Software Restrictions Inconsistency

Hello,
We use Software Restrictions to block users from launching Outlook on their client machines. We do however allow some users to run Outlook and we do this by assigning them to a group which has Deny permissions to the Software Restrictions GPO.
This has been in place for some time and has been working well, but recently several users have complained that they cannot run Outlook any more. We check GPResult and this suggests that the Software Restrictions GPO is now being applied even though there
has been no change in AD Group Membership.
The issue is resolved by a combination of GPUpdate and reboots/logons but the same user may experience the same issue the next day.
As I say there have been no changes to Group Membership or the actual GPO.
We've configured UserEnv logging for some users but this just confirms that when the functionality is "broken" they are getting the Software Restrictions GPO applied and when it is subsequently "fixed" they are no longer applying
the Software Restrictions GPO. It doesn't explain WHY they see this change from one state to another.
The only other clue we have is this seems to only be affecting XP machines, none of our users using a Windows 7 machine have reported this issue, but it's not all the XP users who are seeing the problem.
This one has me stumped!

Hi,
Thanks for your post.
Based on the question description, this issue could be possible caused by the
AdminSDHolder. To resolved it, please first follow the steps below to check if the users who encountered the issue belong to the protected groups.
Action Plan
==============
1. Click Start, click Administrative Tools, and then click
ADSI Edit.
2. Locate the user accounts above, right-click them, and then click
Properties.
3. Locate the attribute named AdminCount, check if the value of it is 1.
==============
If the value of the AdminCount is 1, this user account belongs to protected groups. Please
delete it from the protected groups, and change value of AdminCount to 0 manually.
Please refer to the article as below about detailed informationrelated AdminSDHolder.
AdminSDHolder, Protected Groups and SDPROP
http://technet.microsoft.com/en-us/magazine/2009.09.sdadminholder.aspx
Hope the information above is helpful to you.
forum case

Similar Messages

How to apply Software Restriction policy for specific user in local group policy object ?

I am working on implementing user based software restriction policy programmatically for local group policy object.
If i create a policy through Domain Controller,i do have option for software restriction policy in user configuration but in local group policy editor i don't have option for that.
When i look for the changes made by policy applied from Domain Controller in registry, they modifies registry values for specific users on path HKEY_USERS\(SID of User)\Softwares\Policies\Microsoft\Windows\Safer\Codeidentifiers
They also have registry.pol stored in SYSvol folder in Domain Controller. When i make the same changes in registry to block any other application, application is getting blocked.
I achieved what i wanted but is it right to modify registry values ?
PS:- I am using Igrouppolicyobject API

I achieved what I wanted but is it right to modify registry values ?
You also can modify a registry programmatically based policy. Check this:
http://blogs.msdn.com/b/dsadsi/archive/2009/07/23/working-with-group-policy-objects-programmatically-simple-c-example-illustrating-how-to-modify-a-registry-based-policy.aspx
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Firefox 8.0.1 bypasses Windows software restriction policy and Windows UAC

With the release of Firefox 8.0.1, Firefox bypasses Windows Software Restriction Policy (SRP).
With Firefox 8.0.0 - (and previous), Firefox conformed to the policy set forth in SRP.
In addition to the fact that Firefox completely ignores Windows SRP, Firefox also ignores Windows User Account Control. Standard, non-admin, accounts are able to install Firefox without administrative privileges. When the user executes the Firefox installer, Windows UAC prompts the user to elevate to install the program. If the user clicks "no" the Firefox installer continues past UAC and installs the program in the user's %appdata%\local folder instead of the %programfiles% (if the user were to elevate). Any other program would have ceased the installation if not elevated.
I haven't seen any other software ignore SRP and continue to run and/or bypass UAC and continue to install.
Please advise on what software policy needs to be in place to prevent Firefox from being installed and ran on my domain.

UAC prevents software from making system-wide changes without an administrator's consent. It's purpose isn't for IT staff to control which software may run, though most installers try to make their software available to all users on the computer.
Are you checking the hash of the installer instead of the executable? Firefox get's updated frequently enough that maintaining hashes will be a lot of work.
I haven't tried this, but perhaps populating user profile folders with a read-only path will cause the Firefox installer to fail. You'll also need to consider [http://portableapps.com/apps/internet/firefox_portable portable firefox]

Windows Media Center - wont launch...due to Software Restriction Policy???

Current system:
Windows Vista x64 Ultimate RETAIL installed onto clean system.
UAC disabled
Using full administrator account w/ no restrictions
Problem:
Anytime I attempt to launch Windows Media Center or Media Center Extender I receive the following popup error and the program does not attempt to to even start:
Error:
[Windows Media Center
"Windows cannot open this program because it has been prevented by a software restriction policy. For more information contact your system administrator."
Summary:
When I initialy installed the OS, this problem did not exist. I was able to launch WMC just fine. Only after a couple month of reinstalling necessary base applications do I now get this error. My family cannot even use it as an extender for the XBOX360 anymore.
From what i can tell there are a lot of people with this issue and NO SOLUTION from MS as yet. I did see in one post that someone else had this error and was able to correct it by setting WMC as the default application in "Default Programs --> Set Program Access and Computer Defaults" This did not work for me at all. At this point I am at a complete loss. Any insight would be appreciated.
-J

For Windows 8 here was the solution that FIXED it for us:
http://windows.microsoft.com/en-us/windows-8/set-program-access-computer-defaults
To start, open the Set Program access and computer defaults page:
Swipe in from the right edge of the screen, and then tap Search.
(If you're using a mouse, point to the upper-right corner of the screen, move the mouse pointer down, and then clickSearch.)
Enter control panel in the search box, and then tap or click Control
Panel.
Under View by:, select Large
Icons, and then tap or click Default Programs.
Tap or click Set program access and computer defaults.
Set program access
If you want to make a program inaccessible without uninstalling it, you can set it so it doesn't appear where programs are typically listed.
On the Set Program access and computer defaults page, under Choose
a configuration, tap or click Custom.
Clear the Enable access to this program check box next to the programs you want to make inaccessible,
and then tap or click OK.
Shawn Lafferty

Exchange 2010 EMC and EMS errors - BLOCKED by software restriction

EMC has this message:
Initialization failed "Execution calling 'GetSteppablePipeline" with "1" arguement: File D:\program files\Microsoft\Exchange Server\V14\RemoteScripts\ConsoleInitialize.ps1 cannot be loaded because its execution is blocked
by software restriction policies"
EMS has this error:
"There were errors in loading the format data file: D:\Program Files\Microsoft\Exchange 2010\V14\Bin\exchange.format.ps1x
ml, , D:\Program Files\Microsoft\Exchange 2010\V14\Bin\exchange.format.ps1xml : File skipped because of the following validation exception: File D:\Program Files\Microsoft\Exchange 2010\V14\Bin\exchange.format.ps1xml cannot be loaded because its execution is
blocked by software restriction policies. For more information, contact your system administrator."
All other powershell scripts work just fine. It is not the execution policy. That is set properly. Authenticode returns valid on the files. There are no settings it GPO to control or cause this. Email working fine. It just started
after a reboot for updates. Any other thoughts before I spend $500 for a call?
Server2008 Standard SP2
Update Rollup 4 v2 for Exchange Server 2010 SP2
Thank you

The long and short of it was Microsoft Certificates didn't update and were expired. I was not given a reason why this happened but the final solution after Microsoft spent 2 weeks on this was to first reinstall Exchange Service Pack 3, reboot. Install
update rollup 8, and reboot. This fixed the EMC but not the shell. Then they reinstalled the rollup 8 again and one more reboot. Everything now works. I'd say with all the other little tweaks they looked at as possible suspect and "other
things" they fixed in their efforts to solve this, I defiantly got my money's worth. Despite not really knowing what really caused the issue in the first place

Media center stopped by software restriction policy

i can't acess windows media center because it is stopped by software restriction policy , it says contact your system administrator. where can i get frsh download or give me solutions. i am on windows 7 premium.

