How to Disable or Block Notepad on Windows

Notepad seems harmless, but on a locked-down machine any text editor can be used to write scripts, edit config files, or stage a bypass. Blocking a specific app like Notepad is a good example of app control - and a good lesson in why Windows 11's Store-app version needs extra handling. This guide covers the methods to block Notepad and how to make the block stick.

Why block a specific app

Blocking Notepad is rarely about Notepad itself; it is about controlling which apps run at all. The techniques used to block Notepad - Image File Execution Options, AppLocker, DisallowRun - are the same ones you use to block any unwanted executable.

On single-purpose and kiosk machines, blocking editors and other general tools keeps users inside the intended workflow.

The methods

There are three common ways to block an app by name on Windows, each with tradeoffs.

  • Image File Execution Options (IFEO) - set a Debugger value on notepad.exe so launching it is intercepted
  • AppLocker or SRP - deny rules by path, publisher, or hash (Enterprise and Education)
  • DisallowRun - a per-user Explorer policy listing executables that cannot start

The Windows 11 Store-app catch

On Windows 11, Notepad ships as a packaged Store app, not just a classic notepad.exe. An IFEO trap on notepad.exe may not catch the packaged version, so the app still opens.

Blocking packaged apps reliably needs a watchdog that also handles the Store (UWP) app, or a policy targeting the package. A managed agent handles both the classic and packaged versions and re-applies the block after tampering - which is far more dependable than a single IFEO key.

Block Notepad with IFEO or DisallowRun

  1. Open Registry Editor - Press Win+R, type regedit, and press Enter.
  2. Create the IFEO entry - Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options and create a subkey named notepad.exe.
  3. Add the Debugger value - Inside notepad.exe create a String value named Debugger pointing at a harmless stub or a blocking helper. Launching notepad.exe will now be intercepted.
  4. Or use DisallowRun - Under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer set DisallowRun to 1, then in the DisallowRun subkey add a value listing notepad.exe.
  5. Handle the Windows 11 Store app - On Windows 11, confirm the packaged Notepad is also blocked. If it still opens, target the app package or use a managed agent with a UWP-aware watchdog.

Frequently asked questions

Why does Notepad still open after I set the IFEO key?

On Windows 11 Notepad is a packaged Store app, so an IFEO trap on notepad.exe may miss it. Blocking the packaged app needs a UWP-aware method.

What is the difference between IFEO and DisallowRun?

IFEO intercepts an executable when it launches via a Debugger value. DisallowRun is a per-user Explorer policy that lists executables Explorer will refuse to start.

Can I block any app this way?

Yes. The same IFEO, AppLocker, and DisallowRun techniques block any executable by name - Notepad is just a common example.

How do I keep the block from being removed?

A user with registry access can delete the keys. A managed agent re-applies the block and covers both classic and packaged apps so it stays in force.

Block any app, classic or Store, reliably

CtrlOne blocks apps by name across classic and packaged (UWP) versions, re-applies after tampering, and manages it all from one console.