{"id":25464,"date":"2022-01-02T15:55:48","date_gmt":"2022-01-02T10:25:48","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=25464"},"modified":"2023-07-31T20:35:24","modified_gmt":"2023-07-31T15:05:24","slug":"mrt-exe-blocked-by-system-administrator","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/mrt-exe-blocked-by-system-administrator\/","title":{"rendered":"Fix: MRT.exe Blocked by System Administrator"},"content":{"rendered":"

When you attempt to run the MRT.exe<\/code> or the Microsoft Malicious Software Removal Tool (MSRT) on your Windows computer, the following error may appear:<\/p>\n

This app has been blocked by your system administrator.\n\nContact your system administrator for more info.<\/pre>\n
\"mrt<\/p>\n
MSRT is a tool to remove infections from the computer. This tool scans for a specific, prevalent malicious software, which amounts to a small subset of all the malicious software that exists today. If MRT or MSRT is blocked, then it could be the handiwork of some malware (or in the aftermath of malware removal) on the computer.<\/p>\n
If some policy settings are blocking MRT.exe from running, this article will tell you how to remove those policies and enable MRT.<\/p>\n
Fix: MRT.exe Blocked by System Administrator<\/h2>\n
The “app has been blocked” error implies that MRT is most likely blocked by a custom software restriction policy or AppLocker setting.<\/p>\n
(First, make sure to run a thorough virus scan using the latest definitions. If you’re sure that the system is clean from malware, then proceed further.)<\/em><\/p>\n
To remove the relevant policies that are blocking MRT.exe, follow these steps:<\/p>\n
Windows 10\/11 Professional Edition and higher<\/h3>\n
    \n
  1. Launch the Local Security Policy (secpol.msc<\/code>) applet.<\/li>\n
  2. Expand Security Settings \u2192 Software Restriction Policies \u2192 Additional Rules.<\/li>\n
  3. In the right pane, check if there are any Path or Hash rules that are set to block MRT.exe<\/li>\n
  4. Right-click on that rule (if exists), and choose Delete. Click Yes to confirm the deletion.
    \n\"mrt<\/li>\n
  5. Exit the Local Security Policy console.<\/li>\n<\/ol>\n
    Windows 10\/11 Home Edition<\/h3>\n
    On Windows 10\/11 Home Edition, you won’t find the Local Security Policy console. Follow these steps to remove the corresponding registry-based policy key:<\/p>\n
      \n
    1. Launch the Registry Editor (regedit.exe)<\/li>\n
    2. Navigate to the following key:\n
      HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers<\/pre>\n<\/li>\n
    3. Backup<\/a> the “codeidentifiers<\/code>” registry branch by exporting it to a registry file<\/a>.<\/li>\n
    4. Expand each branch, especially “0<\/code>” and “131072<\/code>” and expand their subkeys.<\/li>\n
    5. Check if there are any values whose data references “MRT” or “MRT.exe”. It could either be a path rule or hash<\/a> rule.
      \n\"mrt<\/li>\n
    6. Let’s say you found the MRT related policy settings under this branch:\n
      HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer\\codeidentifiers\\0\\Paths\\{3eb8ab55-72b7-4bd1-89ce-445c66392411}<\/pre>\n
      All you need to do is right-click {3eb8ab55-72b7-4bd1-89ce-445c66392411}<\/code>\u00a0and choose Delete<\/li>\n
    7. Exit the Registry Editor.<\/li>\n
    8. Restart Windows.<\/li>\n
    9. See if you’re able to run C:\\Windows\\System32\\MRT.exe<\/code> now.<\/li>\n<\/ol>\n
      RELATED:<\/strong> Scanning your PC using Malicious Software Removal Tool (MSRT) and Microsoft Safety Scanner<\/a><\/div>\n
      \n
      Delete the DisallowRun registry keys<\/h3>\n
      If it’s not a Software Restriction Policy, it could be a DisallowRun<\/code> registry key that’s blocking MRT.exe. In that case, you’ll get a different error message than the earlier one:<\/p>\n
      Restrictions\n\nThis operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.<\/pre>\n
      \"mrt<\/p>\n
      which is followed by the error below:<\/p>\n
      \"mrt<\/p>\n
      Malicious Software Removal Tool\n\nYou must be logged on as a member of the Administrators group to run the tool.<\/pre>\n
      To fix the issue, launch the\u00a0Registry Editor (regedit.exe<\/code>), and delete these two keys if they exist:<\/p>\n
      HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun\n\nHKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun<\/pre>\n
      Also, delete the DWORD value named “DisallowRun<\/code>” in the right pane of the following keys:<\/p>\n
      HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\n\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer<\/pre>\n
      Exit the Registry Editor.\n<\/p><\/div>\n
      You should be able to run MRT\/MSRT now. After scanning, MRT writes to the C:\\Windows\\Debug\\MRT.log<\/code> file that contains the details of each scan. Here’s some entries from my MRT.log<\/code> file:<\/p>\n
      Microsoft Windows Malicious Software Removal Tool v5.96, (build 5.96.18833.1)\nStarted On Sun Jan 2 15:20:18 2022\n\nEngine: 1.1.18700.4\nSignatures: 1.353.1477.0\nMpGear: 1.1.16330.1\nRun Mode: Interactive Graphical Mode<\/strong>\nSuccessfully Submitted Heartbeat Report\nMicrosoft Windows Malicious Software Removal Tool Finished On Sun Jan 2 15:44:33 2022\n\nResults Summary:\n----------------\nNo infection found.\nSuccessfully Submitted Heartbeat Report\nMicrosoft Windows Malicious Software Removal Tool Finished On Sun Jan  2 16:05:00 2022\n\nReturn code: 0 (0x0)<\/pre>\n
      Microsoft Windows Malicious Software Removal Tool v5.96, (build 5.96.18833.1)\nStarted On Wed Dec 15 14:20:29 2021\n\nEngine: 1.1.18700.4\nSignatures: 1.353.1477.0\nMpGear: 1.1.16330.1\nRun Mode: Scan Run From Windows Update<\/strong>\n\nResults Summary:\n----------------\nNo infection found.\nSuccessfully Submitted Heartbeat Report\nMicrosoft Windows Malicious Software Removal Tool Finished On Wed Dec 15 14:24:43 2021\n\n\nReturn code: 0 (0x0)<\/pre>\n
      Note that Windows downloads the most recent version of MRT every month (via the Windows Update channel) and scans your computer in the background.<\/p>\n","protected":false},"excerpt":{"rendered":"
      When you attempt to run the MRT.exe or the Microsoft Malicious Software Removal Tool (MSRT) on your Windows computer, the following error may appear: This app has been blocked by your system administrator.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[7],"tags":[191],"class_list":["post-25464","post","type-post","status-publish","format-standard","hentry","category-windows","tag-error-messages"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":4553,"url":"https:\/\/www.winhelponline.com\/blog\/scan-using-malicious-software-removal-tool-msrt-mss\/","url_meta":{"origin":25464,"position":0},"title":"Scanning your PC using Malicious Software Removal Tool (MSRT) and Microsoft Safety Scanner","author":"Ramesh","date":"November 9, 2016","format":false,"excerpt":"Microsoft Malicious Software Removal Tool (MSRT) is a post-infection removal tool which is updated every month and rolled out through the Windows Update channel. Malicious software scanning runs as you install MSRT from Windows Update. You can also initiate scans manually whenever needed by running mrt.exe in the Windows\\System32 directory.\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"msrt vs defender","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/msrt-defender.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":45955,"url":"https:\/\/www.winhelponline.com\/blog\/cant-open-device-manager-any-applet\/","url_meta":{"origin":25464,"position":1},"title":"Can’t Open Device Manager or MMC applets Due to Restrictions","author":"Ramesh","date":"May 14, 2023","format":false,"excerpt":"In Windows 10 or Windows 11. when you try to Device Manager from the Command Prompt (admin) window, the Device Manager doesn't run. The following error message comes up when you do so: C:\\windows\\system32\\devmgmt.msc This file does not have an app associated with it for performing this action. Please install\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"restrictions error disallowrun","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/restrictons-err-disallowrun.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/restrictons-err-disallowrun.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/restrictons-err-disallowrun.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":4472,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-running-alongside-antivirus-program-limited-periodic-scanning\/","url_meta":{"origin":25464,"position":2},"title":"Why Is Windows Defender Running Alongside my Antivirus Program?","author":"Ramesh","date":"October 30, 2016","format":false,"excerpt":"Is Windows Defender running alongside their main antivirus program, as the icons for both programs are visible in the Notification area? Isn't Windows Defender supposed to turn itself off when it detects a third-party antivirus program? Windows Defender and Avast antivirus icons in the Notification area. \"Limited Periodic Scanning\" enabled?\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Limited periodic scanning - Defender settings - Windows 11","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/10\/enable-limited-periodic-scanning-windows-11.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/10\/enable-limited-periodic-scanning-windows-11.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/10\/enable-limited-periodic-scanning-windows-11.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/10\/enable-limited-periodic-scanning-windows-11.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":25816,"url":"https:\/\/www.winhelponline.com\/blog\/startupchecklibrary-winscomrssrv-dll-missing-error-startup\/","url_meta":{"origin":25464,"position":3},"title":"[Fix] StartupCheckLibrary.dll and Winscomrssrv.dll Error at Startup","author":"Ramesh","date":"January 20, 2022","format":false,"excerpt":"When you log in to your Windows computer, the following error message windows may pop up: RunDLL There was a problem starting StartupCheckLibrary.dll The specified module could not be found. RunDLL There was a problem starting winscomrssrv.dll The specified module could not be found. Additionally, you may see the following\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"startupchecklibrary.dll malware startup error","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/malwarebytes-history.png?resize=1050%2C600&ssl=1 3x"},"classes":[]},{"id":80583,"url":"https:\/\/www.winhelponline.com\/blog\/phone-link-blocked-administrator\/","url_meta":{"origin":25464,"position":4},"title":"Phone Link: The feature has been blocked by your system administrator","author":"Ramesh","date":"March 27, 2026","format":false,"excerpt":"When you start the Phone Link app, you may be informed that the feature has been blocked by your administrator. The feature has been blocked by your system administrator. Contact your system administrator for more info. Cause The above message appears when the \"Phone-PC linking on this device\" policy blocks\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"phonelink blocked by administrator","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/phoneline_blocked_by_admin.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/phoneline_blocked_by_admin.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2026\/03\/phoneline_blocked_by_admin.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":5610,"url":"https:\/\/www.winhelponline.com\/blog\/use-controlled-folder-access-windows-10-windows-defender\/","url_meta":{"origin":25464,"position":5},"title":"How to Configure Controlled Folder Access to Stop “Unauthorized changes blocked” Notifications","author":"Ramesh","date":"October 21, 2017","format":false,"excerpt":"Windows 10 and 11 include a beneficial security feature named Controlled folder access, which is part of the Microsoft Defender Exploit Guard. You may have noticed the Unauthorized changes blocked notifications. Microsoft Defender's Controlled folder access feature is the one behind those notifications. Controlled folder access helps you protect valuable\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"defender controlled folder access - blocked apps list","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/wevtutil-defender-blocked-list.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/wevtutil-defender-blocked-list.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/wevtutil-defender-blocked-list.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/25464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=25464"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/25464\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=25464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=25464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=25464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}