Fix 0XC0000364: Access Restricted by Admin Policy

You're trying to open a file or run an installer, and bam — error 0XC0000364. The message says access has been restricted by your administrator by policy rule %2. This usually happens on a corporate Windows 10 or 11 machine, but I've also seen it on personal devices after a GPO update or a security software tweak. The trigger is almost always a blocked executable (.exe, .msi, or a script like .ps1) that a policy rule decided was unsafe.

What's actually happening here?

Windows enforces either AppLocker or Software Restriction Policies (SRP) to control what runs. These rules are set by Group Policy or sometimes by security software that hooks into the Windows policy engine. The error code 0XC0000364 specifically points to a policy rule — not a simple permissions issue. It's not about file ownership or NTFS permissions; it's about a blanket policy that says "no."

Find the policy rule that's blocking you

You need to figure out which policy rule triggered the block. The error message includes a rule identifier (%2), but it's often a GUID or a generic name like "Block all unsigned executables." Start by checking the Event Viewer for details.

Step 1: Check the event logs

1. Hit Win + X and choose Event Viewer.
2. Go to Windows Logs > Security (or Applications and Services Logs > Microsoft > Windows > AppLocker if AppLocker is the culprit).
3. Filter for Event ID 8003 (AppLocker) or 865 (Software Restriction Policies).
4. Look for the exact path of the blocked file and the policy name or rule ID.

If you see an AppLocker event, you know where to go next. If it's an SRP event, note the rule name or the hash.

Step 2: Open the Local Group Policy Editor

This only works if you're a local admin. If you're on a domain machine and not an admin, skip to Step 4.

1. Press Win + R, type gpedit.msc, and hit Enter.
2. Navigate to Computer Configuration > Windows Settings > Security Settings > Software Restriction Policies (if SRP is used).
3. OR go to Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker.

Step 3: Disable or modify the rule

If it's an AppLocker rule:

• Right-click the rule blocking your file (e.g., a path rule or publisher rule) and choose Disable.
• Or create an Allow rule for the specific file or folder path. Right-click on Executable Rules and pick Create New Rule. Choose Path as the condition, then browse to the file or folder. Set the action to Allow.

If it's a Software Restriction Policy rule:

• Find the rule (usually under Additional Rules). Right-click and set it to Unrestricted, or delete the rule.
• You can also set the default security level to Unrestricted — but that's a sledgehammer approach. I'd only do that if you're sure you want everything to run.

Step 4: If you're not a local admin

You can't modify policies. But you can:

• Open a ticket with your IT team and give them the exact file path and the rule ID from the event log.
• Ask them to add an exception for that specific executable or publisher.
• Sometimes they can sign the file with a corporate certificate — then it'll pass a publisher rule.

Still stuck? Check these gotchas

• Security software interference: Some antivirus or endpoint protection tools (CrowdStrike, SentinelOne, McAfee) inject their own AppLocker-like policies. Check your security software logs — they'll often show a "blocked by policy" event.
• Corrupted policy cache: Run gpupdate /force from an admin command prompt, then reboot. I've seen stale policies cause phantom blocks.
• Windows 10/11 S Mode: If your device is in S Mode, only apps from the Microsoft Store run. Exit S Mode (Settings > Activation > Switch to Windows Pro) if you need that desktop app.
• Third-party app control tools: Apps like Bit9 or Carbon Black have their own policy engines. They can produce error 0XC0000364 too.

I've hit this error more times than I can count on corporate machines with tight lockdowns. Nine times out of ten it's a path rule blocking a new installer. If you're the admin, just create an allow rule for the folder. If you're the user, don't bang your head — send your IT team the event log info and the file path. They can fix it in two minutes.