"This App Has Been Blocked by Your System Administrator": Which Policy Fired and How to Fix It

Updated: October 2026

A user double-clicks an installer and Windows answers with a wall of blue and one line of text. The line blames an administrator, so the ticket lands on the technician, who has no idea which control spoke. This guide shows how to tell which policy sits behind "This app has been blocked by your system administrator" and what the right fix is for each one.

Six Controls Share One Message

Windows has no single "block this app" feature. At least six separate mechanisms can stop a program, and several of them borrow the same sentence for the dialog.

The first is User Account Control itself. When the policy Behavior of the elevation prompt for standard users is set to Automatically deny elevation requests, a standard user who runs something that asks for admin rights gets no password prompt. They get the blocked message instead. Microsoft's own policy page says the setting "returns an Access denied error message", and in practice that error is the blue dialog with "Contact your system administrator for more info" underneath.

The second is UAC again, with a different trigger. Since Windows 10, elevation is refused for executables signed with a revoked certificate, documented in Microsoft KB 3082125. Expired or untrusted signatures land in the same place. The wording shifts to "An administrator has blocked you from running this app" or "This app has been blocked for your protection", and no administrator did anything.

The third and fourth are application control: AppLocker and App Control for Business, which many technicians still call WDAC. The fifth is Smart App Control, the consumer cousin of WDAC that ships on fresh Windows 11 installs. The sixth is Microsoft Defender Antivirus, through the attack surface reduction rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion". SmartScreen sits off to the side with its own dialog, "Windows protected your PC", which we cover in the guide to Microsoft Defender SmartScreen.

That is why the usual advice fails. Toggling SmartScreen off does nothing when AppLocker fired, and "run it from an elevated prompt" does nothing when the certificate is revoked.

Read the Dialog Before You Touch Anything

The exact wording is the first clue, and it is more reliable than it looks.

"This app has been blocked by your system administrator. Contact your system administrator for more info" is the UAC auto-deny text and the AppLocker text. "An administrator has blocked you from running this app. For more information, contact the administrator" points at a signature problem on elevation. "This program is blocked by group policy" is the old Software Restriction Policies dialog. A WDAC block says so in its own words and names App Control, and a Smart App Control block names Smart App Control. A Defender ASR block arrives as a Windows Security notification rather than a dialog.

The second clue is what the user was doing. If the message only appears on actions that need admin rights, such as right-click and Run as administrator or an installer that writes to Program Files, you are looking at UAC. If a plain double-click on an app that never asks for elevation fails, you are looking at application control or Defender.

The third clue is which apps fail. When Photos, Sticky Notes or Company Portal throw the message, the culprit is usually a baseline setting that blocks Microsoft Store apps, not a rule someone wrote. A 2024 r/Intune thread shows the pattern: an admin rolling out CIS benchmark policies saw Company Portal blocked, and the replies went straight to AppLocker, the ASR prevalence rule and the "block store apps" setting.

Where Each Control Leaves a Fingerprint

Every one of these controls except UAC writes an event. Open Event Viewer and check the logs in this order, because each takes under a minute and the first hit ends the search.

AppLocker logs under Applications and Services Logs, Microsoft, Windows, AppLocker. Event 8004 in EXE and DLL means an executable was prevented from running under an enforced policy. Event 8007 in MSI and Script is the same for installers and scripts. Microsoft's event reference also lists 8003 and 8006, which mean the file would have been blocked if the policy were enforced, so an 8003 tells you AppLocker is in audit mode and not your problem.

App Control for Business and Smart App Control both write to CodeIntegrity, Operational. Event 3077 is the enforced block. Event 3089 follows it with the signer details, one per signature, and a 3033 alongside means the signature is revoked or an expired lifetime-signing certificate caused it. Packaged apps blocked by WDAC show up as 8040 back in the AppLocker log.

Defender ASR writes to Microsoft, Windows, Windows Defender, Operational. Event 1121 is a block, 1122 an audit. The event body carries the rule GUID, so match 01443614-cd74-433a-b99e-2ecdc07bfc25 to the prevalence rule.

Software Restriction Policies, deprecated but still deployed, log events 865 to 868 in the plain Application log.

