Note to my stupid-self and other Windows Sysadmins: When making use of the “Run only allowed Windows applications” Group Policy Object, be sure you include “gpedit.msc” as one of the allowed applications. For those in the know, you already know what that means. For those who don’t, well, it just means I’m an idiot. Basically, I locked myself out of the tool needed to lock down other aspects of the machine. Stupid, stupid, stupid.