At my workplace we whitelist executables using a "Run only specified Windows applications" group policy applied to the domain. At certain times we need to whitelist large number of executables at a time (say with printers or scanners). Through the GUI you can only add one executable at a time, is there an alternative way to add multiple executables in at once? I looked at powershell group policy commands and that looked like a dead end.

Any help is appreciated.

  • Have you had a look through the policy folder - you may get lucky and find they're in plain text somewhere – Dan Feb 6 '15 at 21:20

Well, the old rule of thumb is every GPO is typically a registry setting somewhere. You might want to take a look here:


Start with the Set-GPRegistryValue section. Looks like this would be the primary way to modify GPOs via PowerShell. You could start with a GPO that has some of these software restrictions and then use the Get-GPRegistryValue cmdlets to the basic setup for a software restriction and then just write a script that adds more to it when needed. I've never used these specific cmdlets but I've used the GPO module many times to do many things and it is fairly decent. I may look into it further some time and let you know.

Keep in mind that GPOs are stored in two places, on SYSVOL and there is an AD object. There is versioning in place and it is not recommend that you modify configuration files directly (obviously uploading scripts and msi files for software installs is a different matter).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.