What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Windows 11 does not have a general built-in feature that asks for a PIN or password before opening an individual desktop or Store app. Windows Hello protects the Windows sign-in session, not separate apps inside it.
You can still control app access, but the right method depends on your goal:
- Block an app for a Windows user: use AppLocker.
- Block or limit an app for a child: use Microsoft Family Safety.
- Turn a PC into a one-app device: use Assigned Access kiosk mode.
- Protect personal apps from another household user: use separate Windows accounts and permissions.
Which Windows 11 method should you use?
| What you want to do | Best Windows feature | What it actually does |
|---|---|---|
| Stop a user from launching an installed app | AppLocker | Allows or denies applications for selected users or groups. It does not display a password prompt. |
| Restrict a child’s app use | Microsoft Family Safety | Blocks apps or sets usage schedules for a managed family member; only a family organizer can change app blocks. |
| Run only one app on a shared PC | Assigned Access single-app kiosk | Signs a kiosk account into one full-screen app and relaunches it when closed. |
| Give someone a limited desktop | Assigned Access restricted user experience | Shows a controlled Start menu and taskbar and applies application restrictions. |
| Ask for a PIN before opening one app in your normal account | No general built-in option | Requires the app’s own authentication feature or carefully evaluated third-party software. |
Microsoft’s current documentation covers AppLocker, Assigned Access, and Family Safety, but does not list a general per-app password feature for Windows 11. Be cautious of guides that claim there is an App Lock page in Settings.
Method 1: Block an app with AppLocker
AppLocker is the closest built-in option when the objective is to stop a particular user from running an application. It supports executable files, Windows Installer files, scripts, packaged apps, packaged app installers, and DLLs when the DLL rule collection is enabled.
Recommended Free Tools
#1 Best Overall
- 5-Foot (1.5m) Carbon Steel Cable - Resists cutting attempts and provides ample length for easily anchoring your laptop to desks, tables, and other attachment points. Incorporates anti-shearing plastic sleeve to protect surfaces
- Slim Lock Head - Designed to support thin laptops using standard lock slots, lock secures while allowing your device to lie flat and stable
- Resettable 4-Wheel Number Code - Set or reset your personal number code from 10,000 possible combinations
- Pivoting Head and Rotating Anchor - The lock tip rotates 360º and the cable rotates up to 90º—allowing access to the ports near the lock slot on most devices and providing a convenient locking and unlocking experience
- One-Handed Attachment - Convenient slider allows for quick and easy attachment to the laptop with one hand
AppLocker enforcement is supported across Windows 11 editions; the old claim that enforcement requires Windows 11 Pro or Enterprise is outdated. Administration and deployment options can still differ by edition and management environment. See Microsoft’s AppLocker requirements.
Before creating a restrictive rule
AppLocker is fundamentally an allowlist system, not simply a blocklist. If no rule exists for a collection, files in that collection are generally allowed. Once rules exist, files generally need to match an applicable Allow rule and must not match a Deny rule; a matching Deny rule takes precedence. Activating a collection with only a rule for your target app can block unrelated Windows or application files.
Start by creating Microsoft’s default rules and test in audit mode before enforcing anything. Default rules are starter rules, not a complete inventory of every application on the PC.
Open the local AppLocker console
- Open Start and search for Local Security Policy.
- Open Local Security Policy and approve the User Account Control prompt.
- Expand Application Control Policies.
- Expand AppLocker.
- Choose the relevant collection: Executable Rules, Windows Installer Rules, Script Rules, Packaged app Rules, or DLL Rules.
Create the default rules first
- Right-click the relevant rule collection, such as Executable Rules.
- Select Create Default Rules.
These starter rules allow essential Windows files and files in the Windows and Program Files folders. Audit testing is still important.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Block a classic desktop application
- Right-click Executable Rules and select Create New Rule.
- On Before You Begin, select Next.
- Under Permissions, select Deny.
- Choose the user or group to restrict, then select Next.
- Choose a condition: Publisher, Path, or File hash.
- Complete the condition-specific wizard.
- Give the rule a recognizable name and select Create.
A Publisher rule is usually more durable than a hash rule for signed software, provided its scope is not limited to an exact version. A hash rule matches one exact file version, so an update changes the hash and can make the rule stop matching. A path rule may not cover another launch location or a different executable that starts the app.
Block a Microsoft Store or packaged app
Packaged apps are controlled separately from traditional executable files. Microsoft also documents that enforcing executable rules can block packaged apps and installers unless appropriate packaged-app rules are present.
- In AppLocker, right-click Packaged app Rules.
- Select Create New Rule, then select Next.
- Choose Deny, select the target user or group, and select Next.
- On the Publisher page, select the installed packaged app used as the reference.
- Set the scope to publisher, package name, or package version.
- Add exceptions if needed, name the rule, and select Create.
A package-name rule can continue covering later versions, while a rule limited to one package version will not automatically cover future updates.
Rank #2
- Computer lock for HP, Lenovo, Acer, Asus and other brands; not compatible with Dell or Alienware (see part # K68008WW)
- Resettable 4-wheel Number code with 10, 000 possible combinations. Push-button design for one-handed engagement to easily attach lock
- 6’ long carbon steel cable is cut-resistant and anchors to desks, tables, or any fixed structure
- Attaches to laptops, desktops, TVs, monitors, hard drives, docking stations, projectors or any other device featuring a Kensington standard size security slot
- Independently verified and tested for industry-leading standards in torque/pull, foreign implements, lock lifecycle, corrosion, key strength and other environmental condition
Set AppLocker to enforce the rule
- Right-click AppLocker and select Properties.
- Open the Enforcement tab.
- For the rule collection you configured, select Configured.
- Choose Enforce rules, then select OK.
For a safer trial, choose Audit only first. Windows records what would have been blocked without preventing the launch.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make sure Application Identity is running
AppLocker depends on the Application Identity service, named AppIDSvc. To start it manually, open Task Manager, select the Services tab, find AppIDSvc, right-click it, and select Start Service.
From an elevated Command Prompt or PowerShell window, Microsoft documents this command to configure automatic startup: sc.exe config appidsvc start=auto. The space after start= is required by the command syntax. Microsoft notes that this protected service’s startup configuration cannot be changed to Manual with sc.exe.
Troubleshoot an AppLocker rule
- Other programs stop working: the rule collection may be enforcing an implicit allowlist without adequate Allow rules. Restore or create default rules and test with Audit only.
- A Store app will not open: create an appropriate rule under Packaged app Rules. Executable rules may also block packaged apps unless appropriate packaged-app rules exist.
- The app still launches: check the selected user or group, actual executable path, rule collection, effective policy, and whether the app is already open. Close and reopen it while testing.
- The rule stops working after an update: review the Publisher rule’s scope or replace the old file-hash rule.
- There is no enforcement: verify that AppIDSvc is running and that the collection is set to Enforce rules.
For evidence, open Event Viewer > Applications and Services Logs > Microsoft > Windows > AppLocker. Relevant logs include EXE and DLL, MSI and Script, Packaged app-Deployment, and Packaged app-Execution.
You can inspect audited events in PowerShell with Get-AppLockerFileInformation -EventLog -EventType Audited -Statistics.
Method 2: Block or limit a child’s app with Microsoft Family Safety
Family Safety is intended for a child or other managed family-member account. It is not a PIN prompt for your own applications. Only a family organizer can block or unblock apps.
Block an app
- Sign in at account.microsoft.com.
- Select the family member’s card.
- Choose the relevant platform tab, such as Windows, Xbox, Edge, or Mobile.
- Select Apps and games.
- Select the More icon beside the app.
- Select Block app.
To reverse it, use the same menu and choose Unblock app. Microsoft notes that you may need to repeat the restriction for each app, device or platform, and family member.
