How to Prevent Applications from Launching Other Apps in ThreatLocker?

This document outlines the step-by-step process of how to prevent applications from launching other apps in ThreatLocker Dashboard.

This article is a part of our ThreatLocker How-to Guides series, Chapter 06 – Network Control & Ringfencing.

Introduction

Some applications, such as Command Prompt (CMD), can be abused to launch or interact with other applications like Notepad, PowerShell, or malicious scripts.

Using ThreatLocker Application Control with Ringfencing, you can prevent trusted applications from launching or interacting with unauthorized software, strengthening your Zero Trust posture.This guide explains how to block Command Prompt from launching Notepad or interacting with it.

Implementation

Step 1: Access the Application Control Module

1. Log in to the ThreatLocker Portal.
2. Navigate to Modules > Application Control
3. Click Create Policy

Step 2: Create the Application Control Policy

1. Fill the policy form

• In the Details section
  • Name: Block CMD from launching Notepad
  • Description: Prevent Command Prompt from interacting with Notepad
• In the Applied To section
  • Select the target computer or computer group where the policy should apply

• In the Condition section
  • Select the application: Command Prompt (cmd.exe)
  • Select All Interfaces
  • Select No Policy Expiration to keep the rule active indefinitely.

In the Action section:

• Select Permit with Ringfencing, then configure the following ringfencing option:
  • Enable Restrict this application from interacting with other applications: 
    • Choose: Allow all except below
    • Add Notepad.exe to the list of blocked interactions

2. After all fields are completed, click Create to save the policy

Step 3: Deploy the policy to Prevent Applications from Launching Other Apps

Deploy the policy to enforce it on the selected devices

Conclusion

By using ThreatLocker’s ringfencing features, you can stop trusted applications like CMD from launching or interacting with others, reducing the risk of internal misuse or attack escalation.

This approach helps contain activity within safe boundaries, reinforces application isolation, and supports a strong Zero Trust strategy.