So have been working on this but seems i cannot deny for some domain users and not for admins - the CMD can be disabled by another GPO and that works - so will try to look at the DeviceTrust part to see if that can do something - Applocaker cannot work - and we are not using FSLogix

Seems to work just fine in my lab 🤷

need to get a copy of your GPO @James Rankin 🙂

When I get back in the house I will dig it up. You're trying to restrict Powershell to an "allowed" AD group, yes?

yes - regular citrix users deny and admins allow 🙂

So here's a GPO that allows ftp.exe for Administrators and members of a specified AD group

Thanks - same as your link to the online guide I have followed. But got it working now - the problem was I did not unwrap our nested ad groups good enough so I got hit on my admin account - now I have it working but need to restructure ad 🤪