WEM deletes registry set by a GPO
Administrator restricted some application execution say PowerShell, Command Prompt through Group Policy which sets following registry and WEM delets it. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun...