Give access to specific apps for Local User

I'm the admin on my PC, but have my kids' accounts as Local accounts on the same machine:



When my kids log in, I'd like them to be able to launch and access only specific apps that I have installed and working for my account (e.g., IrfanView, Minecraft, Affinity Designer, MS Store, etc.). When they're logged in, these apps show in their start menu, but clicking them does nothing.

Without making them admins, how can I grant access to only specific apps?

Is this a Pro or Home version of Windows 10? I would create a user group for the kids and assign policies to that group. You can use Jumpcloud if Pro, Home you would be best to upgrade to Pro.

This is how you can create a GPO. https://www.technipages.com/prevent-users-from-running-certain-programs

Using Jumpcloud will allow you to lock down the computer better.

dalchina said:

However you say the Store doesn't respond...
Is the internet accessible when they are logged in?

Yes, internet is accessible. The Store window opens for a seconds, and then closes. I assumed this was somehow related to permissions.

dalchina said:

Irfanview: try installing the 'desktop' version - not the Store app.
IrfanView 64-bit version

That works for Irfanview, but what about another dozen apps I might want to give them access to as they get older?

dalchina said:

Note that having people log in to your PC potentially exposes you to all manner of problems as so much damage can be done all to readily.
I suggest it's imperative that you use disk imaging on a daily schedule, so that worst case you can have your PC up and running as it was the day before, relatively quickly - essential for a busy parent.

Macrium reflect (free) + large enough external storage.

I have disk imaging setup daily to both cloud (Wasabi, daily) and a NAS (weekly).

- - - Updated - - -

bro67 said:

Is this a Pro or Home version of Windows 10? I would create a user group for the kids and assign policies to that group. You can use Jumpcloud if Pro, Home you would be best to upgrade to Pro.
This is how you can create a GPO. Prevent Users From Running Certain Programs - Technipages

Using Jumpcloud will allow you to lock down the computer better.

Thanks. Win 10 Pro.

I'll check out group policies.

- - - Updated - - -
@bro67, I see that if my "Run only specified Win apps" is Not configured (the default setting) or Disabled, users should be able to run all applications:



So, I'm wondering what the policy setting should be.

I'd rather have an exclusive setting (let them run only what I want) rather than an inclusive one (run everything, and specify what they can't--there's too many appliccations on my PC).

- - - Updated - - -

I found this post on TenForums and figured out how to create a local Group policy for one of my kids:

Apply Local Group Policy to Specific User in Windows 10

I went into "Run only specified Win apps" for that account and Disable it. Then, I logged in as my kid, and tried to launch different programs:

• Chrome - Launches fine, verified internet connection
• Store - Nothing happens
• IrfanView - Installed for me locally (from the install file, not the Store), but doesn't appear for my kid
• Inkscape - Won't launch (works when I launch it from my account)
• Affinity Designer - Won't launch (works when I launch it from my account)
• 3d View - Won't launch (works when I launch it from my account)

If it helps, I made this video that shows me going through and launching each of these, above so you can see what's happening:

https://www.screencast.com/t/DJxtDWhLsQyQ

You can always try and create a profile with only those programs you want them to see in their Start Menu under Appdata/Local.

Also look at Ultimate Windows Tweaker. Ultimate Windows Tweaker 4 for Windows 10

Jumpcloud is a free and easy way to lok the system down.

dalchina said:

Thank you for your reply.
You must distinguish between
- traditional desktop programs which may usually be installed EITHER for all users OR for one particular user.
Hence my example of Irfanview.
- Store apps which are installed additionally to those provided by MS with Windows
- Store apps provided de facto when an account is created
I suspect some- but not all- of what you are complaining of results from confusion here.
When you download and install an app from the Store, you 'own' it.

This makes sense and explains why I don't see some programs in the kids' start menu but I do in mine.

dalchina said:

Store: you say this closes immediately for local users. That is indeed a problem on your system; I've just created a local user and Store runs normally. I have given a URL with some Store fixes above.
There are tutorials in the Tutorial section to reset and reregister the Store, for example.

I went through and tried all six suggestions in the tutorial, including reseting and re-registering the store. No luck.

Then, I decided to check the event logs for right after I tried to launch the Store, and found this warning:

Access to C:\Program Files\WindowsApps\Microsoft.WindowsStore_11909.1001.7.0_x64__8wekyb3d8bbwe\WinStore.App.exe has been restricted by your Administrator by policy rule {8c2bf56d-d649-4b87-8177-8c2fe0838029}.

I also saw similar warnings for other apps I tried to open and got similar warnings.

It should be noted that my PC came w/ Home and I updated to Pro a couple of weeks ago--I'm not sure, but my thought is that there may be more restrictive policies under Pro than there were under Home.

I now need to try and figure out which policies are preventing this, but at least I'm making progress.

dalchina, or even go as far as building a GPO profile specifuc to setting up a profile as a “Kiosk” mode.

@dalchina, thanks for the suggestion.

I tried your blanket option, and that didn't work.

I filtered per your suggestion:



However, it seems there are no settings for that filter: