GiliSoft EXE Lock

Password-protect private apps or stop unwanted programs from opening. Control desktop EXE and supported Microsoft Store apps on Windows.

  • Password-protect apps or block them from starting
  • Manage desktop EXE and supported Microsoft Store apps
  • Use app whitelists, Temporary Unlock, and activity logs
GiliSoft EXE Lock illustration with protected Windows apps and password access

How to Use GiliSoft EXE Lock on Windows

Choose the app-control task you need: lock a desktop program, protect a Store app, require a password, block launches, or release access. Follow the matching steps for passwords, trusted apps, logs, and recovery on Windows 11 and Windows 10.

What Would You Like to Do?

Passwords and Trusted Apps

Lock Desktop and Store Apps

Choose and Test App Access

Logs and Ongoing Maintenance

Passwords and Trusted Apps

Change the Startup and Release Password

Change the password used to open EXE Lock and approve protected app launches. Both uses share the same credential.

  1. Open the password setting

    Go to Settings, or use Open Settings on the Dashboard. Find Startup / Release Password.

  2. Change the unified password

    Select Change Password and complete the password dialog shown by your installed version. Keep the new password available to the person managing app access.

  3. Check management and app approval

    Reopen EXE Lock with the new password. If you use Password Verification, close a protected app and test its next launch with the new password too.

Settings uses one Startup / Release Password and provides the recovery email and app whitelist in the same window.

The release password is also the management password. For supervised use, enter it yourself when the app asks; do not treat it as a separate password for just one application.

Set a Password Recovery Email

Set the email associated with password recovery while you still have access to Settings.

  1. Open Email Settings

    In Settings, find Email Settings beneath the password section. Select Set Email.

  2. Configure an address you can access

    Complete the email dialog and any confirmation it presents. Use an address whose inbox you can still open without relying on an app that you are about to lock.

  3. Keep the recovery address current

    Review the address when the person managing the PC changes or the mailbox is retired. See password recovery if you are already unable to enter EXE Lock.

See Set Email in the Settings screenshot. Keep this address accessible so you can complete recovery when needed.

Keep a Trusted Desktop App Outside the Lock List

Use the whitelist for a desktop app that must stay outside EXE Lock restrictions.

  1. Open the user whitelist

    Go to Settings > App Whitelist and find User Whitelist. This is separate from Desktop Apps (EXE), where you add programs to protect.

  2. Add the trusted executable

    Select Add Desktop App and choose the intended program. Review its PATH / IDENTIFIER rather than relying only on the display name.

  3. Review the existing lock list

    Whitelisted apps cannot be added to the lock list. If this app already has a protected entry, review and remove its lock rule as needed, then test its normal launch instead of assuming a new whitelist entry released it.

Use Search whitelist... to find an existing entry. The Settings screenshot shows the User Whitelist, type selector, and separate desktop and Store add buttons.

Keep a Trusted Store App Outside the Lock List

Keep a trusted Microsoft Store app outside the protected list without treating every detected package as trusted.

  1. Choose Add Store App

    Open Settings > App Whitelist and select Add Store App in User Whitelist.

  2. Identify the intended installed app

    Select the target for the app you want to keep available. Check its name and PATH / IDENTIFIER; similarly named packages or extensions can have different roles.

  3. Verify the trusted entry

    Confirm the intended app appears in the user whitelist. If it was already locked, review its current rule in Store Apps (UWP) and test the normal Start menu entry.

Adding an app to the whitelist is not the same as adding it to Store Apps (UWP) for locking. Choose the list that matches your intention.

Review System Protected Items

Built-in trusted entries help keep essential Windows components out of the lock list.

  1. Open System Protected Items

    In Settings > App Whitelist, expand System Protected Items beneath User Whitelist.

  2. Check why an app is excluded

    Review the entries when EXE Lock will not let you add a target. A system-protected or user-whitelisted app is deliberately kept outside the lock list.

  3. Choose the actual user application

    If your aim is to restrict a game, browser, or business tool, return to that application's executable or Store target. Do not substitute an essential Windows process for the app you meant to lock.

See the System Protected Items section in Settings. User-added trusted entries and built-in system entries are shown separately.

Lock Desktop and Store Apps

Lock a Desktop EXE App

Add one desktop program, choose how its launch should be handled, and confirm the result. Set your Startup / Release Password first if you intend to approve launches with a password.

Add the desktop executable

Open Desktop Apps (EXE) and select Add. Choose the executable for the application you want to lock. If you start from a shortcut, confirm that the displayed target is the program that actually runs.

