"Run only allowed" GP prevents zen apps

Question

I've just started to experiment with restricted Windows Group Policies an ZMC 10.3. I cant seem to get any restricted applications to run from the nal window like they did in zen 4, 6, or 7 while using the "Run only allowed windows applications" group policy setting.
Before I only had to allow nalwin.exe and nalshell.dll but this no longer appears to work. Other people have posted this issue with versions as new as 10.2 and the "fix" was to allow nalshell.dll but I've already done that.
What am I missing? I dont actually get the usual restriction message like if i tried to run an program from the start menu that isnt allowed, but instead zen give an unspecified error. The apps run just fine using a GP that doesnt have "run only allowed" set.
Any help is appreciated.

Answer 1

I think it would be difficult to get a bug created that said:
"ZCM honors Windows Security Policies"
It was certainly never the intentional design to allow this.
Rogue Process Mgmt was the tool to perform the feature you are
describing in lieu of using the Microsoft GPO.
I'm not aware of any products that do or would advertise this feature,
since a security patch could fix it at any time.
The best bet would be to use file rights to actually control what user's
launch in combination with limiting where programs can be launched.
(Such as from %ProgramFiles%, etc..)
On 6/14/2010 1:56 PM, jkillebrew wrote:
>
> Does this still have something to do with changes in 10.2?
>
> Im not sure how its a security issue, but it certainly works well for
> us, allowing us to restrict users to only run applications from within
> the application window and nothing outside other than a very limited
> list of applications defined by the GP which would include things like
> nalwin.exe, antivirus related items, and maybe office applications that
> would need to be opened by file association.
>
> The greater security hole is that this policy can be defeated by
> renaming a program to the same as something allowed since it works by
> the file name, but students dont know that and dont know what files I
> have allowed so it hasnt been a problem so far.
>
> Thanks for any help you can provide. I'd really like to use ZCM but
> this is going to be a deal breaker for us if we cant get it working. We
> are already struggling to remove duplicate usernames across different
> OUs to support ZCM (makes no sense not to support this if edir allows
> it) so this is just another major stumbling block.
>
> BTW, there are numerous examples of this type of use of GP and zen all
> over the place. People have posted examples on their blogs and I even
> read a cool solutions article suggesting this setup, though this was all
> with 7 or older.
>
>
> craig_wilson;1987251 Wrote:
>> I actually misread your earlier posting.
>>
>> I thought you were having an issue launching the ZEN Components
>> themselves, rather than the the Windows Policy Locking preventing the
>> launch of Apps from NAL.
>>
>> I was not aware that ever worked and am a little surprised it ever
>> did.
>> In fact, I would consider it a fairly significant security hole in the
>> Windows policy that I did not know existed and would be concerned
>> about
>> trying to exploit it.
>>
>> I know ZDM had it's own version, called Rogue Process Management, but
>> that does not exist in ZCM. It may be possible to try and create an
>> enhancement request to get this feature re-added.
>>
>> In 10.0 that shipped, this feature would not really have worked the
>> way
>> ZCM was designed, but could at least work in theory now.
>>
>>
>>
>> On 6/14/2010 11:46 AM, jkillebrew wrote:
>>>
>>> I cannot get approval to open a SR because this isnt in production.
>> We
>>> are just trying to migrate our existing policies over from zen 4& 7
>>> with XP to similar policies using zen 10.3 and Windows 7 to see if
>> we
>>> can possible stick with Novell or if we have to move to a new
>> product.
>>> We must keep restricted policies in place because we use this for
>> K-12
>>> schools where students are malicious.
>>>
>>> So far the only fix is to add the application to the allowed list in
>>> the GP every time we create a new app which would be a huge pain the
>>> butt and would cause great delays in getting new apps deployed since
>>> have to wait for the GP to propogate at login while the app would
>> often
>>> arive ahead of the new GP. This would also allow everyone to run the
>>> application even if they dont have that bundle, unless we are going
>> to
>>> start managing more granular GPs, maybe hundreds of separate ones,
>> and
>>> we would have to keep notes on what GPs have access to what
>>> applications. I'd move to another product before I'd go that route.
>>>
>>> It should be fairly easy to recreate i think.
>>>
>>>
>>> craig_wilson;1987169 Wrote:
>>>> There was a change in ZCM 10.3 in how some of the ZCM Processes
>> Launch.
>>>> They are no longer child processes under explorer and they are
>>>> actually
>>>> started by one of the other ZCM services.
>>>>
>>>> It is possible that this could be related to the issue you are
>> seeing.
>>>>
>>>> Just be sure to let me know if you can't create an SR, because I
>> may
>>>> use
>>>> spare time to try and dupe and follow this up.
>>>>
>>>> However, my preference would be me to try and follow an SR you have
>>>> created.
>>>>
>>>> Just let me know.
>>>>
>>>> On 6/14/2010 10:26 AM, jkillebrew wrote:
>>>>>
>>>>> Thanks for the suggestion. At least one person with 10.2 had it
>>>> working
>>>>> according to another thread on this forum so I was hoping it was
>>>> just
>>>>> something simple. Unfortunately I think we have to pay per
>> incident
>>>> so I
>>>>> cant open a CSR.
>>>>>
>>>>> I tried Procmon on both a pc with and without restrictions and
>>>> compared
>>>>> line by line but they seem to be identical. Something is happening
>>>>> within Zen that isnt showing up on procmon and i dont know how
>> else
>>>> to
>>>>> see what is going on by hind the scenes.
>>>>>
>>>>>
>>>>> craig_wilson;1987046 Wrote:
>>>>>> If you are able to open a Service Request, I would recommend
>> doing
>>>>>> this.
>>>>>> I am not sure if the Agent is tested with that policy, but I
>> think
>>>> it
>>>>>> would be a good idea to get an official method documented.
>>>>>>
>>>>>> In the mean time, I would recommend trying the following........
>>>>>>
>>>>>> Disable the Policy and configure PROCOMON to run from startup.
>>>>>> Use this to see what processes and items launch and run.
>>>>>>
>>>>>> Try adding those items to your list.
>>>>>>
>>>>>> (Note: If you can and do make an SR, please drop me a note at
>>>>>> Craig_d_Wilson at Yahoo, and I will make sure it gets into the
>>>> hands
>>>>>> of
>>>>>> somebody who understands the issue.)
>>>>>>
>>>>>> --
>>>>>> Craig Wilson - MCNE, MCSE, CCNA
>>>>>> Novell Knowledge Partner
>>>>>>
>>>>>> Novell does not officially monitor these forums.
>>>>>>
>>>>>> Suggestions/Opinions/Statements made by me are solely my own.
>>>>>> These thoughts may not be shared by either Novell or any rational
>>>>>> human.
>>>>>
>>>>>
>>>>
>>>>
>>>> --
>>>> Craig Wilson - MCNE, MCSE, CCNA
>>>> Novell Knowledge Partner
>>>>
>>>> Novell does not officially monitor these forums.
>>>>
>>>> Suggestions/Opinions/Statements made by me are solely my own.
>>>> These thoughts may not be shared by either Novell or any rational
>>>> human.
>>>
>>>
>>
>>
>> --
>> Craig Wilson - MCNE, MCSE, CCNA
>> Novell Knowledge Partner
>>
>> Novell does not officially monitor these forums.
>>
>> Suggestions/Opinions/Statements made by me are solely my own.
>> These thoughts may not be shared by either Novell or any rational
>> human.
>
>
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.