Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm at a site where user accounts are limited to running only certain programs (according to file name), through the Windows XP RestrictRun policy mechanism. I realize this is largely useless as a security mechanism, but it is what it is.

Occasionally we'll run into a situation where something under a user account triggers the usual error message: "This operation has been cancelled due to restrictions in effect on this computer", but running the same program under a unrestricted account doesn't give any insight into what program was trying to be launched.

In the interest of troubleshooting this type of scenario, is there a way to get Windows to log program names blocked by a user's RestrictRun policy, or to show the name of the program blocked when displaying the above error message?

share|improve this question
And nothing is showing up in the machines Event Logs? – Izzy Sep 20 '10 at 17:40
Nope, nothing in the Event Logs... – Niten Sep 21 '10 at 13:20
up vote 1 down vote accepted

Use Process Monitor to find what threads/processes are related to the exe you are troubleshooting. Once you know what other EXEs are required to run a given app you can more easily unblock it.

share|improve this answer
Thanks for the response – although a little bit of work this is the best approach I've heard. The telltale sign in procmon is the parent process reading an executable file, followed by RegEnumValue operations under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun. – Niten Oct 14 '10 at 12:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.