Confirm the path and lock status

Review the app name and full executable path in the target list, then confirm that its status is Locked. The example shows CapCut.exe as a locked desktop target; the filename and location on your PC will differ.

Desktop Apps (EXE) shows the app name, full path, and Locked status. The example protects CapCut.exe; choose the intended executable on your own PC.

Choose what happens at launch

Open Lock Policy and choose Password Verification to require the Startup / Release Password, or Direct Block to prevent launch without a prompt. This policy applies to the protected list, not only to the app you just added.

See the two Lock Policy options below.

Test the normal app shortcut

Check that Dashboard shows Protection Status: Running and that Temporary Unlock is no longer active. Close the protected app, then reopen its normal shortcut. For Password Verification, test an incorrect password and then the correct one; for Direct Block, confirm that the app stays closed.

To add from a shortcut, see the shortcut task. For Store apps, use Store Apps (UWP) instead of treating a package folder as a desktop executable.

Add a Program from a Shortcut

EXE Lock supports shortcut targets through the app list drop area. The path behind the shortcut still matters.

  1. Add the shortcut target

    Use the supported Drop files here to add protected apps area for the application's .lnk shortcut. The pictured drop area accepts desktop apps, shortcuts, and Store app targets.

  2. Inspect the executable it resolves to

    Check the full path in the protected target list. A shortcut may open a launcher, which then starts a different EXE; do not decide from the shortcut label alone.

  3. Test the shortcut people actually use

    Close the program and reopen it from that shortcut. If it still opens unexpectedly, compare the process in Logs with the target you added and correct the rule.

The Store Apps screenshot shows the supported drop area. For a focused executable example, see how to password-protect an EXE file.

Lock a Microsoft Store App

Use the dedicated Store app list for supported installed Microsoft Store targets instead of browsing and changing WindowsApps folder permissions.

  1. Open Store Apps (UWP)

    Select Store Apps (UWP) in the sidebar. Find the intended installed app and check its path or identifier under the app name.

  2. Apply the lock to the intended target

    Select that entry and use the lock control available in the app list. Confirm the status changes to Locked; selecting a checkbox alone is not evidence that the app is protected.

  3. Test its normal Start menu entry

    Choose the intended behavior in Lock Policy, close the app, and reopen it from Start. Test under the same Windows account that normally uses it.

Store Apps (UWP) shows detected targets separately from desktop programs. The pictured entries are Unlocked, so finding an app here does not by itself mean it is protected.

If a Store app is missing, check that it is installed for the current Windows account. For more detail, see how to lock Microsoft Store apps.

Select Locked or Unlocked Apps

Review the entries you intend to change before applying an action to more than one app.

  1. Open the relevant target list

    Use Desktop Apps (EXE) or Store Apps (UWP). Review app names, paths, and the current Locked or Unlocked labels.

  2. Select the appropriate entries

    Use individual checkboxes, Select All, Select Locked, or Select Unlocked. These controls select entries; they do not themselves lock, unlock, or hide programs.

  3. Review before making a change

    Check which rows are selected before using the available app-list action. Afterward, read each affected status and test the intended program rather than assuming every selected target changed successfully.

See the desktop selection toolbar or the Store app selection toolbar. In particular, Select Unlocked means select unlocked entries, not unlock selected apps.

Choose What Happens When an App Opens

The Lock Policy page sets the launch behavior for the protected target list. Decide whether an app should remain unavailable or open after password approval.

Direct Block

The protected program is prevented from starting without a password prompt. Use it for games, distracting apps, or tools that should not be available on a shared PC.

Expected result: the app does not start. Not seeing a password dialog is normal in this mode.

Password Verification

A launch prompts for the EXE Lock password, and the program runs only after successful verification. Use it when an owner should approve access to finance, work, or personal apps.

Expected result: the app remains blocked until the correct password is entered.

One policy, one password: the interface shown here uses a policy for the protected list and a unified Startup / Release Password. It does not show independent passwords or policy modes for each app.

Choose Password Verification or Direct Block

Choose one launch behavior for the protected target list. The shown version does not assign a separate mode to each app.

  1. Open Lock Policy

    Select Lock Policy and review the target count in Lock Policy Settings. The Allow Method area contains both launch options.

  2. Choose the behavior you want

    Select Password Verification to show a password prompt before a protected app runs. Select Direct Block when it should not start and no prompt should be offered.

  3. Test after switching modes

    Close a protected app and launch it again. Recheck other protected targets too, because the policy applies to the list. With Password Verification, an incorrect password should not release the app.

Lock Policy applies to the protected targets. The example has Password Verification selected; Direct Block is the alternative when no password prompt is wanted.

