DOCUMENT:Q156432 08-AUG-2001 [winnt] TITLE :Windows NT 4.0 Policy Restriction Error at Logon PRODUCT :Microsoft Windows NT PROD/VER::4.0 OPER/SYS: KEYWORDS:kbusage ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Windows NT Workstation version 4.0 - Microsoft Windows NT Server version 4.0 ------------------------------------------------------------------------------- SYMPTOMS ======== Microsoft Windows NT version 4.0 allows administrators to create system policies that determine what programs users can run. In System Policy editor, an administrator can create a user policy, then create a list of allowable executables under User\System\Restrictions\Run only allowed Windows applications on the Properties screen. After creating this user policy, however, the affected user may receive the following error immediately after logging on: This operation has been canceled due to restrictions in effect on this computer. If the user continues past this error message, the Desktop will appear, but the arrow that normally appears, pointing to the Start button with the message "Click here to start," will not appear. Otherwise, the executables allowed in the system policy will run without error. CAUSE ===== After you log on, a program called Systray.exe is run. This program creates the startup arrow and controls the message icons on the taskbar. If Internet Explorer 4.0 is installed, the computer runs another program called Loadwc.exe. For a description of Loadwc.exe, see the following article in the Microsoft Knowledge Base: ARTICLE-ID: Q176960 TITLE : Description of the Loadwc.exe File in Internet Explorer RESOLUTION ========== Add Systray.exe to the list of allowable executables in the System Policy. If Internet Explorer 4.0 is been installed, Loadwc.exe also needs to be added to the list of allowable executables in the System Policy. NOTE:You may also need to add mstinit.exe to the list of allowable executables in the System Policy. Mstinit.exe is part of Internet Explorer 5.5. You may also want to use Regedit.exe or regedt32.exe and look at the following registry key for other applicaions that load during startup: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Additional query words: prodnt ====================================================================== Keywords : kbusage Technology : kbWinNTsearch kbWinNTWsearch kbWinNTW400 kbWinNTW400search kbWinNT400search kbWinNTSsearch kbWinNTS400search kbWinNTS400 Version : :4.0 ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2001.