Rank #3
- 5-Foot (1.5m) Carbon Steel Cable - Resists cutting attempts and provides ample length for easily anchoring your laptop to desks, tables, and other attachment points. Incorporates anti-shearing plastic sleeve to protect surfaces
- Slim Lock Head - Designed to support thin laptops using nano sized lock slots (see images for sizing), lock secures while allowing your device to lie flat and stable
- Resettable 4-Wheel Number Code - Set or reset your personal number code from 10,000 possible combinations
- Pivoting Head and Rotating Anchor - The lock tip rotates 360º and the cable rotates up to 90º—allowing access to the ports near the lock slot on most devices and providing a convenient locking and unlocking experience
Set an app time limit
- Go to family.microsoft.com and sign in.
- Select the family member.
- Select Windows, Xbox, or Mobile.
- Open Apps and games.
- Turn on App and game limits.
- Select the app or game.
- Set the permitted duration and schedule.
App limits can extend across connected Windows, Xbox, and Android devices. Limiting an app does not automatically block its related website. Website restrictions must be configured separately; Microsoft’s web filtering works with Edge when the family member is signed in to their Microsoft account.
Method 3: Use Assigned Access single-app kiosk mode
Assigned Access is appropriate for a reception desk, retail terminal, classroom device, public information screen, or other PC that should run one application. It does not add a password gate to an app in your ordinary Windows account.
Microsoft lists Assigned Access support for Windows 11 Pro, Enterprise and Enterprise LTSC, Education, and IoT Enterprise and IoT Enterprise LTSC. UAC must be enabled, and kiosk setup must be performed at the physical console; it is not supported over Remote Desktop.
Set up a single-app kiosk
- Open Settings > Accounts > Other users.
- Under Set up a kiosk, select Get started.
- Enter a name for the kiosk account, or choose an existing standard account when offered.
- Select Next.
- Choose the application that should run when the kiosk account signs in.
- Complete the remaining options and select Close.
The Settings-based setup supports a single packaged application or Microsoft Edge. Edge can be configured as a full-screen digital sign or as a public browser with controls, a startup URL, and inactivity restart settings. The kiosk app runs full screen and automatically restarts if it is closed.
Configure kiosk mode with PowerShell
From an elevated PowerShell window, Microsoft documents these command forms:
Set-AssignedAccess -AppUserModelId <AUMID> -UserName <username>
Set-AssignedAccess -AppUserModelId <AUMID> -UserSID <usersid>
Set-AssignedAccess -AppName <CustomApp> -UserName <username>
Set-AssignedAccess -AppName <CustomApp> -UserSID <usersid>
If you use -AppName, the account must have signed in at least once. Remove the Assigned Access configuration with Clear-AssignedAccess.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallExit or remove kiosk mode
Press Ctrl + Alt + Del to exit the kiosk session. If the kiosk account signs in again, or the sign-in screen timeout expires, the app relaunches. Microsoft documents a default timeout of 30 seconds.
Rank #4
- 【For Devices Without Security Lock holes】There is a lock slot plate lined industrial grade double sided adhesive, bound the plate to the hard surface of the devices, then insert the locking head into the plate and loop the cable around a fixed object.
- 【For Laptops With Built-in Security Lock holes】Just simply insert the lock head into the slot, and loop the cable around a fixed object.
- 【UPGRADED 100% ANTI THEFT】The lock head is made of super strong stainless steel and double lever lock, thicker and firmer. One key lever push button with 360°rotating, design for one hand operation. 5mm diameter cut-resistant wire braided cable is 30% thicker than normal. Extra length of 6.23ft allows easy movement of device.
- 【Code Combination】The computer locks utilizes a 4 digit security code. This customizable combination allows you to have over 10,000 different and unique combination. no lost keys!
- 【PACKAGE INCLUDED】1*Laptop Combination Lock, 1*Double Sided Adhesive Lock Slot Plate, 1*Manual, 3*Spacer. Please contact us if there is any problem with our product. We promise you a 100% satisfaction resolution. No risk, order now!