UAC leaves no event, which is why it fools people. Check it from policy instead: run gpresult /h report.html on a domain-joined device, or mdmdiagnosticstool -area DeviceEnrollment;DeviceProvisioning;Autopilot -cab on an Intune device and read the UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers line. The registry confirms it in seconds: ConsentPromptBehaviorUser under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System set to 0 is auto-deny.

A September 2025 r/sysadmin thread is a good reminder of what "no event" looks like. AppLocker was deployed, PowerApps links threw the message, and nothing appeared in the AppLocker or Defender logs. The answer was a security-baseline setting with Microsoft's own warning attached: enable it only if recommended as a security response, because it causes serious app compatibility issues.

The Fix Depends on Who Spoke

Once you know the source, the fix is usually short. The mistake is applying one control's fix to another control's block.

UAC auto-deny. Nothing is wrong with the app. The device refuses to elevate standard users, and on a managed fleet that is often deliberate. Microsoft's Windows 11 security baseline (page updated October 2026) sets this value to Automatically deny, and Rudy Ooms at Patch My PC traced the same message to Shared PC mode, which applies it through local policy. If the user needs the install, a technician runs it with admin credentials. If standard users must be able to elevate with a password, change the baseline setting to Prompt for credentials on the secure desktop, and do it in the policy that owns it, not in local gpedit, or the next sync puts it back.

Revoked or invalid signature. Do not unblock this one. Windows is telling you the publisher's certificate was revoked, expired or sits in the Untrusted Certificates store. Run Get-AuthenticodeSignature .\installer.exe in PowerShell and read the status. A vendor who had a certificate stolen will have re-signed a current build, so download that. Older builds of mainstream software trip this too: Bitdefender documents the "blocked for your protection" error on its own outdated installation kits and tells users to fetch the current one.

AppLocker. The 8004 event gives you the path, the publisher and the hash. Add an allow rule for the publisher in the policy that produced the block, whether that is a GPO in the Group Policy Editor or an OMA-URI profile in Intune. Publisher rules survive version updates, hash rules don't. Test in audit mode first and watch for 8003 before you enforce.

App Control and Smart App Control. Pull the signer from the 3089 event and add it to a supplemental policy, then refresh with citool -r. Our WDAC guide walks through the policy format. Smart App Control takes no exceptions at all. On a consumer or small-business PC, the choice is to turn it off, which is one-way and covered in how to turn off Smart App Control, or to sign the app.

Defender ASR. Switch the rule to audit while you investigate, then add a per-rule exclusion for the file or an Allow indicator in the Defender portal. Warn mode gives users a 24-hour Unblock button, and as of Defender platform 4.18.26060 that Unblock needs administrator approval.

If you look after more than a few machines, the right move is to query all of them at once. A script that reads ConsentPromptBehaviorUser, Get-AppLockerPolicy -Effective and the CodeIntegrity policy state across a client's devices, with the output collected in one place, is exactly what OpenFrame's fleet scripting is for.

The walkthrough below covers the single-PC fixes for the "for your protection" variant, which is the path on a home or unmanaged machine.

When the Block Should Stay

Three situations call for leaving the block in place and telling the user why.

The first is a revoked or untrusted certificate. That message exists because stolen signing certificates are how malware looks legitimate, and Windows refusing to elevate it is the control working.

The second is an app nobody can vouch for. An unsigned tool from a forum, a cracked installer or a "portable" copy of a paid product deserves the block it got. Application control exists to stop exactly this, and an exception for one user is a hole for everyone.

The third is a block with no author. A clean Windows install has no enforced AppLocker rules and no SRP rules. If you find deny rules under HKLM\SOFTWARE\Policies\Microsoft\Windows\SrpV2 or Safer\CodeIdentifiers on a machine nobody manages, treat it as tampering. Malware uses those keys to stop antivirus components and diagnostic tools from launching, so the next step is an offline scan, not a registry cleanup.

Everything else is a request for an exception, and the request should carry the file name, the publisher, the hash and the event text. A technician who hands that to the policy owner gets a rule in minutes. A technician who hands over "it says blocked" gets a question back.

Find the Author, Then Decide

Read the wording, check the four logs, and check UAC by policy when the logs are silent. The dialog looks the same across six controls, but each one leaves a different fingerprint, and the fix for one makes no difference to the rest.

For the two application-control layers that generate most of these tickets on managed fleets, the WDAC guide is the next read.