The two modes use the same protected list. To stop locking only one program, change that app rule instead of switching the global launch policy.

Check Protection and Test a Launch

Verify both the running service and the app rule. A Running indicator alone does not confirm that a particular program has been added.

  1. Check Protection Status

    Open Dashboard and look for Protection Status: Running. Make sure a previous Temporary Unlock is no longer releasing protection.

  2. Check Protected Targets

    Review Protected Targets and the desktop and Store app counts. Use the adjacent Edit control to open the list you need. The example screenshot shows zero targets, not a completed app lock.

  3. Test a fresh launch

    Close the protected app and reopen its normal shortcut or Start menu entry. Match the result to Lock Policy, then inspect Blocked Attempts and Recent Intercept Logs.

The Dashboard example is an initial state: protection is Running, but no apps have been added and no intercept events are listed.

The displayed Blocked Attempts count is labeled Since service startup. Use individual event details to investigate a test; do not read this counter as a permanent record of every launch.

Temporarily Unlock Protected Apps

Use Temporary Unlock for supervised access or maintenance when you want to keep the protected app list.

  1. Start the temporary release

    On Dashboard, select Temporary Unlock. Complete the confirmation or password request shown by the installed version.

  2. Finish the supervised task

    Perform the maintenance or supervised use while protection is released. Treat this as a temporary release of protection, not a permanent exception for just one app.

  3. Restore protection and retest

    End the temporary release using the controls shown by EXE Lock. Confirm Protection Status: Running again, close the test app, and check that a fresh launch is blocked or prompts as intended.

See Temporary Unlock on the Dashboard. To leave one application available permanently, use its individual rule rather than leaving protection temporarily released.

Stop Locking One App

Make one program available again while keeping the other protected targets in place.

  1. Find the exact app entry

    Open Desktop Apps (EXE) or Store Apps (UWP). Match the path or identifier, and select only the intended entry.

  2. Change that entry rather than all protection

    Use the target list's available unlock or remove-rule control. Confirm that the entry is Unlocked or no longer in the protected list; do not use Temporary Unlock as a substitute for this change.

  3. Check the result and the remaining locks

    Launch the released app from its normal shortcut, then test another protected app. If the released app should not be added again, add it to the appropriate App Whitelist.

Keep this change separate from Lock Policy, which chooses the launch behavior for the protected list.

Logs and Ongoing Maintenance

Review Blocked Attempts and Logs

Use event records to identify which process was intercepted and whether it matches your intended app.

  1. Create an identifiable test attempt

    Note the time, close the selected protected app, and launch it once from the normal shortcut. Use the current Lock Policy to predict whether you expect a block or a password prompt.

  2. Read Recent Intercept Logs

    On Dashboard, review Recent Intercept Logs and its TIME, PROCESS, ACTION, and STATUS columns. Match the record to your test.

  3. Open Logs for more records

    Select Logs in the sidebar to investigate further. Compare the process with the desktop path or Store target in your protected list, especially when a launcher or an app update is involved.

Intercept records help diagnose app-launch restrictions. They are not a record of everything a user does inside the application after it opens.

Update a Rule After an App Changes

An update, reinstall, or second copy of an app can change the executable or Store target reached by its usual shortcut.

  1. Compare the current target

    After updating an app, review its current executable path or Store entry against the protected list. Check whether the usual shortcut now opens a new launcher or location.

  2. Replace an obsolete rule if needed

    If the target has changed, remove the obsolete entry and add the current executable in Desktop Apps (EXE) or the detected target in Store Apps (UWP). Confirm its Locked status.

  3. Retest the normal launch

    Check that protection is Running and Temporary Unlock has ended. Launch the updated app from its everyday entry point and compare the result and event records with the chosen Lock Policy.

If an update is blocked while you are supervising it, use Temporary Unlock for the maintenance task, then restore protection and verify the updated target.

Recover Access After Forgetting the Password

Use the recovery route linked to the email configured in EXE Lock. Recovery is separate from temporarily releasing apps when you still know the password.

  1. Use the displayed recovery option

    Follow the password-recovery option presented by your installed version. Use the address configured through Settings > Email Settings > Set Email.

  2. Complete the recovery instructions

    Check that mailbox and follow the recovery message or prompts you receive. Complete the instructions for your installed EXE Lock version before testing access again.

  3. Restore and verify access

    After recovery, confirm you can enter EXE Lock and approve a protected launch under Password Verification. If the mailbox or recovery option is unavailable, contact GiliSoft Support with the installed version and the problem.

Once access is restored, review Set Email and the unified password in Settings. Do not delete program or Windows files to try to remove a lock.

Check These Results Before Adding More Apps

Add targets gradually. A correct setting on the policy screen is useful, but the everyday launch result is what matters.

CheckExpected result
Direct BlockThe protected app cannot start; no password prompt is expected.
Password VerificationA wrong password does not release the app. The correct password allows the launch.
Normal launch routeThe desktop shortcut or Start menu entry used every day reaches the intended rule.
Trusted appsRequired work apps and essential Windows components remain available.
After Temporary UnlockProtection is Running again, and a new launch is blocked or prompts as intended.
After an app updateThe target path or package entry is current, and the usual launch still follows the rule.

Troubleshooting App Launch Restrictions

What you seeWhat to check
The app opens without a promptCheck Lock Policy first: Direct Block does not show a password prompt. If the app runs when it should not, check Running status, Temporary Unlock, its current Locked entry, and the actual executable path.
The app is already openClose it and test a fresh launch. A launch restriction is not proof that an application already running has been closed.
A Store app is missingCheck that it is installed for the current Windows account and review Store Apps (UWP). Use only the detected targets supported by EXE Lock.
An app cannot be added to the lock listReview User Whitelist and System Protected Items. A trusted entry is kept outside the protected list; confirm the actual application you meant to restrict.
An update changes the launch resultCompare the current executable, package entry, and normal shortcut with the saved rule. Replace an obsolete target and test again after maintenance.
Temporary access has ended, but an app still runsConfirm the temporary release has ended and protection is Running. Close the app, retest a new launch, and compare its target with the intercept record.
No record matches the testCheck the test time, current status, and executable path. The initial Dashboard screenshot contains no events; do not treat an empty example or zero counter as proof of a successful test.

Frequently Asked Questions

Why can a protected desktop app still open?

Check that Protection Status is Running and Temporary Unlock is no longer active. Close the app before testing a fresh launch. Verify the full executable path: a shortcut may start a launcher that opens a different program. Review the current target after an app update and check the intercept logs.

Why can I not find a Microsoft Store app?

Check that the app is installed for the Windows account you are using and review Store Apps (UWP). Only supported detected targets can be managed there. Some apps have several package or executable entries, so confirm the target with a launch test rather than guessing from the name.

What if an app update changes its path?

Compare the current executable or Store app entry with the protected target. If it is outdated, remove the obsolete rule, add the current target, and retest the normal shortcut. Keep any required trusted apps outside the lock list.

How do I release apps temporarily?

Use Temporary Unlock on the Dashboard for maintenance or supervised access without deleting the protected app list. It temporarily releases protection rather than creating a permanent exception for one app. When finished, restore protection and confirm that Protection Status is Running.

What if a trusted application is blocked?

Use the process and path shown in the logs to identify the affected program. Remove its lock rule or change its status if it should no longer be protected. In Settings, the App Whitelist prevents trusted apps from being added to the lock list; review it before adding more targets.

What if the release password is forgotten?

Use the password-recovery route associated with the email configured in Settings. The current interface uses one Startup / Release Password for entering EXE Lock and approving launches. Configure Set Email while you still have access; contact GiliSoft Support if recovery is unavailable.

Does each app have a different password or lock policy?

The interface shown in this guide uses one Startup / Release Password and a Lock Policy for the protected target list. Choose Direct Block or Password Verification for that list; do not treat the settings as separate passwords or independent policy modes for each app.

Does EXE Lock encrypt the program or its documents?

EXE Lock controls whether a protected application can start on the configured Windows PC. Do not treat a launch restriction as encryption of the executable or every document the application opens. Test the app launch and protect sensitive files separately when needed.

Why is protection Running when no apps are locked?

Running describes the protection status, not the contents of the target list. The Dashboard screenshot shows Running with zero Protected Targets. Add the intended executable or supported Store app, confirm its Locked status, choose a Lock Policy, and test a fresh launch.

Do Select Locked and Select Unlocked change app protection?

No. These are selection controls for choosing rows by their current status. Select Unlocked does not unlock selected apps, and Select Locked does not lock them. Review the selected paths, use the appropriate target-list action, and then check the resulting status.

Why can a whitelisted app not be added to the lock list?

The App Whitelist is designed to keep trusted applications outside the lock list. Review User Whitelist and System Protected Items in Settings. Confirm that you are targeting the intended user application rather than an essential Windows component.

More Windows App Locking Guides

Use the product page for features and license information, or open a focused guide for the kind of app you want to control.

Choose Which Apps Can Open on Your PC

Add the desktop or Store apps you want to control, choose password approval or direct blocking, and keep trusted programs available with the app whitelist.