To remove the configuration, go to Settings > Accounts > Other users, select Kiosk, expand the application under Kiosk info, and select Remove kiosk.
Method 4: Use a restricted user experience
If the user needs a desktop but should access only selected applications, configure Assigned Access as a restricted user experience instead of a single-app kiosk. This mode can provide a defined list of executable applications, a customized Start menu and taskbar, policy settings, and enforced AppLocker rules.
It is designed for shared devices, schools, laboratories, and frontline-worker PCs—not for adding a private password to one app in a personal Windows session.
Do not confuse Assigned Access with Shell Launcher. Assigned Access creates a restricted user experience, while Shell Launcher replaces the Windows shell with a desktop application. They cannot both be configured on the same system, and Shell Launcher is limited to Enterprise and Education editions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What will not work
- Windows Hello for one app: Windows Hello authenticates the Windows account; it does not independently lock ordinary desktop applications.
- A single AppLocker Deny rule as a simple blocklist: enabling a collection can create allowlist behavior and block unrelated files.
- Blocking only an EXE for a Store app: packaged applications use the separate Packaged app Rules collection, and executable-rule enforcement may require packaged-app rules too.
- Kiosk mode in your normal account: Assigned Access targets a kiosk account and session.
- Family Safety as a personal app locker: it is controlled by a family organizer and applies to managed family members.
Practical recommendation
For a personal PC, create a separate standard Windows account for other users and protect your main account with a strong password or Windows Hello. This prevents another person from opening your apps by signing into your account. Use AppLocker when you need policy-based execution control and understand its allowlist behavior.
For a child’s account, use Family Safety. For a shared or public computer, use Assigned Access. In an organization, test AppLocker in Audit only, review the Event Viewer logs, and enforce the policy only after confirming that Windows components and required applications continue to run.
FAQ
Can I password-protect one app in Windows 11?
Not with a general Windows 11 setting. Windows 11 has no universal per-app PIN or password prompt for ordinary desktop or Store apps. You need the app’s own security feature, a separate Windows account, or carefully evaluated third-party software.
Best Value
- Protect laptops from theft. Designed for laptops with no dedicated lock slot. Alternative to Kensington Locks.
- Works with Macbooks, Surface, Dell, Lenevo and all other major laptops, tablets and notebooks that have a 3.5mm audio port (headphone / AUX port)
- Extremely durable cut resistant steel cable to tether to to desks, tables, or any fixed structure
- 1.7 metre cable length providing both flexibility and convenience in cable management
- Resettable 4-digit combination lock with 10,000 possible combinations. Easy flick switch to lock and unlock for fast setup.
Does Windows 11 have an App Lock setting?
No. Settings does not contain a general App Lock page comparable to Android’s App Lock feature.
Is AppLocker available only on Windows 11 Pro?
No. Microsoft’s current requirements state that Windows 11 editions no longer require a specific edition to enforce AppLocker policies. Management and deployment options can still vary by edition.
Will AppLocker show a password box when someone opens a blocked app?
No. AppLocker allows or denies execution for selected users or groups. It does not pause the launch and request a PIN.
How do I block a Microsoft Store app?
Open Local Security Policy, go to Application Control Policies > AppLocker > Packaged app Rules, and create a Deny rule for the relevant user or group. Classic Executable Rules alone may not cover the packaged app.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Can Family Safety limit an app’s usage time?
Yes. At family.microsoft.com, select the family member, open the relevant platform and Apps and games, enable App and game limits, then configure the app’s duration and schedule.
What is the closest built-in Windows feature to locking a PC to one app?
Assigned Access single-app kiosk mode. It uses a kiosk account, runs the selected app full screen, and relaunches it if it closes. It is not a per-app password lock in a normal user session.
The Bottom Line
Bottom line: Windows 11 cannot generally put a PIN on one app. Use AppLocker to deny an app for a user, Family Safety to manage a child’s app access, and Assigned Access to operate a shared PC as a kiosk. For personal privacy, separate Windows accounts are usually safer and simpler than trying to simulate an app password.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
