Use cmd when "Run only specified Windows applications" policy is in effect

I am trying to restrict the applications usage on the VM Windows Server 2019. In Local Group Policy editor (gpedit.msc), i modified the policy, on the left pane, click/tap on to expand User Configuration, Administrative Templates, and System, double click/tap on Run only specified Windows applications to edit it.

We added chrome.exe and firefox.exe here.

After that, on the VM Windows Server 2019, i can open firefox and GoogleChrome application as expected and cannot other applications, such as Word, PowerPoint and Outlook.

However, I also cannot open CMD. In the policy description, it shows " It does not prevent users from running programs such as Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt, Cmd.exe, this setting does not prevent them from starting programs in the command window that they are not permitted to start by using Windows Explorer."

The user i used on the client computer is the local administrator with access the CMD definitely. So, what is the problem?

If i can not open CMD, how can i open others applications from the CMD as the policy descripted?

When i try to open another programm, it says here: "this operation has been cancelled due to restrictions in effect on this computer. please contact your system administrator" on administration Account.

I have locked myself out.

Picture

You can't open cmd from Windows Explorer, but you should be able to start Task Manager by pressing Ctrl-Alt-Delete, or by pressing Ctrl-Shift-Esc.

Then, from the Task Manager, you should be able to start cmd.exe from the File menu.

Why? Because this restriction is processed by Windows Explorer. Starting the task manager with the keyboard shortcut or from the Ctrl-Alt-Delete menu asks WinLogon (running as System) to start the task manager for you, bypassing this restriction.