Windows 11 does not have a general built-in app-lock screen where you assign a PIN to any desktop application. The right method depends on what you are trying to protect: AppLocker controls which programs selected users can run, Family Safety blocks or limits apps for family members, and Assigned Access creates a kiosk or restricted desktop.
For a normal Windows account, AppLocker is the closest built-in equivalent to locking individual apps. For a child account, use Family Safety. For a public-facing or restricted-use PC, use Assigned Access.
Choose the right Windows 11 app restriction
| What you need | Best option | What it does |
|---|---|---|
| Stop a user or group from launching selected desktop programs | AppLocker | Creates allow or deny rules for programs and packaged apps |
| Restrict a child’s apps, games, or usage time | Microsoft Family Safety | Blocks apps and sets schedules for family members |
| Give an account access only to selected apps | Assigned Access | Creates a kiosk or restricted desktop profile |
| Require a PIN before opening one application | No general built-in Windows 11 feature | Use a suitable third-party solution, or restrict the account instead |
Method 1: Lock apps for a Windows user with AppLocker
AppLocker can target an individual user or security group. It supports executable files, scripts, Windows Installer files, DLLs, packaged apps, and packaged-app installers. Microsoft lists AppLocker as included with all Windows editions; the older Windows 10 version 1809-and-earlier exception does not apply to Windows 11.
1. Open the local AppLocker editor
- Sign in with an administrator account.
- Open Start and type secpol.msc.
- Press Enter to open Local Security Policy.
- Go to Application Control Policies → AppLocker.
The rule collections are Executable Rules, Windows Installer Rules, Script Rules, Packaged app Rules, Packaged app Installer Rules, and DLL Rules. DLL rules are not enabled by default. Before enabling them, plan allow rules for every DLL required by the applications you intend to permit.
#1 Best Overall
- VERSATILE BIKE LOCK: Master Lock 8122D outdoor bike cable lock with combination helps secure bicycles, e-bikes, scooters and other outdoor equipment; Ideal as a bicycle lock and basic theft deterrent for everyday security
- RESETTABLE COMBINATION LOCK: Cable bike lock features a four-digit set-your-own combination for keyless convenience; Set and reset your own combination without carrying keys
- BRAIDED STEEL CABLE: Bike lock cable is made with braided steel for strength and flexibility; Protective vinyl coating helps prevent scratches on bikes and outdoor gear
- LONG SECURITY CABLE: Combination bike lock cable measures 6 ft. (1.8 m) long and 1/2 in. (13 mm) wide in diameter, offering extended reach for locking bikes to racks and fixed objects
- INCLUDES ONE CABLE LOCK: Includes one black resettable combination bike lock cable; Portable anti-theft bike lock is designed for basic security and everyday outdoor use
2. Check the Application Identity service
AppLocker requires the Application Identity service, whose service name is appidsvc. If rules do not appear to have an effect, check that service. AppLocker can also run in audit-only mode, where launches continue but violations are recorded in event logs; creating a rule does not automatically mean it is enforced.
3. Create a rule for the user or group
- In AppLocker, right-click Executable Rules.
- Select Create New Rule, then select Next.
- Choose an Allow or Deny rule.
- Select the user or group the rule should affect.
- Choose a condition: Publisher, Path, or File hash.
- Complete the wizard and select Create.
For a direct block, choose Deny, select the affected user, and identify the application using one of those conditions.
Which AppLocker condition should you use?
| Condition | Useful for | Important limitation |
|---|---|---|
| Publisher | Signed software that may receive updates | Unsigned applications cannot use publisher conditions. An exact product-version match stops matching after an update. |
| Path | A known folder or executable location | A user who can write to a permitted path may be able to introduce another executable. |
| File hash | A precise, fixed file | The rule applies only to the exact file version whose hash was captured. |
Publisher rules can match publisher name, product name, file name, and file version. They are usually easier to maintain for signed applications, provided you do not require an exact product version.
4. Use the automatic rule wizard for an allow list
To let a user run only approved programs, right-click the relevant rule collection and select Automatically Generate Rules Wizard. It can create multiple allow rules from files in a folder or installed packaged apps. The Create Rules Wizard creates one rule at a time. Inspect generated rules carefully: a restrictive allow list can prevent required Windows components or business applications from launching.
5. Handle packaged apps before enforcing executable rules
If any rules are enforced for the EXE rule collection, Microsoft says you must also create rules for Packaged apps and Packaged app installers. Otherwise, all packaged apps and packaged-app installers are blocked. Before enforcing an EXE allow list, add the required packaged-app allow rules and test Store and business apps used by the target account.
Rank #2
- Security: Steel strong steel cable with braided steel construction provides strength and flexibility security for your bikes with strong protection
- Durable: Coated in vinyl protects your cable against rusting and scratching
- Wide function: It’s the perfect choice to secure your bicycles, sports equipment, gates and fences, grills & lawnmowers, skateboards, tools, ladders, mechanism, truck bed and more
- Convenience: Sturdy double end-looped to adjust pad-locks, u-locks, disc-locks and more
- 4 sizes available: 4-FT x 12mm, 7-FT x 12mm, 15-FT x 12mm, 30-FT x 12mm, Note: when below 20-25 degrees, cable gets stiff and hard to bend
6. Test in audit mode, then enforce
Start with audit-only behavior. Have the affected user try normal work applications, installers, scripts, and required Windows tools, then review AppLocker event logs for violations and add missing rules. Switch the rule collection to enforcement only after testing, preferably with a separate account first.
Blocking an app is not the same as protecting it from an administrator
AppLocker is designed mainly to control code launched in a user’s context. Microsoft classifies it as a defense-in-depth feature, not a defensible Windows security boundary, and recommends App Control for Business when a robust security boundary is required. Use a standard account for the person being restricted and keep administrative credentials separate.
Method 2: Block or limit a child’s apps with Microsoft Family Safety
Family Safety is a simpler choice for a child or another member of your Microsoft family. Only a Family organizer can block or unblock apps.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBlock an app
- Sign in at Microsoft Family Safety.
- Select the family member’s tile or card.
- Select the platform tab: Windows, Xbox, Edge, or Mobile.
- Select Apps and games.
- Select the More icon beside the app, then select Block app.
To reverse the restriction, use More → Unblock app. Repeat the process for each app, device or platform, and family member that should be restricted; a Windows block does not automatically block the Xbox or mobile version.
Set a daily app or game limit
- Go to Microsoft’s app and game limits instructions.
- Select the family member and the Windows, Xbox, or Mobile platform.
- Select Apps and games and turn on App and game limits.
- Select the app or game and set the daily duration and allowed schedule.
Time limits do not restrict websites. To restrict related web access, select the app or game under Apps and games and choose Block related websites. Family Safety may temporarily show duplicate listings when the same app is installed on multiple devices; each listing may need its own limit until processing finishes.
Rank #3
- Package Contents: You will receive 2 pcs of 6.6ft braided steel coated silver security cables and 2 pcs of locks. Cable diameter: 2.5mm. Lock size: 55*22mm/2.17''*0.87''(L*W). Cable bike lock features a set your own combination, three-digit combination lock
- Premium Material: Security cable lock is made of steel wire. Cable wire surface Vinyl covering protects against rust and scratching and braided steel construction provides strength and flexibility along with strong cut resistance
- Secure and Strong: Our uncuttable cable locks are designed with double loops ends that easily accommodate padlocks, U-locks, and small combination locks. This security steel wire lock cable with loops is lightweight and portable, making it easy to transport and use anywhere
- Wide Application: Cable for lock is used for hanging and securing, can be used to connect strap or clip. Safety cable can be used to lock items such as bicycles, luggage, packages, lights, doors, motorcycles, fences, etc. Widely used in indoor and outdoor use to prevent items get lost
- Best Service: Steel cable lock with loops are perfect for those who need a locking cable to protect their belongings. If you have any questions about our lock with cable, please feel free to contact us at any time and we will solve it for you immediately
Method 3: Use Assigned Access for a kiosk or restricted desktop
Assigned Access is for an account with a deliberately narrow Windows experience, not a password prompt placed over one existing app. Its KioskModeApp profile runs one UWP app or Microsoft Edge full-screen. Its AllAppList profile creates a restricted desktop with a defined list of allowed apps; that list can contain UWP and desktop apps, and Windows generates AppLocker rules for them.
Important Assigned Access requirements
- Assign the profile to a standard local, domain, or Microsoft Entra ID user; a restricted-user profile is not supported for an administrator account.
- The account must already exist on the device before applying the configuration.
- If an allowed app depends on another app, include both in the allowed-app list.
