a bat-file to the to run when this GPO is enabled. It'll be even better to specify which batch files are allowed to run. It can't be (cmd.exe), because that's in the "Specified" list in the local GPO and batch files are still not allowed to be executed. How do I include file.bat along with other executable to be allowed to run?

If you have allowed cmd.exe to be executed, and the .bat file is still blocked, then you have likely prevented a user's access to the command prompt.

Also, if users have access to the command prompt, Cmd.exe, this setting does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer.

The solution to your problem is using something other than a batch script. If you were to use PowerShell, there is an executable you can allow for that,

Source: Configure and allow Windows to Run Specified Programs only

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.