see THIS thread
http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_programs/windows-7-media-center-wont-start-due-to-a/5602d1cb-46ee-426a-b1bb-51d08e7c86e6
and see if the registry edit solves your issue (be sure to back up the registry
first)
On Sat, 17 Dec 2011 21:21:53 +0000, piyush2011 wrote:
>i can't acess windows media center because it is stopped by software restriction policy , it says contact your system administrator. where can i get frsh download or give me solutions. i am on windows 7 premium.
Barb Bowman
http://www.digitalmediaphile.com

Software Restriction Policy not allowing Program Files directory on 64-bit machines

I've created a new software restriction policy, my default security level is set to "Disallowed", I have the standard built-in allowed locations:
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
and I added another exemption for the C:\Program Files (x86) directory:
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)%
However, on my 64-bit machines, there are still programs being blocked in C:\Program Files:
C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe
C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe
These same programs are not being blocked on my 32-bit machines, but the same policy is being applied to both and the programs are installed in the same locations on both.
I checked the registry on one of the 64-bit machines, and the default registry key exemption specified above:
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%
does exist on the 64-bit machine and it is set to C:\Program Files, exactly like the 32-bit machines. So why are programs still being blocked here?
Shaun

Hi Shaun,
>>on my 64-bit machines, there are still programs being blocked in C:\Program Files:
Before going further, are all the applications under the path not able to run or just some ones? Besides, when we run the applications mentioned above, did it tip that it's blocked by group policy? Here, we can run command
gpresult/h gpreport.html with administrative privileges to collect group policy result report to check if this is caused by some other GPOs.
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Software restriction policy not working correctly

Ladies and Gents,
we run a windows server 2008r2 environment.
we have a software restriction policy in place for quite some time now and it's been working fine until about a week ago. here's how we have it setup:
Enforce = All Software files except libraries (such as DLLs). + All Users.
Security Level = Disallowed
Designated File Types=
Defaults
Additional Rules:
C:\* = Disallow.
The rest of the rules are paths for files and folders that we have set as Unrestricted.
Since about a week ago, our security team discovered that they can open any allowed file type such as text file, and then go to file and click on open. In the open dialog box they would type
in C:\Windows\System32\drivers\etc\hosts and then click and open it would actually open the hosts file.
I even tried adding a path rule for C:\Windows\System32\drivers\etc\hosts with Disallow, and it’s still allows opening this file for non admins.
Any ideas as to why is software restriction policy not blocking access to any files or folders that are not explicitly allowed via a path rule?
Any help or comments are much appreciated.
Mohsen Almassud

You are moving in a wrong way. Software Restriction Policies are designed to prevent users to launch executables/applications. It cannot prevent you from opening TXT file, because it is not an executable. In order to prevent TXT files, you have to block
notepad.exe executable. It is very different technology.
You must move to a permission configuration. If there are folders users should not access, remove them from respective folder's ACL. You must be careful with restricting user access to system folders (%systemroot%), because you may block critical applications
and eventually no one will be able to log on to server, because logon-dependant paths are not accessible due to restrictions in the ACL.
My weblog: http://en-us.sysadmins.lv
PowerShell PKI Module: http://pspki.codeplex.com
Check out new:
PowerShell FCIV tool.

Software Restriction Policy help

This policy was working fine, then all of the sudden it is not working anymore.
Blocking from
%AppData%\*.exe
%AppData%\*\*.exe
Here is the error I get
An error has occurred while collecting data for Software Restriction
Policies.
This error impacts the following settings:
Software Restriction Policies
Software Restriction Policies/Security
Levels
Software Restriction Policies/Additional Rules
The following errors apply to all of the above
settings:
A certificate stored by this extension is not valid. Use the Group Policy
Management Editor to reconfigure the settings in this extension.

Hi,
How is the issue going? Where did the certificate come from? For this is also related to the certificate, if the issue persists, we can also ask for suggestions in the
following security forum.
Security
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserversecurity
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
Best regards,
Frank Shen

Adobe and software restriction policy

Hello!
Could you enumerate what other programs are called by acrord32.exe?
I have to use software restriction policies, to prevent run other programs except adobe readre 9.
I set up group policy for user's software restriction policy: acrord32.exe
When I start acrobat reader, the program starts, reader window appears, but I get the following message.
Software cannot be run due to softwre restriction policies and adobe reader stops.
My question is what other programs I have to allow to run acrord32.exe?
Thank's

When a software restriction policy "goes off," Windows creates event-log entries that describe what happened. In many cases, you must be an Administrator to view the contents of this log.
Here's a page that might be useful. (I Googled "software restriction policy" "event viewer" ):
http://technet.microsoft.com/en-us/library/cc737011.aspx
Although it is tedious to set up restriction policies, it can be worth it. (But also make sure that you are observing all the other prudent security practices, most especially making sure that the end-users are not "administrators.")
Realistically, the event log is the only way to determine "what runs what." It is also important that you run your tests from every flavor of user-account that will be affected by the policy, and that you periodically review the event logs to proactively detect errors that end users did not bother to report.

Software Restriction Policy batch vs vbs

Hi there,
I have recently implemented a Software Restriction Policy on a Computer level with Disallowed level as default.
I whitelisted the \\mydomain\SysVol so that my Group Policies could run.
I have a few batch files that run upon user logon. The batch files run but the the commands within them do not, they are being "access denied"
example of one of the batch files:
sc start servicexyz, killtask processxyz
if I were to convert my batch script into a vb script, would vb script be treated as a single file? unlike batch file which makes calls to other executables.
Thanks,

What you are trying to do cannot be done with a GP and cannot be done with a script. Thisis becsue what you are trying to do makes very little technical sense. Either delegate the right or use another method.
¯\_(ツ)_/¯
This is how it worked for me just fine before I introduced SRP.
When user logged off, a logoff batch script used "sc start service" to start service
When user logged on, a logon batch script used "sc stop service" to stop a service from running
Before SRP, all of my users were local administrators of their computers so permissions were not in a way. After the SRP introduction,
I had to remove all users local admin right and now experience this issue.
Do you mean it makes little technical sense with SRP or in general? Care to elaborate please?
Why do you think you have to start and stop the service all of the time? It sounds like a design issue or an issue with a bad service.
You can use SC to give users permissions on a service. You can give out just start and stop (control) to a group thyne add or remove users from the group.
The group can be a domain group and GP can change the security on a service.
¯\_(ツ)_/¯

Software Restriction Policy exceptions for Spiceworks scanning

Is there a list of exceptions that should be added to allow Spiceworks to scan the network? I have a network with Software Restriction Policy blocking anything from running out of the temp folders, and I'm seeing this in the logs:
TextAccess to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Spiceworks\spiceworks_upload.vbs has been restricted by your Administrator by location with policy rule {c5b16481-b6f1-41e2-a202-65ae9ceb3865} placed on path C:\Documents and Settings\Administrator\Local Settings\Temp\*
Will everything Spiceworks related run from the %temp%\Spiceworks folder, or are there other locations?
This topic first appeared in the Spiceworks Community

Hello,
C:\Program Files\Internet Explorer\iexplore.exe
You can try to use this variable:
%ProgramW6432%
It only exists on 64-Bit systems.
Otherwise you can create a WMI-Filter that will enable the policy only for 64-Bit systems.
select * from Win32_ComputerSystem WHERE SystemType LIKE "%64%"
MVP Group Policy - Mythen, Insiderinfos und Troubleshooting zum Thema GPOs:
Let's go, use GPO!
Success! Well, sort of.
I had already tried the WMI Filter but using the system variable worked.
But it only worked for IE 9 and below. IE 10 and above are still displaying the same issues. Luckily we'll be on IE 9 for the foreseeable future so this isn't a big concern.
Thanks Matthias!

Software Restriction Policies?

I have had several SysAdmin's around me state that the CryptoLocker malware has hit them hard. I have been looking into better ways to keep my systems protected and had a few implementation policy questions for those of you running a non-Active Directory environment.
The first question is regarding Software Restriction Policies. Anyone using this through the GPO inside ZENworks? Any recommendations on how best to deploy this to prevent disasters like Crypto?
The second question is regarding other areas, security wise, I should be working with? Recommendations on GPO settings that I should be posting? Other security settings outside of a GPO I should be working on?
I have been rather lucky so far with my Virus issues not being to large but I want to ensure I am doing all I can to ensure I keep the risk to a minimum.
Thanks.
Richard

No, it does not download it to Cache and run from there.
It runs it from where-ever the app runs it.
Most Browswers will run from from AppData and TEMP.
One of the Key item's for Crypto is making sure JAVA is updated and has
proper security settings.
You could also have a process that runs on user logon that wipes your
the HKCU RUN registry key.
These type of apps always pop themselves there, since they won't have
rights to write to any system keys.
Perhaps even have something that revokes the user's write rights to the key.
On 11/7/2013 12:46 PM, rhuhman wrote:
>
> I have a new issue/question regarding policies and how ZENworks
> functions. I set Software Restrictions on my main Computer GPO so that
> it doesn't allow EXE execution from AppData, LocalAppData, Temp, and tmp
> directories. I have one of the staff members show me an error stating
> the bundle for a website couldn't be executed due to a Group Policy
> enforcement.
>
> I guess I am lost now on how ZENworks launches bundles. I always thought
> it was downloaded into the cache location and launched from that
> location. (C:\Program Files\Novell\ZEnworks\cache\zmd)
>
> Which location do I need to worry about or is this unrelated to the GPO
> preventing exe execution.
>
> Thanks for the guidance.
>
> Richard
>
>

RoboHelp9 HTML won't open software restriction policy

My system administrator installed my upgrade to RoboHelp 9 today, but RH HTML won't open and gives a "Windows cannot open this program because it has been prevented by a software restriction policy" error. Note that I do not have admin rights to my PC.

Thanks you for quick answer.
But I have tryed set this options to false.
And restart FF.
Nothing, error still present.
browser.download.manager.scanWhenDone;false
services.sync.prefs.sync.browser.download.manager.scanWhenDone;false
Now i have write small test application thats will start program
<pre><nowiki>#include <windows.h>
#include <stdio.h>
void main(int argc, char *argv[])
static char CommandLine[4096];
if(argc < 2)
printf("\nSoftware Restriction Policy ByPass for FireFox Thunderbird.\n"
"Set this Application Name as Mail Attachment Processing Handler.\n");
return;
sprintf(CommandLine, "Start %s", argv[1]);
system(CommandLine);
}</nowiki></pre>
Application is setup in FF as application for .doc files. And start. But error still present.
But if I set IE as application for .doc files IE will start and will open .doc with Word!
I have found that MS Office and 7-zip, that not works, - are 64 bits applications.
Foxitreader is 32 bit application that is work normally.
Firefox also is 32 bit.

Software Restriction Policy block zipped js file.

Trying to block zipped js files from running. Have applied the following path rule under our software restriction policies.
*.zip\*.js
*\*.zip\*.js
*.zip\test.js
Neither works to block.
Using "test.js" as path rule works fine.
Am I missing something here?
Also I have added JS as a file type in software restriction policies.

Hi Allister Wade 2,
Here is a link for reference of Software Restriction Policies.
Software Restriction Policies
https://technet.microsoft.com/en-us/library/hh831534.aspx
All the failed rules including the letter "*", I am afraid this policy will not support the fuzzy query. Considering test.js will work well ,we would add an exact file path to be forbidden .
What is the purpose of this operation ?If it is used to forbid the ZIP software from running the js file .
As a work around ,we can change the js file association to have a check.(Control Panel\All Control Panel Items\Default
Programs)
Best regards
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Software Restrictions Inconsistency

Similar Messages

Maybe you are looking for