- Group accounts can use a restricted-user experience but cannot be assigned a KioskModeApp profile. Nested groups are not supported.
- Generated Assigned Access AppLocker rules cannot be managed in MMC snap-ins. Do not create conflicting AppLocker rules.
- Assigned Access does not prevent installation of UWP apps. A newly installed UWP app is not added to the deny list until the kiosk user signs out and back in.
Account names in an Assigned Access configuration
Use account syntax that matches the account type:
| Account type | Example syntax |
|---|---|
| Local account | devicename\user, .\user, or user |
| Active Directory | domain\samAccountName |
| Microsoft Entra ID | AzureAD\user@contoso.onmicrosoft.com |
Assigned Access configurations use XML. Generate a profile identifier in PowerShell with New-Guid. Windows 11 version 22H2 uses the v5 namespace http://schemas.microsoft.com/AssignedAccess/2022/config; version 21H2 uses the v4 namespace http://schemas.microsoft.com/AssignedAccess/2021/config. Verify the target Windows version before adapting an XML configuration.
Restricted sessions disable shortcuts including Ctrl+Shift+Esc for Task Manager, Win+E for File Explorer, Win+I for Settings, Win+R for Run, Win+D for the desktop, and Win+Q or Win+S for Search. In a single-app kiosk profile, Ctrl+Alt+Delete can exit kiosk mode by default; the XML BreakoutSequence element can change that key combination.
What will not work
- Windows 11 has no universal built-in PIN lock for individual apps.
- AppLocker audit-only mode permits launches while recording violations.
- Hash rules and exact product-version publisher rules need maintenance after app updates.
- Family Safety time limits do not cover websites; use Block related websites separately.
- Assigned Access restricted-user profiles cannot be applied to administrator accounts.
FAQ
Can I put a PIN on any Windows 11 app without installing software?
No. Windows 11 does not include a general per-app PIN feature. Use AppLocker to restrict a Windows user, Family Safety for a family member, or Assigned Access for a kiosk or restricted desktop.
Is AppLocker available only in Windows 11 Pro or Enterprise?
No. Microsoft’s current AppLocker overview says it is included with all Windows editions. The older exception concerns Windows 10 version 1809 and earlier.
Rank #4
- Secure Your Bike - Our 3/8" bike cable locks are the perfect solution for securing your bike and keeping it safe from theft. Cable is wrapped with vinyl covering to protect against scratching surfaces.
- Multipurpose Design - Male end of the cable is designed to fit through narrow spaces making it perfect to secure kayaks and paddleboards but also other common items like scooters, gates, etc.
- Easy to Use - Intuitive locking mechanism, simply loop it around whatever you want to secure and a fixed object and snap it together to lock. Each bike lock comes with 2 keys.
- Dustproof Design - Locking mechanism designed with dustproof cap to protect the key hole from dusts and water, ensuring the life span and durability of the locking mechanism.
- Made With 7 Braided Steel - Our lock for bike is made of heavy-duty 7 braided steels to deter theft, providing you with peace of mind.
How do I block an EXE for one Windows user?
Open Start, run secpol.msc, go to Application Control Policies → AppLocker → Executable Rules, create a Deny rule, select the target user, and identify the program by publisher, path, or file hash.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Will an AppLocker hash rule survive an application update?
Usually not. A hash rule applies to the exact file version captured. For signed software, a publisher rule is generally easier to maintain, unless it requires an exact product-version match.
Why did AppLocker block Microsoft Store apps?
If EXE rules are enforced, Microsoft says you must also create rules for Packaged apps and Packaged app installers. Otherwise, packaged apps and their installers can be blocked.
Can Family Safety limit an app’s associated websites?
An app or game time limit does not limit websites. Select the app or game in Apps and games and choose Block related websites.
Is Assigned Access suitable for locking one normal desktop app?
Assigned Access is intended for a single-app kiosk or a restricted desktop with an allowed-app list. It is not a per-app password lock. Use AppLocker to stop a selected user from launching a desktop program.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe Bottom Line
For most administrator-managed Windows 11 PCs, start with AppLocker: target the specific user, use a publisher rule where possible, audit first, and test packaged apps before enforcing EXE rules. Use Family Safety for child accounts and usage schedules. Use Assigned Access when the entire account should behave like a kiosk or restricted workstation. None of these built-in tools is a universal per-app PIN, and AppLocker is not a complete security boundary.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
